Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

€54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

discuss.ai.google.dev

Post reply on HN
Print view View original

281–290 of 325 posts

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#281

Post by glenpierce »

michaelt wrote: post #269
giancarlostoro wrote: post #267

Earlier quoted context omitted.

It shouldnt mean shutting down all your services, it should mean not letting you provision new ones and limiting the scope of what you can continue doing.

If I budget enough to store 1TB of data for 1 month, then on the first day of the month I store 2TB of data - what should the behaviour be after 15 days?

Nuke the data. It’s gone forever if you didn’t back it up elsewhere. This should be a meaningful risk mitigation that I can employ to avoid having a catastrophic financial disaster.

This isn’t a limit I’m setting at some percentage above expected costs, it’s: “I don’t want to take out a HELOC if something goes wrong”

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#283

Post by adriand »

theanonymousone wrote: post #230
adriand wrote: post #167

Earlier quoted context omitted.

You mean openrouter.ai. And yes, on reading this blog post, I immediately reviewed my API keys in OpenRouter to make sure that they were capped. My prod key was capped at $20/day (phew!) but my dev key had no cap, which I just updated. What a horrible story.

But isn't OpenRouter anyway prepaid, meaning the most you lose is your current credit?

You can set it to auto top up if it drops below a certain amount. If you do that, then it would definitely be wise to add a cap. They let you add daily/weekly caps, which is convenient.

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#284

Post by lxgr »

il-b wrote: post #222
lxgr wrote: post #111

Earlier quoted context omitted.

Public API keys are a thing. Arguably they are poorly named (it's really more of a client identifier), and modeling them as primarily a key instead of primarily as a non-secret identifier can go very wrong, as evidenced here.

Yeah, just like “public key” in the cryptography sense

They’re not really cryptographic keys in that sense usually; I’d say “bearer token” is more accurate.

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#285

Post by SAI_Peregrinus »

three14 wrote: post #132
someothherguyy wrote: post #95

Earlier quoted context omitted.

If one ignores 70% of the documentation, it makes for a demonizing blog post about it, sure. " API keys for Firebase services are not secret API keys for Firebase services only identify your Firebase project and app to those services. Authorization is handled through Google Cloud IAM permissions, Firebase Security Rules, and Firebase App Check. All Firebase-provisioned API keys are automatically restricted to Firebas…

The only reasonable design is to have two kinds of API keys that cannot be used interchangeably: public API keys, that cannot be configured to use private APIs, and private API keys, that cannot be configured to use public APIs. There's no one who must use a single API key for both purposes, and almost all cases in which someone does configure an API key like that will be a mistake. It would be even better if the API…

It'd be much better to call them something like "API usernames" or "API Client IDs". Though I also dislike the naming of "public keys" in asymmetric cryptography, for the same reasons, and I'm definitely not winning that fight!

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#286

Post by PufPufPuf »

For personal projects, is there a cloud service that has actual working spend caps? I would perhaps try using a cloud service if I wasn't exposing myself to a risk of losing my yearly income by a small mistake. Or is renting a VPS the only sensible option?

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#287

Post by glenpierce »

Rekindle8090 wrote: post #278
ch0wn wrote: post #142

Earlier quoted context omitted.

This should be illegal. If a contractor your hired to swap out a tile on your bathroom floor billed you for remodelling your back garden, you would obviously have the legal right to refuse that.

"We can either charge per tile, per job or on demand. Or you can have us on call for a year and get any of the former at a discounted rate." "Per tile. Lay tiles until I say stop" >you fall asleep "Wtf why are you still laying tile" "You said per tile and lay until you say stop. That'll be 50k please" How is this the contractors fault?

The cloud services wrote the contract and the UI for their console. They then encourage young developers to try out their tools and encourage a market environment where those skills are needed to secure employment. Some kid goes and tries to build their first web app, they follow instructions and tutorials but miss that a single default selection on a menu three nested layers down is going to cost $2,000 per month. This isn’t disclosed on the page. Sure, it can be determined by reading several different documents, but the provider chose to not show estimates for costs in the setup.

How is that the kid’s fault?

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#288

Post by gettingoverit »

sofixa wrote: post #225
Leomuck wrote: post #145

Earlier quoted context omitted.

That's actually crazy. So I can build a project I love, that does good, but somehow get in a situation where I'm accidentally paying 30.000€ (or 50.000€) to a big tech company? How is that fair? I mean yes, as a software engineer, you ought to reflect on all possible weaknesses, but there was a time when overlooking something meant something completely different than being down 30/50k. That is actually life-altering.

If that happens, you create a support ticket and AWS/GCP/Azure wave it, especially the first time. They're aware that billing per usage can have surprise effects, but at the same time they don't want to kill their customers' workloads and delete their data, so it is what it is.

It's quite easy to check responses to other customers in other threads there, and somehow I see quite a lot of "oh, go to that other support" and ghosting.

If you create support ticket on hacker news, then yes, you will probably get it waved. It's somewhat sad that HN is their support forum now.

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#289

Post by MagicMoonlight »

giancarlostoro wrote: post #267
startages wrote: post #152

Earlier quoted context omitted.

Yeah, that the main reason I never use services like Google Cloud if I don't have to, it's impossible to have a hard cap, and anyone pretending to be an expert, is just off. Google says that they can't provide a hard cap because that would mean shutting down all your services..bla bla, but at least give users the option.

It shouldnt mean shutting down all your services, it should mean not letting you provision new ones and limiting the scope of what you can continue doing.

And just shut down the service which is surging.

If you have a lambda set up that normally runs a hundred times a day, and suddenly it tries to spin up 10 million instances, it should block that unless you specifically enable it.

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#290

Post by william0353 »

Hi I am just curious the reason behind it as I have a firebase app with firebase ai logic service as well.

Is that the apiKey below which was used for web sdk init?

const firebaseConfig = { apiKey: XXXX, authDomain: XXX

Did Zanbezi enabled app check? This is kind worrying...

};

Post reply on HN