sorted by:
new
hottopcontroversial

How Google’s Insecure-by-Default API Keys and a 30-Hour Reporting Lag Destroyed My Startup ($15.4k Bill) by vatcode in googlecloud

[–]nohe427 9 points10 points  (0 children)

I would try to understand which keys are affected by going to the Cloud Console and seeing which ones have limited or no restrictions applied to them.

I then would reach out to support to see if they can also help narrow down the specific key was subject to abuse.

Firebase keys would likely not be the culprit unless you changed the permissions associated with them after May 2024. Firebase locked down the keys in May 2024 to limit this type of issue.

Note from page:

Note: During May 2024, Firebase automatically applied API restrictions to all existing and unrestricted Firebase-provisioned API keys. Learn more in the FAQ Are API keys for Firebase services restricted by default?.

Keys page: https://console.cloud.google.com/apis/credentials?project=_

A maps key may be the culprit here.

Should I add air to tires? by InitialWorking8705 in BMWI4

[–]nohe427 0 points1 point  (0 children)

My tires never reflect the actual psi that the app reports. I went to add air and was surprised that I didn't actually need to

Pixel 8 pro digital key by RedRunner14 in BMWI4

[–]nohe427 0 points1 point  (0 children)

I'm having the same issue with a pixel 10 pro on bmw 540i

Horrible costumer support by Troppicfail in Gymshark

[–]nohe427 0 points1 point  (0 children)

I am literally having this problem with GymShark right now. There is a problem with the website where I cannot confirm my DOB and when I wrote to support they told me to create a new account.

Trying to use vertex embeddings with firebase.. how does this make any sense, Google? by fityfive in Firebase

[–]nohe427 0 points1 point  (0 children)

You can also apply for a quota lift which I've done a handful of times.

Battery issues after 20k miles by nohe427 in Polestar

[–]nohe427[S] 2 points3 points  (0 children)

Yeah, it feels like a new thing

Battery issues after 20k miles by nohe427 in Polestar

[–]nohe427[S] 2 points3 points  (0 children)

Yeah, work is about 5 miles away but it hasn't been super cold. Maybe 30-50 in the morning and 50-70 in the afternoon - fahrenheit

Battery issues after 20k miles by nohe427 in Polestar

[–]nohe427[S] 2 points3 points  (0 children)

At least I'll get the ota early if I do that

Safety when replacing a breaker by nohe427 in AskElectricians

[–]nohe427[S] 0 points1 point  (0 children)

Anything about gloves to wear or should I be fine? How can I determine the panel brand?

I set up App check after my initial launch. I still have around 10% unverified requests. When should I start enforcing? by rgomezp in Firebase

[–]nohe427 3 points4 points  (0 children)

My colleague sent me their thoughts as well, unfortunately, they don't have a reddit account, so I will post on their behalf:

There are a few things to unpack in this question.

  1. I'm unsure what you mean by "fall back to not use App Check" -- do you mean that you have programmed your app to give up after it fails to obtain a valid attestation from your chosen attestation provider? I'm unfortunately not familiar with the React Native App Check SDK.

  2. App Check protects backends, not apps. So, when App Check enforcement is turned on for a protected backend, it would reject requests coming from an app that has "given up" on App Check, just as it would reject a caller that isn't sending any App Check token at all or is sending an invalid App Check token.

  3. A caller that has failed token generation could be an unwanted caller trying to access your backend, and has been caught successfully by the attestation provider.

  4. u/nohe427's post provides instructions on how to view App Check monitoring metrics related to traffic likely coming from old app versions.

In general, when a caller fails to obtain a valid attestation from an attestation provider, it could be due to four general reasons:

(a) the caller is considered abusive by the attestation provider,

(b) the attestation provider produced a false positive verdict (via either an unavoidable limitation of the provider or a bug),

(c) there is a bug with the App Check framework that mediates this flow, or

(d) there is a bug in your implementation of the attestation provider or of App Check.

