Hacker News Reader

Comment by drawkbox | Hacker News Reader

Another confirmation that engineers and product developers are no longer in control at Google.

Engineering and product first is how Google won the game initially, very easy to forget that when the money rolls in massively and the power structures move away from those driving forces.

Microsoft already went through this engineering/product growth to bizdev/marketing control to stagnation and is already in the return to engineering/product first phase. Basically their own Ballmer era is what Google is entering.

Bizdev + marketing are hugely important, but the products and engineering need to be the focus. It is much easier to bizdev and market a product and engineering led system/focus, though success through this is always forgotten when massive success comes around because engineering/research and development are hard to quantify and put metrics to which the power structures move away from.

Let's hope there are factions of engineering/product focused people in Google that can gain back control.

View on HN

I assume this is the engineering at work.

"Okay, users are confused by how they're logged into Google but not Chrome, or Chrome but not Google - let's make them one and the same".

"Okay, but once you're logged into Chrome now, every post we check to see if we have the Google cookies to keep that sync... so that means when you clear the cookies the Google ones will automagically reappear"

"Ugh, let's just notify the user that clearing the cookies won't clear the Google ones"

"Yeah, that works".

Come on, we're all developers here, we all know how these conversations work.

Hackernews needs it’s own version of infowars where people can declare and believe in their most absurd and cynical conspiracy theories regarding tech.

as long as it also pushes dubious health supplmenets

What makes this a cynical and absurd conspiracy theory? Is it that cookies are being kept so as to not break browser login, or that the decision-making was driven by software engineers?

Everybody at Google, for anything they do, should ask a simple question on any proposal ... how does this impact user privacy for those that care?

Given Google's size and power it's irresponsible for them to not do so.

And given that there are really smart people working for Google, including a whole department working on analyzing the threats and preserving user privacy, I won't believe for a second that nobody thought of this. Which may mean that they don't care, even if they did once. And again, given their size, their power, their potential for harm, that's not OK. With great power comes great responsibility, bla, bla.

So I'm not buying that.

Also, now that the shit has hit the fan, lets see what they do in response. Probably nothing ;-)

You're kidding, right? Selling user privacy is how Google makes their money. Other than Facebook, there probably isn't a single company out there less interested in protecting user privacy.

Unless you use G Suite.

Agree. It's just about respect. If you respect your users, it's clearly evident. Google doesn't.

> how does this impact user privacy for those that care?

Can you answer this for me?

Given the scenario - when you clear cookies all cookies are cleared but new cookies for google services are set again, what is the privacy concern for end users?

This idealism reminds me of a post I saw here a long time ago about a software developer union. One of their stated goals was "to advocate for people whose job was displaced by automation".

Both read to me immediately like high octane, weapons grade, 200 proof naiveté.

"Everyone at UPS, for anything they do, should ask a simple question on any proposal ... how does this impact bicycle couriers?"

"Everyone at Amazon, for anything they do, should ask a simple quesiton on any proposal ... how does this impact local mom and pop general stores?"

The organization you're talking about is diametrically configured to oppose the thing you're saying they should be mindful of. I just don't even know how it's a thing you can imagine is possible in this world.

This comment reads to me like someone saying. "When anyone in the world is about to shoot another person, they should stop.. think about what they're doing and then _not_ shoot them. This would reduce the number of shootings dramatically."

I uh.. atleast to some degree agree with all the above things.. despite that, there's a whole axis of maximum confused exasperation I feel reading about them.

> The organization you're talking about is diametrically configured to oppose the thing you're saying they should be mindful of

True. That's precisely why engineering ethics is our last hope.

If our last hope depends on any kind of unity of intent among members of our profession then we're doomed.

It's at this point I am tempted to unpack what precipice we're about to go over when our last hope disappoints. Instead i'll stop on an optimistic note: everything is terrible and nothing matters, but humans will keep doing human stuff for as long as we can. By some measures things will continuously improve and by some others we'll regress and retry old tyrannies under new epochs. The ebb and flow can't be arrested by unity while we all hate each other like we do.

Fortunately, we'll only keep on hating each other until we get something else we hate even more. Make no mistake, some day we'll all come together to hate something else again. The unity of action that'll afford will allow us to do some pretty remarkable things. Hopefully the thing we all hate together actually deserves it this time. It doesn't always work that way ;(

It absolutely isn't.

Industries are regulated because they don't naturally do what society wants. Regulation changes their incentives and behavior to make that happen.

A leopard can't change its spots and an ad-tech company is never going to design their products with preserving privacy first, because they can't [1]. It's like a body rejecting an organ transplant.

[1] https://en.wikipedia.org/wiki/Privacy_by_design

That is why I wrote the essay. The history behind that is not simple.

Mhm. In the same way that imbuing stoats with a sense of empathy will help restore endangered bird numbers.

As another comment stated, direct governance in the form of regulation is the appropriate tool for this problem. Other options, especially hoping for an application of a particular ethical framework, is dreams.

I can see how the programmer example is analogous to the others and shows naïveté.

I don't see how any of those is analogous the parent's suggestion. Privacy is not a business rival to Google (as Amazon to small shops or UPS to bike couriers).

True, the attribute privacy hurts one of Google's profit channels; but then, it also makes the product less attractive [1] to the users it needs and exposes it to legal liability, or may leak information that hurts users and hurts profitability in other ways. Even if Google benefits from loss of privacy in some respects, it is hurt in other ways by not consistently, predictably enforcing privacy boundaries.

Neither is true for Amazon vs mom-and-pop or UPS vs independent bike couriers.

Lumping them together is unfair and only communicates "there exists a superficial similarity to an argument that's stupid".

[1] I get it, "if you're not paying, you're not the customer..." My point should be clear though.

Google's takes money from group B, and use their tools and tech to convince group A to give money to group B.

Data about A is the fuel for the machines that allow them to provide value for group B. I removed the indirection in my metaphors to try and communicate how the "consciousness" of a large company views the assertion. If you view google as a sentient entity, it looks upon comments like the GP as though they're coming from children.

I could've added more parity by replacing the business rivals with the words "decentralization" on all of my examples, but I think it muddies the message for no gain.

"Google should think about what it's doing to people's privacy!" sounds naive to me because google does exactly this! The levy of google's smartest are constantly trying to find ways to gather more data, or infer more things from the data they've got.

