Hacker News Reader

Comment by breakingcups | Hacker News Reader

It's incredibly Kafka-eqsue that you get banned for a supposed violation that you're supposed to appeal, but you don't know what you're being accused of doing.

This is exacerbated by the fact that 9 out of 10 times a story like this appears it's an algorithm gone rogue which its billion-dollar shepherd assumes is infallible.

The remaining 1 time it's because someone knows how to abuse reporting systems to get someone locked out on purpose.

The only reason these tech companies managed to get so big is because they'll cheat at anything that requires human scale. Support, moderation, taking responsibility for the content they host. They somehow managed to skirt on that just as the web was transitioning from a wild west to a somewhat ingrained, regulated place and the world is worse off for it.

Because they skirted on all this, they are now somehow the world's gatekeepers on modern communications. If you don't play ball with them, you're cut off from almost everyone. Their recklessness and callousness ironically put them in the position to rule over the rest.

View on HN

I don't think the internet was ever going to become regulated. What did occur post-2007 was that what made the internet work as a disparate ecosystem of loosely connected destinations (news groups, message boards, blogs, misc websites) that all played their own very important role, controlled and owned by their own communities became one platform under Facebook, Twitter, Reddit, etc... and was controlled and owned by people who had no identity-based connection to the people using those platforms.

This is largely based on my own observations and could be wrong, but it's my theory. Tech companies robbed an internet culture they didn't even realize or appreciate existed, and then shoved a bunch of people who had never used the internet before on it and convinced them that Facebook was the internet. Or rather, that the standards, norms, and culture on Facebook was somehow reflective of everything outside of Facebook. Just replace Facebook with the growing list of companies who engage in "platforms" in varying degrees.

tldr: this obsession with centralization made no sense to the way we do things as a human species, any of our values, any of our culture, and we let it happen anyway. The chickens have come home to roost.

I definitely think that what you're saying is true, and is part of the explanation. But another part is that the Wild West internet also had its own major issues -- roving bandits, to carry the analogy -- and these big companies did solve real problems that were only growing with time.

Gmail's spam filtering. Recaptcha's bot rejection. Facebook's identity verification. Paypal's secure credit card processing. Google de-ranking link farms. Youtube's hosting costs. All of these very effectively solved real problems with the old web, and those problems were growing as bad actors became more sophisticated.

I like the old web too, but I do appreciate that an attempt to return to it would still require very effective tools to solve at least some of these problems, and they'd require constant improvement to keep the roving bandits at bay.

I believe this is an overly rosy-glasses view of the current heavily centralized internet.

Gmail spam filtering? Isn't particularly good. I run my own email infrastructure and I get way less spam through it than on my gmail address. And I don't do anything particularly special other than configure postfix correctly.

Recaptcha? Was there ever a more hated piece of user abusive technology? Plenty of rage against it here in many discussions. I won't do business anymore with any site that won't let me buy without identifying 27 traffic lights in slow motion (looking at you adorama). We're all better off if this dies.

Facebook verification? Don't know what value this brings to anyone other than FB.

Youtube? Granted.. Hopefully with bandwidth costs reducing over time, decentralization becomes more viable.

Paypal? Always pay with credit card directly. The regulatory consumer protection for that was well in place before internet commerce even took off.

The original potential of the internet was in its fully decentralized functionality. Usenet being a great example (owned by nobody, hosted peer to peer) which should be studied a bit more now that we have generations of developers coming up never having known it. Of course, it was (mostly) overrun by spam. But unlike email where spam is pretty much defeated, there was never a meaningful effort in addressing spam on Usenet (forums and mailing lists took over instead). Applying the same techniques to NNTP could well be equally successful.

If there is any desire to avoid the internet becoming fully a new cable-tv controlled by just a few major player we need to pursue research into decentralized services as a priority.

(If nothing else, consider at least running your own email infrastructure if you're technically capable. Keep the foot in the door so it doesn't close permanently.)

It's more of an attempt at a steelman. Just for the record, I don't like the current centralized internet; I've all but deactivated my facebook account; when a site requires a Google or Facebook verified login ID without their own "create account" option I avoid them at all costs; I avoid Paypal now because there are better alternatives (but in the early '00s, I would not have trusted most sites enough to pay with a card). And so on. I'm not trying to advocate for their position, but just understand the problems that they solve and why we got here.

