6 ms·

In Google AI Studio, Google documentation encourages to deploy vibecoded apps with an open proxy that allow equivalent AI billing abuse - giving the impression

by qudent 8mo ago

In Google AI Studio, Google documentation encourages to deploy vibecoded apps with an open proxy that allow equivalent AI billing abuse - giving the impression that the API key were secure because it is behind a proxy. Even an app with 0 AI features exposes dollars-per-query video models unless the key is manually scoped. Vulnerable apps (all apps deployed from AI Studio) are easily found by searching Google, Twitter or Hacker News. https://github.com/qudent/qudent.github.io/blob/master/_posts/2026-01-16-aistudio-proxy.md https://github.com/qudent/qudent.github.io/blob/master/_post...

gib444 8mo ago
[flagged]
- RobotToaster 8mo ago
  Sure, after 6 years in court you may get a settlement, 95% of which will go towards paying your legal fees.
  - thepasch 8mo ago
    > 95% of which will go towards paying your legal fees laughs in European
    - deleted 8mo ago
      [deleted]
    - pineaux 8mo ago
      I laughed. No in europe when you win a case like this the judge usually forces the losing party to pay the legal expenses of the winner. Especially if the losing party is a big corporation.
      - petcat 8mo ago
        It's the same in the US
        staticman2 8mo ago
        It is not. Legal fees are rarely awarded in the U.S.
        petcat 8mo ago
        I should have said if you recover it in your damages, which every competent attorney will push for.
        staticman2 8mo ago
        Legal fees are not something you are usually legally entitled to. Your attorney can push for whatever illegal thing they can think of, it doesn't mean you will get it.
        malfist 8mo ago
        > Your attorney can push for whatever illegal thing they can think of, it doesn't mean you will get it. It is not illegal to include legal fees in damages.
        deleted 8mo ago
        [deleted]
        staticman2 8mo ago
        By illegal I mean contrary to American law. Legal fees are literally not damages. A court granting legal fees would be doing that in addition to damages. In most cases the jury will never even be told what your attorneys fees are, and they are not permitted to award them: https://en.wikipedia.org/wiki/American_rule_(attorney%27s_fees) https://en.wikipedia.org/wiki/American_rule_(attorney%27s_fe...
        8mo ago
- gmerc 8mo ago
  Not illegal enough to worry about. nothing a peace board donation can’t fix.
- qudent 8mo ago
  I think the fact that it is not possible to put hard spending caps on API keys might be ruled illegal by some EU court soon enough, at least when they sell to consumers (given the explosion of vibecoding end-users making some apps). When I use OpenAI, Openrouter etc., I can put 10 $ on my API key, and when the key leaks, someone can use these 10 $ and that's it. With Google, there is no way to do that - there are extremely complicated "billing alerts" https://firebase.google.com/docs/projects/billing/advanced-billing-alerts-logic https://firebase.google.com/docs/projects/billing/advanced-b... , but these are time-delayed e-mails and there is no out of the box way to do the straightforward thing, which is to actually turn off the tap automatically once a budget is spent. The only native way to set a limit enforced immediately is by rate limiting - but I didn't see params which made it safe while usable in my case. (a legal angle might be the Unfair Contract Terms Directive in the EU, though plenty of individual countries have their own laws that may apply to my understanding. A quite equivalent situation were the "bill shock" situations for mobile phone users, where people went on vacation and arrived home to an outrageously high roaming bill that they didn't understand they incurred. This is also limited today in the EU; by law, the service must be stopped after a certain charge is incurred)
  - Nathanba 8mo ago
    let's hope it happens soon, I'm pretty sick of this reality where companies get to charge you whatever they want and it's designed to always be your fault
    - Eddy_Viscosity2 8mo ago
      > I'm pretty sick of this reality where companies get to charge you whatever they want and it's designed to always be your fault But have you considered it from the companies POV? Charging whatever you like and its always the customers fault is a pretty sweet deal. Up next in the innovation pipeline is charging customers extra fees for something or other. It'll be great!
      - cwmoore 8mo ago
        Healthy, even.
- Matl 8mo ago
  How dare you question a corporation's ability to make unlimited money?
  - blinding-streak 8mo ago
    Will someone think of the shareholders? /s
- dathinab 8mo ago
  I think the term you are looking for is "negligence". But not in the causal sense of the word but in the legal "the company didn't folly the legal required base line of acting with due diligence". In general companies are required to act with diligence, this is also e.g. where punitive damages come in to produce a insensitive to companies to act with diligence or they might need to pay far above the actual damages done. This is also why in some countries for negligence the executives related to the negligent decisions up to the CEO can be hold _personally_ liable. (Through mostly wrt. cases of negligence where people got physically harmed/died; And mostly as an alternative approach to keeping companies diligent, i.e. instead of punitive damages.). The main problem is that in many cases companies do wriggle their way out of it with a mixture of "make pretend" diligence, lawyer nonsense dragging thing out and early settlements.
- chrisjj 8mo ago
  Upvoted. Not illegal, but it should make enforcing payment illegal.
- hluska 8mo ago
  It’s possibly civil, but I don’t see how this type of negligence would be breaking a law. If it was illegal, a massive number of independent consultants would be serving prison sentences. I’m not sure how that makes anything better though I guess a lot of people think rage is fun.
  - marcosdumay 8mo ago
    Civil law is law, and breaking it is illegal. You seem to be misunderstanding it.
- Dylan16807 8mo ago
  > Downvoted for asking an honest question. If you put in "surely" and people think it's quite wrong then they might downvote. It's not personal.