Privacy is more of a business rival to google than any other company. Alexa, Google Assistant, Siri -- they're all just new pump jacks.

Really, the whole concept of the parent shows a lot of naiveté I didn't even address. 7/10 engineers on a floor agreeing not to take the "mind control plebs" ticket doesn't do a thing when there's enough people to complete it anyways. Your gesture didn't do anything.

Publicly martyring your career for your idealism DOES add a nugget of fuel to society's awareness and opinions about the thing, but I suspect the issue is just too oblique right now for that fire to get started.

Off topic, but I have a sneaking suspicion that Facebook / Google are >100 years ahead of everyone else in sociology. At some point the code's just cracked, and taking away the keys doesn't do anything but deepen the moat around Facebook / Google.

If those companies are ever defeated in war, I suspect that their contribution to society will be similar to Unit 731, Ahnenerbe, or any of number the other non consensual human experimentation throughout the years. We'll tut tut about the unethical mongrels while telepathically scheduling the chores of our vat grown slaves made possible by the abuses of this era.

Or maybe engineers will just agree to stop sometime soon and that'll be that!

You're saying it's idealism, I wouldn't call it that.

This to me is the social contract that binds our relationship as consumers with these companies.

If I cannot trust them, it means I can no longer recommend Google. And I already stopped recommending Google's products a while ago. What changed now is that ... I'm actively recommending against them to everyone I know and that is using a Google product that I happen to notice.

Of course, I'm a single individual, I can only influence my friends and my Twitter followers maybe, and I'm sure most of the time I'm preaching to the choir.

But I felt that way when I was recommending against Microsoft, since 2005. And guess what, enough people started to do it and it started eroding on their influence and market share, coupled with their own blunders of course, the classic "inovator's dilemma".

And as a datapoint, I think one of the primary reasons for why Windows Phone was a failure was because developers rejected it, due to it coming from Microsoft. Now you can talk all you want about market share, monetization and tell people that developers go where the money is, but I remember people hacking for Android phones ever since they hit the market and it took a really long time for Android to become barely profitable for app developers (it still isn't actually), not to mention a worse experience compared with Apple's APIs, yet developers embraced Android. Thus that lost sex appeal and trust that Microsoft had back in the days of Windows 95 was lost and they still haven't recovered, which prevented them from getting a foothold in a market that really matters for their future.

Nowadays Microsoft is doing fine, but they had to make some drastic changes to regain the lost trust, as they were going downhill, even if it wasn't necessaril and please notice that in spite of their best efforts, they still haven't regained that trust. Notice what happened when they acquired GitHub. Not the kind of reaction you expect when you buy something for 7.5 billion. Although I'm sure people will get over it soon, if they don't screw it, like they screwed Skype that is.

So you know ... I might be idealistic, my colleagues too, but judging by HN's reaction and the reaction of people I follow on Twitter, to me it's clear Google's image has changed and it does matter because we can influence their future.

Companies can choose to not care. But that's how they eventually become irrelevant.

> how does this impact user privacy for those that care?

Maybe it's even more important to ask "how does this impact the user privacy for those that don't care?"

Because that group appears to be the majority...

If that is the case, I recommend some basic privacy and security training for every engineer. I believe the root cause at Google is elsewhere though, its goal is to make money, lots of it.

Don't they have anybody from the legal department to oversee the decisions of developers? A wrong decision could cost them millions in fines in these days.

Are these fines actually ever collected/paid?

I remember the five billion dollar fine sourced out of GDPR, but is that ever actually initiated or part of an ongoing power play?

Perhaps to your point... how could legal have not signed off on these updates?

Answer: no way in hell. Legal most assuredly signed off; Google decided they have no liability, formally.

Yet, it coincidentally has the properties to keep your ad tracking identity in tact, so Google can serve you ads based on your online profile. What a wonderful side effect. I'm sure they had no idea that would be the case, just pure luck.

Maybe for something small? But also an “engineer at work” might stand up for not doing the lazy thing on principle.

Furthermore, I see all this anger about this technical decision affecting peoples privacy, but have not yet seen someone provide a good engineering solution to the problem it was trying to solve.

Example Use Case: I was contacted by my poor old mother recently who said that she was logged into "The Google" but was seeing the wrong emails! She was horribly confused.

What had happened was that my sister had checked her email on my mothers computer and forgot to log out. My mother was logged into Chrome (as it correctly said on the top right of the browser) but didn't understand that logging in/out of Gmail was a different thing.

To blame non technical users for being confused here is unfair at the least. And I'm sure there are millions of them with the same problem.

A technical user who cares about privacy can:

- not log into Google and use an external email client for Gmail

- use Gmail in incognito

- disable Chrome auto log in via the preferences (although I haven't tried this myself some people say it works, although I've seen conflicting info about if this works in future versions of Chrome).

- use Firefox (but if you are still using Gmail I'm rolling my eyes here)

I personally don't think it is too evil that Google cares more about people like my mother than advanced privacy conscious technical users.

Also I can't see how auto syncing ones account with Chrome really damages privacy any more than what is there now? If you are logged into Gmail they have your cookies while you browse the web anyway. If you privacy conscious enough that you log out of Gmail every time you are done, fair enough, but I would suggest not using Gmail at all in that case.

But most importantly I'd like to hear a better engineering solution for people like my mother?

> But most importantly I'd like to hear a better engineering solution for people like my mother?

Sounds like not having to be logged into your web browser would be a good start, then you'r mother wouldn't have been confused between being logged into chrome and logged into gmail. This is a problem google created in the first place and now you're giving them credit for fixing it.

> I personally don't think it is too evil that Google cares more about people like my mother than advanced privacy conscious technical users.

They care about her so they can harvest her data and manipulate her.

I'm not generally a fan of the privacy hysteria around Google/FB, etc. But I think the solution here is pretty clear: Don't build a login system for your browser. It's inherently confusing.

It's inherently confusing.

Rubbish.

What's confusing is having a zillion usernames and passwords for every site on the internet, and "doing it right" (which only a tiny percentage do) requires installing password manager extensions in your browser. In practice billions of users use the same insecure password everywhere including their banks.

