you posted this in the chromium thread too and ... it's not relevant

I think it might be relevant, this seems to indicate that google is hardcoding their API keys in the shipped chrome binaries. These exceeded, and broke functionality in the app. This seems like a bad security practice and it is very relevant to call it out here.

There's really no practical alternative but to ship binaries with baked in API keys.

Maybe you dynamically provision API keys, but the binary needs a baked in permission to access that API to start with...

so every release goes out with its own API key?

Well, they're obviously going to have to hardcode something into the binary, I think you're imagining an issue that doesn't exist.

Interesting... if you make a chromium derivative, you need to pay for user's google API access. Or replace them with something else.

You can use Mozilla's free geolocation service based on crowd-sourced location data for hundreds of millions of Wi-Fi access points, cell towers, and Bluetooth beacons. The website has a zoomable world map of network location coverage:

https://location.services.mozilla.com/map

Or 'reverse engineer' it to make your own server side software.