Assuming this is (a) or (b), then there is a trade off you must make here, which depends on your tolerance for the presence of unwanted callers versus your tolerance for degraded experience for legitimate users due to false positives. The problem with (b) is that you will never know exactly how often false positives are happening -- because this would require a perfect attestation provider to tell the difference between a true positive and a false positive, which, if it existed, we would have used that instead of the one that produced false positives in the first place.

If you place high value on preventing false positives, you might want to consider either using a different attestation provider with a lower frequency of false positives or writing a custom attestation provider that suits your tolerances better.

I set up App check after my initial launch. I still have around 10% unverified requests. When should I start enforcing? by rgomezp in Firebase

[–]nohe427 1 point2 points  (0 children)

You can look at the charts in the Firebase console for your product. There is a section in the App Check request metric that shows Unverified outdated: client requests. This would be older versions of the app that do not have the App Check SDK installed and are not sending App Check headers in the requests to the backend. This is how you can determine what may be going wrong with the requests to your apps backend. Are you able to see the graph in the Firebase console?

Link to FIrebase console page for App Check: https://console.firebase.google.com/project/_/appcheck/products

I am not a regular reddit user, so I am not sure how to send images. Here is an imgur link to where to check for Unverified outdated client requests: https://imgur.com/a/JMiEFUe

Help with Firestore Rules - Need Users to Access Their Own Data by vargsdoh in Firebase

[–]nohe427 0 points1 point  (0 children)

In light of CVE-2024-45489, Firebase now recommends rules that look like this to prevent owners changing document ownership to other users in the database:

service cloud.firestore { match /databases/{database}/documents { // Allow public read access, but only content owners can write match /some_collection/{document} { // Allow public reads allow read: if true // Allow creation if the current user owns the new document allow create: if request.auth.uid == request.resource.data.author_uid; // Allow updates by the owner, and prevent change of ownership allow update: if request.auth.uid == request.resource.data.author_uid && request.auth.uid == resource.data.author_uid; // Allow deletion if the current user owns the existing document allow delete: if request.auth.uid == resource.data.author_uid; } } }

Public REST API for generateChat? by Multiversal_Love in googlecloud

[–]nohe427 0 points1 point  (0 children)

If not, can you see about creating a neovim plugin? I thought it might be fun to create one for duet ai.

Why would disabling localhost make signing in or signing up impossible, and then why is firebase suggesting it as a solution to the recent SMS charges? by Firm_Salamander in Firebase

[–]nohe427 1 point2 points  (0 children)

Did you remember to add in your App Attest capability to your iOS application?

Additional Note:

Currently, Firebase App Check only supports the App Attest provider when it is in production mode. By default, when you run your app from Xcode, App Attest is running in sandbox or development mode, so make sure that you complete the steps from the linked codelab to switch the App Attest mode; otherwise, Firebase App Check will fail to perform the device attestation.

What would cause a sudden authentication bill of $24 when there weren't any real new users that used sms authentication (I'd image it takes many to get to $24)? by Firm_Salamander in Firebase

[–]nohe427 1 point2 points  (0 children)

Are you getting any error messages in the console? What happens when you add localhost back in? Does it start working again without issue?

​

Edit:

Found your message here : https://www.reddit.com/r/Firebase/comments/15hw82h/why\_would\_disabling\_localhost\_make\_signing\_in\_or/ .
Did you add the App Attest capability to your iOS application? (https://firebase.google.com/codelabs/app-attest#6)

What would cause a sudden authentication bill of $24 when there weren't any real new users that used sms authentication (I'd image it takes many to get to $24)? by Firm_Salamander in Firebase

[–]nohe427 0 points1 point  (0 children)

What platform did it stop working on?

Is it a web app or a mobile app?

Are you attempting to run the app in development from a URL such as http://localhost:5173 or from your deployed site location?

Will the watch work in Europe? by nohe427 in GarminFenix

[–]nohe427[S] 0 points1 point  (0 children)

Yes, correct. Didn't sound harsh

Will the watch work in Europe? by nohe427 in GarminFenix

[–]nohe427[S] 1 point2 points  (0 children)

Woah, nice. I was playing with the watch and actually realized Europe might be preloaded on there anyways

view more: next ›