You may or may not like the implications of centralizing authentication to a few players, but it is a massive improvement in security and usability over what we have now.

I am quite happy with this change, and hope to see "log into chrome" as the equivalent of "log into all websites that use google auth". It will simplify not only my own life, but all of my customers' lives (my B2B SaaS service uses Google auth).

Logging into your browser is not the same as logging into all the sites you use. And you certainly don't need browser login to enable it - just use OAuth. This is a solved problem.

I suggest you try spending a few hours in my support channels.

The problem is that users are confused by the fact that "logging into your browser is not the same as logging into all the sites you use". You can literally sign into chrome with one google account and then sign into google with a totally different google account. Futhermore chrome has different "people" (browsing profiles) which confuses them even more; there's three different things that look vaguely like identity here.

You think this is just fine, Mr. Oauth, but I guarantee you it's a giant mess for the 99.9% of humans who have no idea what oauth is.

Chrome usability would be significantly improved by collapsing "logged into chrome" and "logged into google" into a single thing.

It seems to me like you provided no arguments how is login-into-browser feature clarifying things. You even mentioned people being _confused_ about it.

People don't need to understand oauth to use it.

(and before you pull that one again - I am supporting technically-illiterate people quite often)

It would be a world of simplicity if I logged into the browser with my google account, a little picture of myself showed in the top right corner of the browser chrome (instead of in various places in different apps), and that identity is what was used for per-app Google auth.

I should also mention, there's another place it gets used - in Chrome extensions. That should use the same identity.

Google login then becomes one reasonable choice for "log into the internet". Right now it's too fractured to be a coherent identity.

> I should also mention, there's another place it gets used - in Chrome extensions. That should use the same identity.

That's actually good use case for the browser login feature. (when one is using some google-acc-connected extension)

But for ordinary users I don't think this solution would work flawlessly, because it is different than ones before (and users learn new things slowly).

However if that would be the actual implementation (force logging everywhere into the same acc) I agree it would be simpler for end-users. But it is not, therefore original point (browser login is confusing people) still stands. And therefore teaching users to rely on it does not seem like a good idea.

I realized that Chrome now (M69) forces the forced-logging-in solution (not sure, cannot test atm). Then my post is mostly moot (can't edit already), and for simple-users is this change probably good.

People don't need to know what OAuth is to use it. I've built and provided support for a site used by thousands of adults and even children! They rarely had problems understanding OAuth. So, maybe make a better argument than "you just don't have experience with support".

> What's confusing is having a zillion usernames and passwords for every site on the internet, and "doing it right" (which only a tiny percentage do) requires installing password manager extensions in your browser. In practice billions of users use the same insecure password everywhere including their banks.

That should be OS level. The fact that the OS does not provide good, lightweight ways for mortal users to whip up additional user-accounts for guests and family-members without breaking a lot of things should not mean that Google makes their own into the browser and adds yet-another-layer-of-login.

That should be OS level.

I log into things from my apple laptop, my android phone, and occasionally from a chromebook I have lying around. Credentials shouldn't be tied to one OS or one OS maker. I'm happier with authentication baked into Chrome, which straddles all three.

That feels like whitewashing part of the blame that applies to engineers and product developers. We don't get to say "oh it's those pesky money people, how dare they", while drawing a salary from the same pockets.

It's not a simple blame game. Whomever controls the product definition rules the roost.

E.g. good luck trying to be a developer at Microsoft 10 years ago in Balmer's 'embrace, extend, extinguish' model

That is to say, it's organisational dna that dictates who defines the product. Once the 'specs' have been written, hands are tied.

It’s actually very simple: anyone who makes a living from working on this product owns a share of the blame. Nobody in this industry can claim to have their hands tied; it’s not difficult for folks talented enough to land a job at Google to instead find work that doesn’t involve violating privacy at web scale. If you write code or participate in meetings intended to execute on a corrupt vision then you are tainted.

I disagree. Specifications require implementation, and the implementation literally comes out of the engineers' fingers - if none of the engineers agreed to implement something they thought was unethical, then it's mostly irrelevant what the product definition says.

They disagree with the direction the company is going so they ... quit? They apply at some other company comparable to Google, uproot their family, move across country, and get a job somewhere else?

I don't blame the engineers one bit. I certainly don't expect the poor engineer that had to implement the cookie changes to refuse and quit his job over it.

> I certainly don't expect the poor engineer that had to implement the cookie changes to refuse and quit his job over it.

There are no poor engineers at Google.

That is, ironically, the point people are making: if you make that much money doing something so (arguably) distasteful, you deserve scorn. It's in the "you can't have your cake and eat it too" family.

There’s a difference between coming up with the requirement and the “order”, and implementing it because that’s your job.

And don’t say they should quit. This isn’t the solution. At some point they will find an engineer to do it anyway.

The solution should be applied at the source.

There is a wikipedia page devoted to the argument that they were only doing their job:

https://en.wikipedia.org/wiki/Superior_orders

Are you really comparing a software developer completing tickets based on requirements to Nazis being told to kill? The fact that you need to draw that comparison tells me you are going overboard.

No, I’m not comparing engineers at Google to prison camp guards.

I’m comparing the argument that the Google engineer is just following orders to the argument that camp guards were just following orders.

I’m not the one who brought up the exact same defense. But if that defence is brought up, Perhaps the person emplying that argument should be asked if they meant to make the comparison indirectly by using the same argument.

Your argument is wrong in every regard that matters and this is in no way comparable to the military.

The contract you sign when you get the job tells you to follow those instructions. And you have laws that say that you can be a whistleblower if they are illegal. Well this may be immoral or unethical but it doesn't strike me as illegal. So your only option is to refuse the implementation and quit your job.

Is the problem solved? No. Then that wasn't a solution and the responsibility wasn't on the engineer's shoulders. When you have a leaking pipe staining the wall don't blame and just repair the wall. Fix the pipe.

You're letting some irrational anger/hate cloud your judgement and it shows. You came up with a comparison with Nazis (!!!) and nothing anywhere close to reasonable opinion on who's really to blame and what the solution is. You're the guy who hates the person in the call center for following those questionable and possibly abusive scripts. Obviously it's on them.

> At some point they will find an engineer to do it anyway.