And while I hate using recaptcha, I also had the even more unpleasant experience of watching a forum that I moderated die under a crushing assault of spam bots that were smart enough to make it past the built-in CAPTCHA. Recaptcha isn't there to solve problems for the people who interact with it, it's solving problems for the people who chose to put it on their site.

I wrote in a sibling comment what value Facebook's login brings to the sites that opt into it. (Offload all the work of password handling, claims about stolen accounts, preventing sockpuppetry and catfishing, etc).

You can't look up voting locations without a reCAPTCHA challenge https://recorder.maricopa.gov/pollingplace/default.aspx

This is particularly pernicious. If a private business does it I'll hate on them but oh well, it's their business at the end of the day.

But there should be accessibility laws to prevent government agencies from blocking access to citizens/taxpayers using these proprietary technologies.

What's the alternative?

I don't know offhand of an open-source captcha library that's nearly as effective as reCAPTCHA. All the old "wavy lines through slanted text" ones are completely broken with current OCR techniques.

The alternative is nothing. There is no justifiable reason for a CAPTCHA for looking up voting locations. It can be a static HTML page served to anyone in the world.

I don't think you're right.

> Facebook's identity verification

in real life, do you need to know the real name of the cashier and see their contract so you can trust them with your payment? You don't, you use common sense.

> Google de-ranking link farms

hey, haha, and what do we get instead? Monopoly on ad-driven search engine, great, I'd rather have link farms since I can easily filter those out with little brain-power. I can't do that with paid-for-propaganda

Now imagine we'd leave the way it was, people would learn how to deal with it, the same way you learned you can't leave unlocked bicycle in a city. It's a price to pay for anonymity, and we should all have right to be anonymous on internet.

Yeah, Google kind of created the link-farm ecosystem because it rewarded links— again, without verification etc. but just algorithmically.

100%, I agree, going back to the Wild Wild West probably isn't the thing to do, but I think we can look at decentralization through the lens of modern tools for a brighter and more equitable future for the internets new and old denizens.

A couple of ideas I've had:

- Leverage PGP and trust rings for identity without a need for non-anonymity. This could be structured in a nuanced manner so that we respect pseudo-anonymity while also maintaining the integrity that real identity brings.

- A wholesale education of the populace, instead of an education by fear, of the power of anonymity and services which further anonymity.

- A move away from the advertising and services-exploitation business model. Not that we can't have service oriented businesses, but those businesses cannot be exploiting people to do labor and a bottom line price.

- A data ownership model which establishes a monetary value for different types of data. We already do data classification inside mega-corps, and we're able to establish and correlate it's sensitivity. Extrapolating this to value would not be stretch. Users consent which data they give up in exchange for services. The price for the service is adjusted based on what data they give up, and how they choose it will be used (Data for marketing may be more valuable than say data for behavior research, or even vice versa!)

> Gmail's spam filtering. Recaptcha's bot rejection.

> Facebook's identity verification.

The ability to choose an identity online not connected to your legal or in-person name, to make it more difficult to find and stalk you in person, is a feature, not a bug.

I don't disagree, but a lot of websites these days choose to offload their login systems to Google and Facebook to certify that a unique human is on the other end. It solves real problems for them like password management, bot detection, astroturfing, sockpuppetry, stolen accounts, and so on.

For these purposes, an actual Real Verified Name is overkill, and a unique identity number would be enough. But Facebook offers that service for Free(TM) so there's not much incentive to the site operator to aim for something more minimal. And with GPT-3 and other systems inching closer to passing the Turing test, this only makes alternatives more challenging for them.

Those are problems in the Wild West that would need solutions if we were to reclaim the net from Facebook and Google.

What links those accounts is not special, it's OAuth2. I don't think there's anything stopping different groups from running open OAuth2 endpoints that just provide a PGP based identity service. I actually wondered why Keybase didn't start an OAuth2 endpoint, because it'd put a big dent in some of the services you described.

I see GitHub OAuth logins in some programmer-centric websites. I prefer that over Google login (and god forbid Facebook). It's just as bad from a login-centralization perspective, but GitHub allows you to control your identity freely, instead of mandating (and more-or-less enforcing) your legal name like Facebook.

(Google no longer rejects or bans you for fake-sounding names, ever since the Google+ controversy, but it still enforces a Western-style first/last name instead of other cultures' name formats or single-part usernames.)