by qudent 8mo ago

gib444 8mo ago

[flagged]

RobotToaster 8mo ago
Sure, after 6 years in court you may get a settlement, 95% of which will go towards paying your legal fees.
- thepasch 8mo ago
  > 95% of which will go towards paying your legal fees laughs in European
  - deleted 8mo ago
    [deleted]
  - pineaux 8mo ago
    I laughed. No in europe when you win a case like this the judge usually forces the losing party to pay the legal expenses of the winner. Especially if the losing party is a big corporation.
    - petcat 8mo ago
      It's the same in the US
      - staticman2 8mo ago
        It is not. Legal fees are rarely awarded in the U.S.
        petcat 8mo ago
        I should have said if you recover it in your damages, which every competent attorney will push for.
        staticman2 8mo ago
        Legal fees are not something you are usually legally entitled to. Your attorney can push for whatever illegal thing they can think of, it doesn't mean you will get it.
        malfist 8mo ago
        > Your attorney can push for whatever illegal thing they can think of, it doesn't mean you will get it. It is not illegal to include legal fees in damages.
        deleted 8mo ago
        [deleted]
        staticman2 8mo ago
        By illegal I mean contrary to American law. Legal fees are literally not damages. A court granting legal fees would be doing that in addition to damages. In most cases the jury will never even be told what your attorneys fees are, and they are not permitted to award them: https://en.wikipedia.org/wiki/American_rule_(attorney%27s_fees) https://en.wikipedia.org/wiki/American_rule_(attorney%27s_fe...
        8mo ago
gmerc 8mo ago
Not illegal enough to worry about. nothing a peace board donation can’t fix.
qudent 8mo ago
I think the fact that it is not possible to put hard spending caps on API keys might be ruled illegal by some EU court soon enough, at least when they sell to consumers (given the explosion of vibecoding end-users making some apps). When I use OpenAI, Openrouter etc., I can put 10 $ on my API key, and when the key leaks, someone can use these 10 $ and that's it. With Google, there is no way to do that - there are extremely complicated "billing alerts" https://firebase.google.com/docs/projects/billing/advanced-billing-alerts-logic https://firebase.google.com/docs/projects/billing/advanced-b... , but these are time-delayed e-mails and there is no out of the box way to do the straightforward thing, which is to actually turn off the tap automatically once a budget is spent. The only native way to set a limit enforced immediately is by rate limiting - but I didn't see params which made it safe while usable in my case. (a legal angle might be the Unfair Contract Terms Directive in the EU, though plenty of individual countries have their own laws that may apply to my understanding. A quite equivalent situation were the "bill shock" situations for mobile phone users, where people went on vacation and arrived home to an outrageously high roaming bill that they didn't understand they incurred. This is also limited today in the EU; by law, the service must be stopped after a certain charge is incurred)
- Nathanba 8mo ago
  let's hope it happens soon, I'm pretty sick of this reality where companies get to charge you whatever they want and it's designed to always be your fault
  - Eddy_Viscosity2 8mo ago
    > I'm pretty sick of this reality where companies get to charge you whatever they want and it's designed to always be your fault But have you considered it from the companies POV? Charging whatever you like and its always the customers fault is a pretty sweet deal. Up next in the innovation pipeline is charging customers extra fees for something or other. It'll be great!
    - cwmoore 8mo ago
      Healthy, even.
Matl 8mo ago
How dare you question a corporation's ability to make unlimited money?
- blinding-streak 8mo ago
  Will someone think of the shareholders? /s
dathinab 8mo ago
I think the term you are looking for is "negligence". But not in the causal sense of the word but in the legal "the company didn't folly the legal required base line of acting with due diligence". In general companies are required to act with diligence, this is also e.g. where punitive damages come in to produce a insensitive to companies to act with diligence or they might need to pay far above the actual damages done. This is also why in some countries for negligence the executives related to the negligent decisions up to the CEO can be hold _personally_ liable. (Through mostly wrt. cases of negligence where people got physically harmed/died; And mostly as an alternative approach to keeping companies diligent, i.e. instead of punitive damages.). The main problem is that in many cases companies do wriggle their way out of it with a mixture of "make pretend" diligence, lawyer nonsense dragging thing out and early settlements.
chrisjj 8mo ago
Upvoted. Not illegal, but it should make enforcing payment illegal.
hluska 8mo ago
It’s possibly civil, but I don’t see how this type of negligence would be breaking a law. If it was illegal, a massive number of independent consultants would be serving prison sentences. I’m not sure how that makes anything better though I guess a lot of people think rage is fun.
- marcosdumay 8mo ago
  Civil law is law, and breaking it is illegal. You seem to be misunderstanding it.
Dylan16807 8mo ago
> Downvoted for asking an honest question. If you put in "surely" and people think it's quite wrong then they might downvote. It's not personal.