And at some point when <future Google mostly comprised of scum> is thoroughly obviously malicious, we can expect/hope/encourage them to lose customers until they collapse.

The rats will move on as well, but at least the more virtuous employees can be elsewhere before the end implosion.

That's just addressing the issue in a really tangential way. You want to fix it, go for the people who come up with the idea. Even a company that employs almost exclusively ethical engineers will still have a few willing to compromise. Go for the head and the body will follow. Change starts at the top.

Most people working at Google don't work on these things. They work on products that genuinely help users. Should they quit just because someone else at the company is doing stupid things? Wouldn't that just leave the idiots in control of the massive resources of the company, unrestrained by internal pressure from good employees?

Yes.

That’s how values work. You VALUE them, meaning—objectively—you are willing to make some sacrifice for them.

Same goes for working for a predatory financial institution, a manufacturer who makes dangerous products, or for that matter, a company with a toxic culture.

How is this different from working for a tobacco company? Decades ago we had the same conversation about people who ”were just following orders.”

If you aren’t able to change your organization, change organizations. If not, fine, but you cannot escape having proven that you don’t actually value consumer privacy or what-have-you more than your hot supper. You just consider it a nice ideal to bandy about in conversation.

Summary: Those who are complicit certainly deserve their share of the blame. At the very least, you can say of them, “they value money more than privacy.”

If you don’t think so, maybe YOU don’t value these things that much, which is why you won't hold anyone else accountable for them.

One more thing (apologies):

If you take the engineer off the hook because “they can’t change things,” you know what inevitably happens? You discover that the product and eng managers can’t change things either. In theory, maybe, but in practice they are given accountability for revenue and growth targets, so what choice do they have?

Let’s move up the ladder. Can we blame the directors and ELT. No, the markets hold them accountable for growth, and every company plays dirty, so what choice do THEY have?

Pretty soon everyone is shrugging, and now you understand how SYSTEMIC problems persist: Nobody is held personally accountable because no one person can make change without sacrifice, and sometimes not even then, it would take mass walkouts or protests , and each person is but a drop in the bucket.

This mechanism of not holding people accountable because they don’t have sufficient authority or power to make unilateral change is how all systemic injustices persist. Racism, sexism, class distinctions, corruption in government, predatory corporations, all of them.

They persist because individuals say, “What can I do? Nothing, so I might as well go along with it.” And if everyone accepts this...

The next thing you know, they’re writing software to assist opressive regimes oppress their citizens.

Agree in spirit, but in the case of Google/Alphabet there is somewhere for the buck to stop: AFAIK Larry + Sergei (+ maybe Eric?) control more than half of the equity in terms of voting power, so if they want too promote their principles at the expense of revenue growth they can do that regardless of the feelings of other shareholders.

This is more speculative, but I think public markets don't really react adversely to visionary CEOs / founders putting principles over growth, so it's not like they would make all their paid-in-equity engineers take a pay cut for their principles either.

All participants are equally complicit, but some are more equally complicit than others :-)

p.s. I know the market seems to like Apple’s perspective on privacy, but unless we can examine an altrnate universe where iPhones aren’t selling like hotcakes, it’s tough to know whether the market values the eithics involved, or just thinks it’s a fine strategy.

If the latter, the market doesnkt really value their values, but rther their ability to make money. Which is mot the same thing.

We can examine an alternate universe where iPhones aren’t selling like hotcakes actually.

> With only seven million iPhones sold in China during the second quarter of 2018, Apple's market share in the country dropped by 12.5 percent year on year to 6.7 percent, according to a report by the International Data Corporation (IDC)

Apple have some very particular values in China though, storing iCloud data and encryption keys on state-owned servers. But the trend to decline started a long before that recent Apple decision.

Hasn't Apple basically abandoned the low price phone market in the same period though?

Maybe.

> If you head over to Xiaomi China’s official store (via XDA-Developers) you’ll see three new bundles unsubtly named the XS, XS Max, and XR sets. Included in each bundle is a new Xiaomi phone — either the Mi Mix 2S, Mi 8, or Mi 8 SE, respectively — a Xiaomi Notebook, a Mi Band 3, and a Bluetooth earpiece/earphones, all for the same price as their namesake iPhones.

Apple could already make tons of money off of user data right now. Do you not think people have suggested this within Apple? It'd be ridiculous to assume so.

They are leaving a ton of money on the table taking their privacy stance right now.

Well as a consumer, I value their perspective on privacy, and am willing to throw money at them to protect it. Sadly, I don't think most other consumers factor in privacy to that extent.

Collective action problems are an awful mess. By the time it's clear to everyone that a problem exists, few individuals can get results in return for impoverishing and isolating themselves by taking a stand. The few who can are so dependent on the system that they aren't going to do anything without the threat of a guillotine or FBI raid.

Putting yourself in a weaker position due to your views doesn't scale and thus doesn't work. For one hero there are ten conformists at the same level of skill, waiting for him/her to leave. While it's brave, it is also pointless. The problem as you state it can be solved only by explicit consensus, being it a law or just a manifesto. Modern privacy has no professional and power-y organization under it, except for few self-distanced like GNU, FSF, etc. Moreover, by staying at google engineers who have an opinion probably can influence much more than those who left.

If your argument is that they can do more good by staying, fine. I say the exact same thing about staying in Ontario despite the recent election of a wannabe Trump populist.

But if you say, “Ontario made this stupid decision,” I can’t tell you, “I didn’t vote for this, I can’t change it, I’m not responsible.”

I have to tell you, “It sucks, and as a citizen I bear some of the responsibility, and here’s what I’m doing in the hopes of fixing it.”

My only argument is that people who stay have some accountability. Accountability doesn’t mean they are automatically bad people, but it does mean we can ask them, “What are you doing about it?” And they don’t get to shrug and say, “Nothing I can do, so my conscience is clear.”

I see your point, but personally believe that we shouldn't dismiss high morals of those who realized to work for misbehaving businesses. It is just impractical to think that these grounds are unbreakable in general, so why care at all. Why not give them vote box instead.

You are weakening your own case by grandstanding. No sane person would expect you to "take responsibility" for some politician you didn't like (or help) to get elected in Ontario (a place with 14 Million people, but of limited global impact). You staying in Ontario (even without engaging in political activism) is not at all comparable to directly working on products you consider immoral in a company with an engineering workforce roughly one thousands the size of that but vastly bigger global impact. Neither in terms of personal culpability, sacrifices required or plausible positive effect your decisions might have.

you can use the same argument to tell people not to vote. it's not a good one.