WebAuthn is right there and built into Windows 10 and macOS now. I don't understand why it isn't seeing more adoption.

imo the need for 'centralization' comes from the fact that in order for different people to understand each other, they must use the same dictionary (so to say). So the 'dictionary' is a centralized construction. It must be the same for everybody.

If our dictionaries vary to much in their definitions then our communication becomes more and more difficult.

Maybe dictionary is not the best analogy (this is just an analogy) but I hope I'm getting my point across with this example.

I used the internet without facebook before it existed. I had a Facebook account for over a decade. I haven't had a Facebook account in two years.

To the extent that what you are saying is true, it is only true because these companies have walled themselves off. You used to be able to chat with Facebook users over XMPP even.

Yeah, I agree. If I remember XMPP was dropped while using that old adage of "scale", which maybe was real, but in the end the net effect is the same. Advanced users know a broader breadth of the internet while most internet users only know the depth of Facebook and other various platforms.

I guess once they got big enough there was no longer a point in interoperability, it seems like a pretty big phase transition got hit about a decade ago where suddenly each walled garden got big and valuable enough that isolation was a better strategy for them.

It just sucks for the internet. I don't think, if those companies ceased to exist, that they would automatically get recreated because of some inevitable niche or market law. I think that they got where they are because of a fluke of the times they were created in -- people could not grasp how they make money.

I understand the motivation. I work on platforms teams internally for companies (and have for a number of years). In smaller scale, this concept largely makes sense because developers at a single company come from a single culture which those developers largely have already bought into or are actively being shoveled into by corporate work. This is the role a lot of developer advocates play at companies who don't have external developer customers.

In large scale, what you're asking is more dubious. If you concede that the United States alone has 11 major cultures, then you have to begin a process of "on-boarding" everyone onto your new, structured culture that your platform is designed around. That's why these debates about who is represented in the building of the platform come about, because under that model those concerns take center stage and they should.

I guess what I'm saying is the whole problem never needed to exist. There's better ways to share information than being on one platform.

https://www.youtube.com/watch?v=gEyFH-a-XoQ

> It's incredibly Kafka-eqsue that you get banned for a supposed violation that you're supposed to appeal

"You must understand, all problems are [user]'s own. If you only made certain to properly follow proper protocols, no such problems would exist!"

> but you don't know what you're being accused of doing.

"If there is a problem, fill out complaint form, and place it in an envelope addressed to the name of the hospital in which you were born."

# The Onion wasn't supposed be a prescient view of our future.

> This is exacerbated by the fact that 9 out of 10 times a story like this appears it's an algorithm gone rogue which its billion-dollar shepherd assumes is infallible.

This. And it happens in all businesses Google is part of. As a website owner who monetized with AdSense for a decade, this year their algorithms suddenly decided that 33% of the ad revenue was from "invalid clicks". The month before this happened, I was experimenting with a different ad provider. My suspicion is when I returned to AdSense the month-over-month increase in revenue tripped up the algo. Talking to Google reps was of no use because they have no control over the algo. I lost ~$12K in revenue over 2.5 months and eventually just stopped using Adsense.

It took 6 months for Facebook to get to an appeal of mine to unban a page. I was happy it was unbanned, but the ticket said "1-2 business weeks" in the turn around...I was never contacted for an entire 6 months. If that had been a crucial page for me that brought in revenue for me, I'd have been completely screwed. Google is also hard to get a hold of for anything unless you're a partner.

I worked at a startup where we used Google Cloud. Even as a paying customer, when I'd try to talk to their "support" all they would do is try to upsell their consulting partners to answer a question about their own services.

That's wild, we're a fairly small Azure customer (compared to others) and I get calls and emails every month from a rep asking us what they can do, if anything. I think Microsoft is maybe a bit smarter at this by connecting sales to CSMs, because they can up sell and get you to support if you need it. While with Google it's a big shell game.

From hearsay Azure has better customer support because they know that in cloud and server environments they are a relative newcomer, traditionally many data center people would run away when they hear Microsoft.

Google has the ego of a market leader. They don't care for their customers, that's nothing new.

Despite the (apparently) good support, the decision to "run away" when you hear Microsoft is still justified unfortunately. I've recently had the displeasure to work with Azure and not only the console UI is even worse than AWS but every single service, despite looking similar to the competition, is actually different in subtle ways (which you often don't realize until you get started implementing against it) and forces you to waste time working around some Microsoft dev's attempt at being smart[0].

