Chrome's geolocation fails daily due to API limit

https://bugs.chromium.org/p/chromium/issues/detail?id=753242

by zspitzer • 9 years ago

117 25 9 years ago

bugs.chromium.org

Flammy• 9 years ago

Heh, so Google's own projects run into Google rate limits too.

Scaevolus• 9 years ago

Rate limits are how services prevent even legitimate clients from accidentally destroying them!

blaisio• 9 years ago

It's pretty weird in this case.

Google serves web pages and adds rate limits to keep people from taking their servers down (or, at least, from making them use way more servers than normal, which would make providing the services too expensive, which would force them to take the servers down). If their servers go down, then users can no longer use their web pages properly. But, here we see the rate limiting is itself keeping users from using web pages properly. So the rate limiting is effectively disabling services even though the whole point of the rate limit is to protect them!

I wonder if there are other feedback loops in Chrome where, in order to be able to keep serving web pages, Google could sometimes accidentally prevent Chrome users from viewing web pages?

xpaulbettsx• 9 years ago

https://www.chromium.org/developers/how-tos/api-keys

wehere1• 9 years ago

you posted this in the chromium thread too and ... it's not relevant

berg43w2t3t• 9 years ago

I think it might be relevant, this seems to indicate that google is hardcoding their API keys in the shipped chrome binaries. These exceeded, and broke functionality in the app. This seems like a bad security practice and it is very relevant to call it out here.

mastax• 9 years ago

Interesting... if you make a chromium derivative, you need to pay for user's google API access. Or replace them with something else.

ktta2• 9 years ago

Or 'reverse engineer' it to make your own server side software.

cpeterso• 9 years ago

You can use Mozilla's free geolocation service based on crowd-sourced location data for hundreds of millions of Wi-Fi access points, cell towers, and Bluetooth beacons. The website has a zoomable world map of network location coverage:

https://location.services.mozilla.com/map

gondo2• 9 years ago

does this mean that technically (not legally) one can extract API credentials form chromium/chrome and use them in other project?

KekDemaga• 9 years ago

You can do that for practically any API you can imagine if you are creative enough.

gondo2• 9 years ago

i don't understand what do you mean. how can i do that? f.e. how would i do that with AWS API?

the thing with chromium is: it is open source (you can find the credentials), it is meant to be used on any computer via any IP (you can't whitelist API requests)

jpatokal• 9 years ago

You can apply on server-side restrictions on Google API keys:

https://developers.google.com/maps/documentation/javascript/...

https://developers.google.com/maps/faq#keysystem

The most secure approach is to get a premium plan with a cryptographic key and sign your requests serverside. This is complicated/not feasible for some APIs and client-side applications though.

Disclaimer: Googler, used to work on Google Maps, nothing to do with Chrome.

TorKlingberg• 9 years ago

Lots of mobile apps ship with API credentials in the binary. The whole thing runs on the honour system basically.

zspitzer• 9 years ago

I've been told this has been addressed.

If you want to test POSITION_UNAVAILABLE, IE 11 always fails after the first request.

For anyone interested, the location emulation in Chrome Dev Tools is also buggy, Chrome also fires two callbacks on failure, TIMEOUT and POSITION_UNAVAILABLE https://bugs.chromium.org/p/chromium/issues/detail?id=542923

ncr100• 9 years ago

Comment 9 by scheib@chromium.org, Today (33 minutes ago) Status: Started Thank you for reporting. We have adjusted API limits that should ease this immediately. Our monitoring is clearly not sufficient and we will follow up with process improvements to avoid this recurring.

spaniard_dev• 9 years ago

I'm almost sure this also happens with the translation API. Some days when I try to translate websites I get 403 errors and I have to wait for some time until I can use the feature again.

Chrome's geolocation fails daily due to API limit

Related Stories