Not a good one use or argument itself?

Citation needed. How do you know that? Maybe it's more like this: For every conscientious person deciding not to take a stand because they think it's pointless, there are ten conscientious persons also deciding not to take a stand because they think it's pointless.

Maybe when one person speaks up, others will be emboldened.

It is called a hunger strike and for that you must be literally hungry anyway. All other strikes are solved by dealing with few instigators. I doubt that it really requires any citation, since it is a manager’s textbook case.

To be fair, the OP was complaining about short-term biases from management. The entire ethical discussion is pushed way over its actual relevance (really, how big an ethical flaw is not deleting a cookie? Google will identify you anyway, cookie or not).

That said, about this:

> and now you understand how SYSTEMIC problems persist: Nobody is held personally accountable

It looks completely backwards. Environments that fix systemic problems are overwhelmingly on the side of not blaming individuals and looking only at the system. You are probably thinking about goal misalignment problems, and yet, just going after the individuals is still counterproductive if the system won't support the ones that do the right thing.

> > and now you understand how SYSTEMIC problems persist: Nobody is held personally accountable

> It looks completely backwards. Environments that fix systemic problems are overwhelmingly on the side of not blaming individuals and looking only at the system.

That's a fascinating exchange. I find myself siding more with you than with braythwayt, but still uncertain because the idea is new to me. Is there a good writeup of arguments for both sides?

I don't think these two ideas are as opposed as you're implying. They're describing two different perspectives on the same process. To wit:

1. Individuals have values and ethics that they'll make a reasonable effort to comply with. Society recognizes this and rewards and punishes individuals for the ethical bent of the projects they are clearly responsible for.

2. As the size and complexity of a project grows responsibility becomes diffuse until there's no single individual to hold responsible for any given decision. Once this happens the informal, personalized ethical safeguards begin to break down.

3. Once the informal individual scale safeguards have dissolved they usually can't be rebuilt. Instead they need to be replaced with formal safeguard mechanisms that operate at the project scale.

I don't know of any good writeup on the side of blaming the individual. On the side of fixing the system, I think the canon would be to look at systems theory (at the more human centered flank, like Meadows). You can get to the same conclusion on administration theory from Deming and his following, or any of the X-safety groups, like work-safety, aviation-safety, nuclear-safety, etc.

What really confuses the discussion is that a well working system that deals with ethical failures does necessarily hold people personally accountable. But you can't fix it by focusing on the "holding people accountable" part, it never works. You have to focus on the "system" part.

I don't feel like it is reasonable to draw a direct analogy between Nazis and implementing browser level account logins.

The decades I was thinking about referred to the business of tobacco companies. I was very much alive while public opinion swang against them, and I recall lively debate about the ethics of working for tobacco companies, the loss of tax revenue from tobacco companies, the ethics of tobacco companies sponsoring sport, and so on.

As for the Nazis, there are some parallels, just as there are for other social problems like racism. But in my initial comment, I preferred to stick to a more direct comparison involving employment with a fantastically profitable and legal company.

I meant the quote on "just following orders" which is specifically the Nuremberg Defence.

This is a toothless, short-sighted, and self-serving philosophy that does not solve any problem.

I will explain, but first let it be known that I am a scorned Google user. I jumped on board the magic carpet of every Google service as soon as I could and loved it the whole time, but it has become clear to me that Google and my values no longer align. So I'm leaving.

However, telling the workers to "just quit" won't solve anything. In fact, it guarantees that the company will have a higher percentage of people you morally disagree with leading to, by your moral standards and actions, a more evil product.

Additionally, quitting because you disagree with company politics is the least meaningful protest you could levy. Inaction from the sidelines is just as damning as internal complicency. If you want to split moral hairs and feel Superior because you quit, go for it but don't pretend like you're a hero or in any way part of the solution. To be specific, Google won't reverse it's whole company plan and Buck the entire industry trend due to a _temporary_ uptick an employee turnover of a few percentage points (if that).

Change can come from internal activism and external Market pressures. Quitting is neither of those and actively contrary to the former.

To be specific, my words above are:

“If you can’t change your organization, change organizations.”

If the argument is that by staying they can create change, our views are compatible.

If the argument is that “although they may try, they can’t change anything, but they should still stay,” then my argument is that they have chosen to be complicit, and it is appropriate to hold them to account.

Nobody is really telling anyone to quit, but the argument above is that if they don’t quit, they cannot be held accountable. I reject that notion.

> To be specific, my words above are:

> “If you can’t change your organization, change organizations.”

> Nobody is really telling anyone to quit, but the argument above is that if they don’t quit, they cannot be held accountable. I reject that notion.

This is a false dichotomy.

The world exists in grey areas. Just because you are passionate about security and privacy does not mean joe the google engineer is culpable for the _industry accepted_ practices you disagree with.

People are fallible and so are companies. If everyone had to change-or-quit every company they worked at, no one would work anywhere. Your philosophy is not sustainable, logical, or implementable. In the spectrum of immoralities, fingerprinting users is pretty far down on the list, although it is certainly present.

> However, telling the workers to "just quit" won't solve anything. In fact, it guarantees that the company will have a higher percentage of people you morally disagree with leading to, by your moral standards and actions, a more evil product.

Not necessarily.

Thank God Albert Einstein "just quit" as opposed to returning to Germany to influence it from the inside and change it from within.

Perhaps that engineer could go on to work for companies that care more about privacy and help them succeed, or explain to others why he left and convince others to as well.

Movements are not collections of popular supermen who do extraordinary things. You make it seem as if, unless you can completely change the course of the company, don't bother. Same as "don't vote your vote doesn't matter."

I drew a different conclusion from reading the parent. The issue with "your vote doesn't matter", however true it may be, is that the decision not to vote results in removing yourself from the decision-making process, giving more power to those you oppose. That seems to be specifically what the parent is arguing not to do, as someone who has quit no longer has any power within the organization.

That may be true in a closed system, but Google is not a closed system, and that person can do any number of things outside of that system.