[0]: as an example, obtaining root on a container in an Azure DevOps CI pipeline. You have to bind-mount the Docker management socket into the container, then use that to gain initial root access and install sudo, then use sudo to run all your commands. I don't recall ever having to do that on any other CI service.

Yeah, I was probably a bit spoiled at the time. I was at startups that leveraged AWS in the early days and their reps and support people were at least somewhat accessible but at the very least knowledgeable. That flew in complete contrast to my experience with GCP.

Microsoft is a company born in selling physical products. Their software used to come on floppies and CDs. Google hasn't really sold anything real their entire existence.

Azure was down in Australia one night and I randomly sent a tweet to microsoft. To my pleasant surprise they acted on it and resolved it in few minutes. this is the same microsoft that was the villain around 10 years ago

Microsoft's "villian" nature in my experience was never in their products but in their Legal and Licensing teams

While the rest of MS is improving those 2 teams are still a problem, the "cloud" is ripe with ways to obfuscate and needlessly complicate licensing to over charge companies and MS excels at that

Microsoft has decades and decades of B2B experience. Amazon has decades of Consumer Experiance

Google has none, this is why Microsoft and Amazon excel leaps and bounds above Google in customer experience

Same experience, we spend less than 10k on Azure. The customer service people have been phenomenal. Though they need to move to some modern ticketing system.

Good to know

"The remaining 1 time it's because someone knows how to abuse reporting systems to get someone locked out on purpose."

I'm going to suggest (without any backup) that it's much more common but you simply don't hear about it.

The whole thing is based on anecdotal numbers. We have no idea how often false positives happen or at what rate. And even in those that are apparently false positives and complain, it's not always 100% clear if they're saying the truth.

> The remaining 1 time it's because someone knows how to abuse reporting systems to get someone locked out on purpose.

My Twitter account got disabled many months ago due to "suspicious activity". I did not do anything. At the time I talked to someone with whom I disagreed respectfully on a CS-related subject and was not political. Next thing that happens is that it asks me to verify via phone and only then I am able to use my account. I am not going to do that, so yeah.

What I believe happened is that he attempted to login to my account a few times, which triggered their bullshit...

Twitter routinely disables accounts for "suspicious activity" as a scummy way to harvest phone numbers (despite the account supposedly being considered dangerous and in breach of the ToS, simply providing a phone number immediately restores it without any human review).

Perhaps your FBI agent requested Twitter for some help figuring out your true identity.

Wonder if they've blocked the providers of temporary virtual phone numbers?

Presumably the known providers such as Twilio, etc are blocked, but there are small companies that provide numbers from the same number ranges as the big cellular carriers so those are completely undetectable.

I suspect if there would be enough demand for this service, a "grey" industry of people buying prepaid SIMs and renting access to them would appear.

Phone number risk scoring models would heavily weigh against behavior like that. Prepaid numbers are typically scored worse than post paid numbers as well, but that sort of behavior would quickly be identified as fraudulent.

> Prepaid numbers are typically scored worse than post paid numbers as well, but that sort of behavior would quickly be identified as fraudulent.

This assumes there is a way to tell which numbers are prepaid or not. To the best of my knowledge they both originate from the same pool of numbers and it is impossible for an outsider to tell whether a given carrier's number is prepaid or postpaid.

I once got locked out of my Veeva Vault account because I couldn't remember who I put as "who was your best friend in kindergarten?" (I had like 8 best friends then!). After putting in a ticket and hearing nothing back I finally braved the phone system and called support line. The rep who unlocked my account and reset my password assigned me 4 different modules of 60-question EACH mandatory training in order to get back into my "dashboard."

>They somehow managed to skirt on that

Not "somehow". Our national leaders in the US since Google was created have been fabulously pro-business, to the extent that they have never updated our laws governing privacy for the computer age (IE, limiting what businesses can do with data) and they've gutted consumer protections along the way.

Since the US government is so thoroughly corrupted by money, once a corporation is large enough they can effectively write their own laws. Google and others have done this, so there's no law stating that they must give consumers rights in a dispute, must provide their data, or even must be fair.

Government + money = corruption.

