Hacker News Reader

"This includes failed attempts which are blocked by their security rules."

Ouch!

> Ouch!

Yeah, no kidding. It means someone nefarious (or bored) can easily run up a huge bill by just directing a ton of invalid requests to their API.

Many inexpensive hosting providers provide you with a lot of bandwidth (e.g. Scaleway offers unlimited bandwidth at ~200MBit/s). Assuming you can saturate the link, that's around 64TB per month of traffic. Quite the Firebase bill they'd have.

well it's not like anybody has the business model of doing denial of service attacks that stop when the ransom is paid, because if someone did have that business model this seems like a great way to make sure people will pay you. I mean just do like enough to cost $500 and say pay me $1000 today or you will pay google $10000 tomorrow.

I'm guessing that spamming invalid request on all of firebases customers endpoints is the most efficient way to deal with the whole ordeal... If a large enough customer base gets the problem they'll have to act... Unless they can happily close up shop because Google owns them... Ah well :(

Reply on news.ycombinator.com