A person leaving is essentially a vote. It says I no longer have faith in the decision makers of this current group of leaders at google. You no longer will offer your value to them - that on its own, is most likely a loss (they would not have kept you if you didn't offer value.) On top of that, you add value to a potential competitor, or the EFF, or here on HN, where many have already switched to Firefox.

On its own, it doesn't mean much. But collectively, it could be devastating.

If not, oh well. My job isn't to ensure Google decides to be good and not evil. But I can determine if I will support something evil or not. And I choose not.

>Change can come from internal activism and external Market pressures. Quitting is neither of those and actively contrary to the former.

False. A mass exodus of employees can certainly increase market pressures as it signals instability; it can also be extremely difficult (sometimes impossible) for new hires to understand big legacy code bases -- so quitting can be a form of legal/indirect sabotage

We saw what happened when you try to do that on their mailing-lists.

Between things decided by data and management I'm not sure what a single developer can influence. I guess it sill more than by quitting, because you won't say anything in the exit interview in case you want to come back.

I reckon it´s not only money that they give value. Other intangibles might apply (as all family related issues).

I agree that engineers might also have something to say, but we don´t actually have a clue if some of them actually expressed they concerns for this change, unless you have some insight from inside the company that you may not be able to share.

Even if some of them left as you suggest, I´m pretty sure Google wouldn´t have any problem to find some other engineers that would happily implement anything without questions.

Nevertheless, I agree that concerns should be raised by everyone in the org, but the only ones that might lead to an actual change is stock holders/board of directors.

Sure. If you have the monopoly, you don't need people to love you.

While Google could easily find engineers to implement anything, they can't as easily find people who know what to implement: People with a deep understanding of the web. The power grab we could observe over the last year has alienated a lot of people. In hindsight we will know whether that grab worked for them.

Right now, they are burning through goodwill at a high rate.

I agree that values are important, but I have a problem with comparing this Google situation to other situations that literally kill people. An engineer who values privacy could reasonably think that staying at Google and fighting the privacy fight is the best way to keep pushing his or her values.

I think you're misreading his comment. And your followon comment is showing your assumptions:

>If you take the engineer off the hook because “they can’t change things,”

He never said this, and in my reading is not trying to say this. What I read him trying to say is:

"Quitting is not the only way to handle the problem."

Or the harsher:

"The solution is not to run away from the problems."

More or less the equivalent of:

"If the US is going downhill, the solution isn't to run away from the country, but work to fix it"

As an engineer you're part of the company. And putting a recent unfortunate case aside, Google is relatively open to engineers voicing their opinions. If you're fatalistic or meek, sure, you can leave. But that's the weakest of all options.

Come on, Google offices are only in tech hubs where these engineers can easily find a decent job. Not necessarily as highly paid as Google (applying to other tech giants is always a lottery) but they can still make a very good living in the same city.

> They apply at some other company comparable to Google, uproot their family, move across country, and get a job somewhere else?

Why do they have to uproot their family? Why can't they just work from home? I don't understand why we still insist on making people physically show up for jobs that can be done from home in someone's PJ's.

If you're not willing to do that then it means you don't care. That's what values and principles are: you have to make sacrifices, it's not enough to say you have them.

I'm not necessarily making any judgement here, I'm not saying "those assholes, why don't they quit?". I'm just saying that you cannot be unwilling to make a sacrifice for your "values" and then claim you have "values". Pick one.

Sure you can. If Value A (some given ethic or aesthetic) is sufficiently less valued than Value Set B (family, personal happiness, financial security, career success), then most likely the hypothetical holder of these values will make no attempt to protect Value A when Value Set B would be negatively affected as a direct result.

> They apply at some other company comparable to Google, uproot their family, move across country, and get a job somewhere else?

Not all job changes are so drastic. Refusing to implement this behavior might be as simple as just requesting to switch teams within Google. If one chooses to leave, finding another high paying job in the same area is not typically a great challenge for a Google engineer. No uprooting necessary...

They disagree with the direction the company is going so they ... quit? They apply at some other company comparable to Google, uproot their family, move across country, and get a job somewhere else?

Google isn't the only tech company in Silicon Valley.

> I certainly don't expect the poor engineer that had to implement the cookie changes to refuse and quit his job over it.

I frankly can't disagree more with this statement. That's how you get VW's defeat devices etc. Engineering ethics matter. And engineers are not "poor". Maybe not everyone realises it but we, engineers, have substantial powers. We need to exercise them.

Exactly, there are plenty of other companies to go working for. People working for Google at best accept a compromise, at worst are actively working against their customers (should I say users?)

That said, as a customer I'm using an Android phone because IMHO anything else is a worse choice for a number of reasons. At least I'm signed out of any Google service except Play.

> any Google service except Play

Yeah, that's enough, that logs you in on google play services, which has god mode on your phone.

Having play services (https://github.com/opengapps) on LineageOS is not like that. You can go to Privacy Guard and deny any permissions from Play Services.

Sure. Is it still in /system/priv-apps? If yes, you're wrong, it still has god mode.

Engineers losing control to money types and bureaucrats is a gradual process. It is not that one day Google strikes out the second word from its unofficial motto ("do not be evil"). Engineers might dislike each small step in that direction, but it is not enough to make them pack up and move (house, family, kids, etc.). Pretty quickly they are tamed by both money people and the bureaucrats -- still appreciated and paid, but as brains to be tasked, with no ability to influence company policy.

People accept a LOT with gradual changes over a few years that they would never accept as an upfront bulk package. This is not just in engineering. But there is a flip side to this -- once bureaucrats are in control and engineers who stay accept "that is the way we do it" as a justification they often lose energy and become set in their ways. This is more dangerous to a company than a rotting executive class. My 2c.

I wouldn’t call Microsoft as a company returning control to Engineers and product.

I bought a surface pad for my dad. Setting up was a pain, my dad had constant issues where he’d do something and didn’t know how to get out of it. UX was inconsistent. Bing ads everywhere. Yuck! It still very much felt like features were created for someone to get a promo.

Google at the moment feels like a ruthless data driven company. “Our charts show that with this change people use more google services. It invades user’s privacy and pisses off a bunch of HN users but who cares? This will make us a trillion dollar company, and it is working!”