You would think that with congress seriously talking about breaking up monopolistic tech companies, the big players would have tried to _tone down_ the monopolistic behavior, not amp it up...

> which its billion-dollar shepherd assumes is infallible.

I think the "cattle, not pets" implications haven't quite sunken in yet. Stragglers get turned into mutton.

Well, presumably not straggling cattle.

Is it that easy to have someone locked out of Google? Just by reporting them for fake abuse? I'm sort of shocked if that is indeed true. It ought to be hard to do that. Otherwise, people who disagree with others may use that to get even or settle an online quarrel, etc.

I had a small website few years ago and I placed Google Ads on it. After few weeks my Google Ads account got banned forever (no appeal available) for fraudulent clicks. There is no way to reverse this ban. I am 100% sure I didn't click on my own ads. I guess someone could easily do some suspicious activity on your ads (or just extract your Ads ID from Android APK) and then get your account banned. Fortunately, they only blocked me from Google Ads for life, but not from the rest of the account. Also - never ever open a Google Play developer account with your personal Google email. Create a new one for this.

> never ever open a Google Play developer account with your personal Google email. Create a new one for this.

That means having another phone number, right? I tried to make a Google account for this kind of purpose, but had no way to receive the text they insist on without linking the new account directly to the old one.

A friend in the freeer err I mean 3rd world might hook you up

Not only is this incredibly Kafka-esque, it's archetypally Kafka-esque! This is effectively exactly the plot of The Trial!

Though less serious, my wife has a similar problem with Amazon. She tried to review a product (first review for a very long time) and was greeted with this message:

"! We apologize but Amazon has noticed some unusual reviewing activity on this account. As a result, all reviews submitted by this account have been removed and this account will no longer be able to contribute reviews and other content on Amazon. If you would like to learn more, please see our community guidelines. To contact us about this decision, please email reviews - help@amazon.co.uk."

The 'community guidelines' link goes to a page with what the rules are, but doesn't say what rules have been broken.

We emailed Amazon, using the email address in the post and got this reply:

"I relayed your information to the team trained to handle this scenario regarding your inability to post reviews. They are not able to provide an exact date or time when they expect this issue to be resolved. For more information about our policies, please see our Community Guidelines (http://www.amazon.co.uk/review-guidelines) We appreciate your patience in this matter.

Warmest regards,"

'Warmest Regards'? Really - you just told me she's locked out and it's gonna stay like that for the foreseeable future. :(

Really? The world is worse off because of the Internet?

The Internet has been the single best thing that has happened to the world ever. Information is effectively free now. It's given limitless opportunity to billions of people everywhere in the world, regardless of class or wealth or social status. Largely, the Internet itself is not discriminatory.

Sure, it has its downsides, like misinformation, and 1 in 10m people getting locked out of their accounts.

I lost my Google account, which was tied to my phone number (Google Voice), a few years ago. It sucked. But, honestly, it wasn't even as bad as losing my license.

I'll take free information for that.

He is referring to the tech companies, you are referring to "the internet"

Are you certain you two are speaking about the same concept?

"This is exacerbated by the fact that 9 out of 10 times a story like this appears it's an algorithm gone rogue which its billion-dollar shepherd assumes is infallible."

The "facts" are a bit misleading though. You won't hear stories like this when it isn't framed as a case of an algorithm gone rogue, and of course whether the billion-dollar shepherd assumes it is infallible or not is something being projected onto the story.

One thing that is tough about these stories is that there a class of US enforcement responses for which it is illegal to disclose why you responded.

For instance, it is a prison-time offence for an individual employee of a financial institution to tell a customer they filed a SAR on them.

The way you get kafka is BSA compliance officers have personal liability for this reporting, so they prefer not to have customers that trigger reporting, but they cant tell a customer why they are dumping them, so the word comes from ‘on high’ or an algorithm and thats it. Nobody internally can help because for their own good they do not know the reasons for account termination.

This may be that or it may not, but probably its not that google is being dicks to its own employees. It is an outcome of a pernicious set of government and institutional dynamics.

Filing a required financial report is not similar to terminating someone's access to their account

Filing an SAR usually comes (99.99%) along with suspending the account. Suspension of account usually comes before filing the SAR as to stop any further illegal actions.

> Filing an SAR usually comes (99.99%) along with suspending the account.

You're missing half of the analysis. What percentage of account suspensions are preceded by an SAR filing?

