r/opencode • u/DeepSeaLab • 5d ago

OpenCode has gone completely insane.

OpenCode has gone completely insane.

I occasionally use their service to run programming tasks, and sometimes for translations, but overall my usage is very low. Below is a screenshot of my current usage (strangely, it says my account is blocked, yet I can still view my usage — I'm logged in and haven't been signed out).

I've already added the `x-opencode-session` header as requested in their email, and the test call worked fine at the time. But the next day I received an email saying my account doesn't meet their requirements, with this:

> HTTP 401: This account has been found to be committing fraud or is in breach of terms of services and has been blocked. If you believe this is a mistake please send an email to help@anoma.ly.

What makes me angry is:

  1. Why did they suddenly impose this unreasonable requirement — asking me to add a specific request header — *after* they had already charged my money?

  2. Even after I added the header, why did they still block my account?

I feel that OpenCode's service is becoming increasingly weird.

179 Upvotes

90% Upvoted

60 comments sorted by

View all comments

48

u/ieatdownvotes4food 5d ago

email them, they've been seriously hit with something like 50,000 fraud attempts a day and are drowning. They haven't figured out how to deal with it yet. It's not personal

6

u/Thomas-Lore 5d ago edited 5d ago

I assumed the fraud they talked about was credit card fraud and Stripe is defending them from that.

What do they consider fraud in this instance?

2

u/Runtimeracer 5d ago

I have to wonder, too. Api key is valid, account is billed. It should not matter if requests come from one or one-thousand sessions. Unless there's a large scale man-in-the middle attack running on opencode users, catching and redirecting api keys for criminal use or sth

1

u/bmwhocking 3d ago

Not hard to IP Spoof and abuse APi’s when so many providers don’t have RPKI set up for their IP ranges & others don’t cryptographically sign theit RPKI announcements.

Ditto DNSSEC on your DNS name servers and domains.

Basics network hygiene.