And this is why everyone should fear Google. If they are willing to do this, as their AI capabilities advance, their actions show they value their stock price far above their users privacy. God knows what they’ll do next. It’s not the first time they’ve done something like this.

On the other hand. The current US govt is in bed with Google. They lobby like crazy. The govt will not do anything. Gogo is a behemoth that can pretty much get away with anything now. May be the EU will. I really hope they get fined for this.

> I wouldn’t call Microsoft as a company returning control to Engineers and product.

I would not either, but this just reinforces the opinion that it is very hard for a company to get out of this state. Once engineers are domesticated even if the leadership wants to reinvigorate the company (and I think Microsoft's would like), empowering tame engineers is unlikely to produce earth-shattering results. Product improvements, sure; new technologies, probably not. My 2c.

> Google at the moment feels like a ruthless data driven company. “Our charts show that with this change people use more google services. It invades user’s privacy and pisses off a bunch of HN users but who cares? This will make us a trillion dollar company, and it is working!”

This. A million times. Be prepared for the next step: http://decisionproblem.com/paperclips/index2.html

Despite my familiarity with the Paperclip Maximizer, it has still been instructive to think it through in real time. It's a nice way to think about priorities in life.

Thanks!

Holy cow, what have you done to me?! And I thought Civ5 was "one more click" syndrome...

The page is pretty sparse; do you know if there are any winning conditions, or it just goes on until `Number` in JS oveflows?

It does terminate and there's more to the story than you've seen so far.

Didn’t they literally strike that word out from their motto overnight. I believe I recall them removing it from the handbook but I’m not sure.

Yes, right after they got caught helping drug pushers and had to pay a $500,000,000 fine.[1]

"Google executives, including CEO Larry Page, knew about this stuff and condoned it":

"Mr. Page, now Google’s chief executive, knew about the illicit conduct, said Mr. Neronha, the U.S. attorney for Rhode Island who led the multiagency federal task force that conducted the sting. “We simply know from the documents we reviewed and witnesses we interviewed that Larry Page knew what was going on,” he said in an interview after the August settlement… “Suffice to say this was not two or three rogue employees at the customer service level doing this on their own,” said Mr. Neronha, the U.S. attorney. “This was corporate decision to engage in this conduct.”"

This is way, way beyond most company scandals. It made the front page of the Wall Street Journal. Page could have ended up doing federal prison time.

[1] https://archives.cjr.org/the_audit/the_journal_takes_us_insi...

Yes we do. Just like Tesla employees get to critizise Musk for his Twitter market manipulation while still working their day job and drawing a sallery, and Americans can criticize Trump whithout moving out of the country.

Just because you are a benefitting part of an organization, it doesn’t mean you cannot disagree with management and if you disagree it doesn’t mean you have to quit or stop being critical.

Twitter market manipulation is entirely Elon Musk's fault, not something Tesla and its employees are responsible for (except, perhaps, for some inner circle who might have stopped him). On the other hand, the newly revised Chrome is a core product: disagreeing with management but allowing it to be distributed isn't enough.

But are there any moral corporations left? It feels like you can just keep running.

Is it the responsibility of a corporation to be moral or is the responsibility of the shareholders and customers to keep them moral?

Not really, gotta work for small businesses or start your own.

And those will be sold to evil corp later on or will do subcontractors for them. I do not see any escape.

If you start a small business and then do those things, then you can no longer blame other people; You are the immoral person

It's not their pockets. We need to ditch this notion that marketing/business people provide our salary.

That just feels like Stallman-esque "lifestyleism". It's okay to be critical of a system while living in and part of it.

Yeah, they do. That's exactly how it works with real (certified, legally-enforced labeling of) engineering. That is, civil engineers push back against (excessive) safety-cutting to save money while drawing a salary from the same companies that want to implement such design changes. They only differ in how effectively they have organized to prevent being overruled.

I agree to some extent, but at the same time I think it would be silly for somebody to take a stand over this.

In the grand scheme of things, this is a pretty small issue compared to all the other tracking they do and things like "Project Dragonfly".

The idea that technical people are all impeccably ethical is not very plausible. Consider the scientists who promoted the claim that smoking was harmless long after it clearly was not, the engineers who concocted VW's diesel-emissions fraud, and the developers who produced Madoff's fake accounting. And, of course, this particular deception is hardly the first fall from grace on the internet.

I don't think anyone is seriously promoting that idea. The implication, rather, is a more modest proposal: That, of a company's staff, the bean counters and executives are at least on average more bottom-line-motivated and hence more likely to push for changes that will pull in cash at the expense of honesty, privacy or consistency with user expectations, when compared with the technical types.

This is simply too naive. We need regulation to stop global tech monopolities shamelessly exploiting their dominant position, be it Google, Microsoft, Facebook, Amazon, Apple, Samsung and so on. I doubt this can be done properly on any other level than national.

Why? Don’t like Google, don’t use it. Pretty simple.

That's from the gospel of the Libertarian Church of the Invisible Hand.

This approach doesn't work in the real world because Google's consumers are neither perfectly informed nor perfectly rational. It also ignores the fact that major corporations can enlist the help of the US government in maintaining and extending their de facto monopolies.

Still, it's hard to argue that Google Chrome is a monopoly, when it's not even the default in most user OSs (the exceptions bring ChromeOS and some of the Android vendors.)

Is it not a de-facto default when the first thing many people do on the internet is hit Google.com and get prompted to download it?

Something I wonder is: would we have anywhere near as much of a problem with a handful of companies monopolising the information technology industry, if we didn't have Intellectual Property laws?

People often forget that patents, copyright, etc. are just an arbitrary social construct with little real justification for their existence. Yet the overall effect they have is to make it considerably harder to start a new company to compete with a tech giant.

It may be that the problem is that we have too much regulation rather than too little.

Yes! We'll just write our problems away.

Only market forces can alter the course now. A decision has been made at the CEO level to aggressively use Google’s grip on the browser and search engine markets in any way that helps their bottom line and has been calculated to not trigger a massive PR backlash among the general public. The rank-and-file Googlers tasked with enabling these misdeeds have a simple choice: remain complicit or refuse to work on these products and accept the potential consequences.