(Probably not many.)

Google is not a government. It just acts like one.

Its only 9 times out of 10 when the story is escalated to the front page of Hacker News. For all we know, 99,999 times out of 100,000 its a case of fraud or law enforcement action that is completely correct and valid, and you do not give those actors information on how you detected them.

It absolutely is, which is why what they're doing looks fine on internal metrics.

Imagine I make a laser bug zapper and install them at every fast food joint in the US. 9999 out of 10000 times it zaps an insect. 1 out of 10000 times the laser fires it blinds a child.

I could wax all I want want about the 99.99% accuracy, the _relative_ accuracy won't mean a thing to the million people blinded by it.

When there is a mix of spambot garbage and human beings that being harmed the right metric isn't the ratio. Blinding a million children wouldn't go from unacceptable to acceptable just because the level of insects swarming around a restaurant increased by a factor of 10. The harm stands alone, and there is a level of harm which could not be justified by any amount of boring spambot influx.

Something about this argument doesn't smell right.

I care about the crime rate, or car accident rate, or botched surgery rate, because it tells me the odds that something bad will happen to me.

Given a stable rate of bad things, population growth alone causes more bad things to happen.

If we took your argument about absolute harm seriously, then we should, say, encourage population reduction until there are only 10k human beings on the planet. That would surely minimize the number of bad things that continue happening to people.

It is trivial to put every criminal to prison: put everyone in prison.

It is trivial to ban every spammer: ban everyone.

If you ban most spam while significantly harming some of your users, you've done your job poorly.

Can you give some examples of this type of job done flawlessly? i.e. where all bad actors are stopped and no good actors are hurt in the process

No, but I can think of a few examples where most of the fraud is stopped while not significantly harming users.

Make fraud impossible through technical means or make "abuse" impossible by just not providing any incentive to do so (for example, make the service paid so that there is no longer any incentive to "abuse" the free service)?

Humans are notorious for under estimating routine hazards, and overestimating things that are rarer. We worry about strangers in deep dark alleys trying to rob/rape/beat/kill us, when in fact, most crime is perpetrated by someone the victim is familiar with.

Your comment calls to mind the paperclip maximizer thought experiment: https://wiki.lesswrong.com/wiki/Paperclip_maximizer

Usually cost/benefit arguments do consider the benefits. If I kill millions of mosquitos and reduce malaria fatalties by 100 per million population while blinding 1 per million, then unless there is a better way to kill the bugs we should consider this approach.

I don't really see how this line of argument really translates to this issue with Google. First of all I should have acknowledged that imprisoning data is almost assuredly unacceptable and that unless Google is acting directly in response to a law enforcement action they should give you a way to download your data when they tell you that they have chosen not to continue the business relationship they have with you.

But there will be cases where they cannot do that, and in some cases it will be a mistake but the reason they cannot solve this problem cheaply is because usually it is not a mistake and so litigating 99,999 cases to find the one worthy of saving is a hard case to make, why should Google pay for that?

I should have mentioned up-front that this article scared the hell out of me and I'm probably moving to Fastmail. I've had my own domain for going on two decades and am still grandfathered into the free gsuite for it but I'd much rather pay someone who will support me than use a free service that could cost me access to data that I might want again in the future. I also realized I could be vulnerable to a trap where my DNS account is disabled at the same time my email is, meaning I couldn't even move the DNS without first recovering access to my mailbox.

I think you would agree that there is no plausible amount of spam traffic which would justify google murdering a user to cut the spam down. That it's just incomparable, right? Even though the cost of being dead would be borne by the user and their family and not part of google's bottom line-- murder for spam reduction would be right out.

I don't think it's that big a leap to say that it is unlikely that there is any plausible reduction in spam from an automated facility that justifies the kind of extreme harm and disruption created by locking an honest user out of their decades long email-- which might be more damaging to them then a home fire--, with zero effectual recourse. Yet it happens because the cost of the spam is on google's 'balance sheet' while the damage to the user is not.

So that is the sort of argument that I'm making. I think google is creating damages wildly out of proportion to any plausible benefit, but it works out for them currently because the damages are externalities.

Were Google a more conventional company the threat of litigation (even litigation they'd ultimately win) would help internalize some of these costs, but Google has grown to such a size and scope that even the federal government finds prosecuting them to be extremely daunting.

An externality is a cost borne by an unrelated third party. That is not the case here. These are two party arrangements. You and Google have engaged in a contract; Google is providing you email in exchange for your eyeballs, and there are terms and agreements.

There should still be a solution though. Maybe this is a terrible idea, but one idea: Google could sell a service where you pay them $200 and they thoroughly review your case, tell you what happened and work with you to restore access to data, maybe even setup email forwarding for 90 days or something that comes reasonably close to making you whole even if they can't restore service.

If in the course of doing this work they figure out they screwed up closing the account in the first place, the money is refunded. Of course fraudsters would not generally want to sign-up and pay this money as - even if the information of how they were caught was worth $200 - that would create a paper-trail. And it could still be the case that Google is under a FISA letter or something and can't fulfill this service, and in that case they'd refund your money as well.

Bullshit. Maybe 99.999 are successfully identified, but one is mistakenly banned/suspended for no reason and it often has significant impact on his/her business. Google automation is a broken system. A system made by people who never have to deal with the actual users.

> you do not give those actors information on how you detected them.

Not about how you detected them, but you should tell them what you detected. E.g. if you're using a spam filter, you don't want spammers to know which exact keywords triggered the classification, but it wouldn't hurt much to let people know that their account was locked for sending spam instead of some other reason.

If it were spam I think they'd tell them that. If they don't tell you the reason, almost certainly its fraud, and the only way to win against fraudsters is not to play with them. Anything you tell them is just an invitation for them to argue with you and waste your time, or infer detection methods. It is very hard to control fraud costs without alienating your users, especially for a free service with low barriers to entry. That isn't an excuse for Google to be so terrible, but I do think people lack appreciation for the actual problems here.

> The only reason these tech companies managed to get so big is because they'll cheat at anything that requires human scale. Support, moderation, taking responsibility for the content they host. They somehow managed to skirt on that just as the web was transitioning from a wild west to a somewhat ingrained, regulated place and the world is worse off for it.

People willingly chose the free option and chose to not pay companies that would have offered support.

The argument that customers chose to be ripped off by opting for 'free' is not supported by evidence that paid services are any more accountable.

Anyone who's had to deal with Google support for paid business accounts will tell you that the situation is barely any different for paying customers. Things might be different for very large businesses who are spending millions per month, but that's hardly relevant to how Google might handle email customers hypothetically paying $9.95 a month for a personal mailbox.

I do not understand why anyone defends consumer abuse by businesses. Unless they work for said businesses, or own their stock, there is absolutely nothing to gain by siding with an abusive business over an abused customer. The business isn't going to reward their supporters' loyalty by treating them better.

Collaborating with hostile entities is not a redeeming quality.

Lots of people with free gmail accounts have their app store purchases locked up behind that very email, don't they? Or their phones.

> Anyone who's had to deal with Google support for paid business accounts will tell you that the situation is barely any different for paying customers. Things might be different for very large businesses who are spending millions per month, but that's hardly relevant to how Google might handle email customers hypothetically paying $9.95 a month for a personal mailbox.

Then don’t pay google $10 a month. I don’t. I do the work of supporting businesses that I think deserve it. I know some businesses have monopolies that customers can’t fix by voting with their wallet, but email isn’t one of them.

> Collaborating with hostile entities is not a redeeming quality.

Using their free services and not voting for the right candidate in the market by paying for the service is collaborating with hostile entities (in the example of email where there is no monopoly and almost zero cost to switching).

Because support sucks universally and everywhere. There is no way to know if you will get support, even if you pay. Support is one giant lemon market.

https://en.m.wikipedia.org/wiki/The_Market_for_Lemons

I get support from apple when I walk into their store, or I open up a chat window on their website. I received it in April when my phone died and they helped me try to revive it.

I get support from Fastmail, and Migadu and Target and banks and plenty of other companies. I also provide support for my businesses.

Support usually sucks with monopolies, such as ISPs who know you have no alternative. But even then, I’ve always been able to get someone on the line to fix my issue.

Doesn't GDPR have some sort of clause against "algorithmic decision making"? So in situations like this you can deny Google automated decisions? Probably not - can anyone explain, who knows the topic?