>>A decision has been made at the CEO level to aggressively use Google’s grip on the browser and search engine markets in any way

Now it's obvious to everyone but I am almost certain that Google did this already with search at least since 2008. The low hanging fruit was picked with Matt Cutts being their PR mouthpiece, and what's left to do now stinks. They can't hide behind the "search" and ads are separated lie. Special mention to his pal, Danny Sullivan, the "fair and balanced" search expert.

Edited to ad: If they claim that SERPS are unbiased and not connected to ad revenue, doing otherwise would fraud. Tens of $billion worth.

Perhaps the (you won't be signed out of your Google account) language was something an engineer or product developer insisted on. Perhaps they figured that was their part, and that it's up to the rest of us to take 10 minutes and switch to Firefox so data-driven Google knows this was a bad idea.

Mozilla are winding down their efforts to make Firefox competitive. They are not planning to make a full servo browser anytime soon and they are transfering resources to VR and other things. This is disapointing.

You can't blame them, their user base is in free fall.

Are you sure? Seems like a lot going on when I look at https://www.mozilla.org/en-US/firefox/releases/

From https://github.com/servo/servo/wiki/Roadmap

> Our long-term plan is to:

> Incrementally replace components in Firefox with ones written in Rust and shared with Servo

I don't know if they have a date in mind for the delivery of a 100% Rust Firefox, but they're not stopping the initiative.

The page goes on with a list of stuff they planned to add to Servo in 2018, which will eventually go into Firefox.

Edit: fixed the formatting of the quote

>>Basically their own Ballmer era is what Google is entering.

If its just one person, it often easy to fix the problem by eliminating that one person(like Microsoft).

But if an entire cartel is at work in the top layers. Like the political brotherhood, to say. It will be impossible to solve the problem until an eventual IBM like corporation will come to happen. Basically you fire one exec, and the brotherhood will bring one from their golf buddies to replace them, and this process will go on. No one know what's to be done to fix the problem, because whatever new boss you will get will be the same as the old boss.

I'm also fairly sure by now that the 20% spare time project culture/process is fairly dead by now.

No political exec will let some programmer create a project leading to creation of a new threat to their fiefdom.

I'm guessing most of Google's growth will now come only from Acquisitions.

>Another confirmation that engineers and product developers are no longer in control at Google.

The engineers not being in charged happened a long time ago.

To wit: the current CEO of Google, Sundar Pichai, was never an actual engineer.

He actually learnt the ropes of his job at McKinsey.

https://en.wikipedia.org/wiki/Sundar_Pichai

I don’t think there’s reasonable hope.

Mainstream people dont need and dont value products being great in every detail.

I don’t know what they need. But as google is still successful with a search engine that used to be great a decade ago because it delivered results for exactly what i was looking for and nothing else, and now is more a „whatever you search, we‘ll serve you some results no matter if words you search really appear there, they seem to be happy being served anything wether it’s what they ordered or not...

For the minority with high demands on products his is difficult because we have to look for new providers again and again after the logic of growth makes companies shift to cater there products to the mainstream... after using us as beta testers and advertisers.

Google is an advertising company, Are we just now finally realizing "you get what you pay for?"?

Maybe an antitrust break up of Google will be a good thing.

Isn't it native to assume all the Engineer oppose to this ? Some, maybe many will be happy to work on this. This is not an illegal thing that is enforced and has severe punishment.

> Microsoft already went through this engineering/product growth to bizdev/marketing control to stagnation and is already in the return to engineering/product first phase.

Microsoft were always a marketing first company. Even in the early days they sold BASIC and DOS before they'd even written a line of code. And Windows certainly didn't become the dominant desktop OS through being the best at engineering (in the 80s and 90s they were usually amongst the worst in terms of performance and stability).

Having good engineering and being product focused doesnt mean you'll have a successful product. In fact all too often it takes underhanded stunts to get your neck in front simply because most people are not like us, they're not engineers. So you'd be amazed at how little most people would care about what's happening here (assuming they even understand it in the first place)

> Even in the early days they sold BASIC and DOS before they'd even written a line of code

Microsoft didn't create DOS

But they did sell it before they'd written a line of code.

No, of course they didn't. But that doesn't mean they didn't still modify the codebase of the DOS (I cant recall what it was called) that they bought.

Besides, my point clearly wasn't who originally authored MS-DOS but rather that MS didn't even have a product to sell -let along a well engineered one- back when they first visited IBM.

MS didn't even have a product to sell

Microsoft BASIC was the original Microsoft product, written by Paul Allen and Bill Gates in 1975. It was already wildly successful and the default microcomputer BASIC dialect by the time they had talks with IBM.

MS-DOS was originally 86-DOS, née QDOS, by Seattle Computer Products.

I was talking about Altair BASIC, Micro-Soft (as they were then called) first product and it was pitched to Ed Roberts (MITS founder) to run on his Altair before any code had been written on their (Micro-Soft's) BASIC interpreter. So I was absolutely correct to state they didn't have a product to sell there.

And yes, MS-DOS was originally a SCP product - however you've left out the important part: when Microsoft visited IBMs headquarters to sell their disk operating system after Digital Research struck out with IBM (though accounts regarding what happened there differ wildly depending on who you ask), Microsoft did not have a CP/M nor DOS clone at that time which is why they approached Tim Patterson of SCP and later bought the OS for a pittance compared to what Microsoft then licenced it for. Thus once again I'm completely correct to say Microsoft didn't have a product to sell.

I don't know why you and the former poster have gotten so hung up on who originally created MS-DOS since I was only discussing it's licensing to IBM. But hopefully you now understand the point I was making.

> very easy to forget that when the money rolls in massively

I agree with the problem but not the cause. I don't feel that this has anything to do with being complacent. If anything, this is the downside of being a publicly traded company that has the pressure to meet Wall Street's myopic expectations of growth every quarter.

You are right. But in the end some engineer built that feature.

Engineers like money too. 85%+ of their revenue is from ads.

> Basically their own Ballmer era is what Google is entering.

It was not just Ballmer. When Gates was in charge, the technology was never the priority. Gates understands the tech, but MS never worked trough technology towards their goals. They used their monopoly power and bought tech, almost never build it.

MS products started to gradually improve after Gates stopped being the chief technology officer of the company.

I am not sure if it is possible to generalize to the whole of Google.

Reply on news.ycombinator.com