I'll play the devils advocate: moderating any platform is a challenging endeavor, mostly because of malicious users. Having all the rules broken down in detail allows bad actors to either get close to the line but not cross it, or abuse the system while technically not breaking any rules. As such, having very broad rules (read TOS) helps. Additionally, not having to explain exactly what was violated means that people can't probe the system to figure out the rules in detail as well as the limits of acceptable behavior.

The problem with such opaque systems is that it can go terribly wrong, but the answer is to not centralize anything important; always keep a backup. After all, the cloud is someone else's computer.

If you want to become a platform that everyone in the world uses and reap those billions in profits that come with that, maybe... just maybe you should be responsible for sane, humane moderation as well. Don't build something that's manageable and then complain when people ask you to manage it.

I've said this before here, I'm pretty libertarian, and very much in favor of small gov, but at this point its become clear that anyone who strives to become an internet platform where market dominance equals monopoly or duopoly, should be held to strict regulatory standards, re: free speech, appeals, etc. similar to what a gov entity is held to.

> I've said this before here, I'm pretty libertarian, and very much in favor of small gov, but at this point its become clear that anyone who strives to become an internet platform where market dominance equals monopoly or duopoly, should be held to strict regulatory standards, re: free speech, appeals, etc. similar to what a gov entity is held to.

About that - the government can be pretty opaque. I too would like some strict regulatory standards to apply to the CBP.

Maybe it's better not have platforms that everyone on the planet have to use in order to access content/software.

Perhaps - but it has always been prudent to keep redundant copies of anything important since before computing platforms existed. Frequently backup your data and test the backups.

The bigger problem here is not really about the content, but the means. If all e-mail communication goes through Gmail (and maybe a bit via Outlook and some remnants of Yahoo), at some point you may lose your ability to communicate with the rest of the population unless you subscribe to one of these services. This is already happening to some degree but is definitely getting worse.

What seems novel here is that the author _actually works_ at Google and still can’t help despite being an insider. Although, not sure if that says more about Google or more about the banned account.

TBH, this is the way it should be.

Getting your account unbanned shouldn't require having an insider.

---

There should be a clear reason for why an account is banned. When you're accused of a crime in a society, we don't just tell you to read abstract law. We tell you exactly what you've been accused of, such that you can defend yourself appropriately. There is this basic principle in English law that states:

- It is better that ten guilty persons escape than that one innocent suffer.

What's been happening with many of these companies is that many guilty actually do escape, whilst many innocent actually still do suffer.

If Google insiders had special access, wouldn't that be similar to exactly how the recent Twitter vulnerability was exploited?

Although, in this case, I guess the guy was just looking for any qualitative explanation for how to fix the situation, not specifically asking for exceptions to policies to be made.

As a Google employee, I don't expect to have any special privileged access to Google customer support and I think if we did have it, wouldn't you think that would be unjust?

Disclaimer: not saying anything about the qualities of said services.

> ... wouldn't you think that would be unjust?

Not at all.

Being able to more efficiently access other systems and employees at your company than outsiders isn't "unjust" in any way.

Not being able to do so, seems very broken and weird. :(

Does Google have customer support at all?

> moderating any platform is a challenging endeavor, mostly because of malicious users. Having all the rules broken down in detail allows bad actors to either get close to the line but not cross it, or abuse the system while technically not breaking any rules.

Couldn't that same argument be used to support secret laws and secret courts enforcing those secret laws? After all, we're definitely seeing the problem of people going as close as possible to the line without overstepping.

I think those laws would help tremendously, but mostly by forcing everyone to be overly cautious not to break them, creating strong chilling effects. They'd stifle freedom, and so does Google's secret law system.

To minimize fallout, I think it's more useful to split up Google along services (Search, Youtube, Gmail, Office/Suite etc). You could search for double plus ungood things on Google Search then without running the risk to loose access to your emails.

> I think those laws would help tremendously, but mostly by forcing everyone to be overly cautious not to break them, creating strong chilling effects. They'd stifle freedom, and so does Google's secret law system.

No need to have new secret laws - there are already enough obscure laws that I guarantee you have broken many of them whose statute hasn't expired. That is why you shouldn't speak to cops without a lawyer.

That said - it's not a Google problem as it's the norm. Most services, banks or even potential employers will tell you the reason for declining service - not because they want a chilling effect, but because there are so many ways it can get wrong (for them).

I'll be honest here: move moderation to AI/robots and sent automatic messages "go out here! we're so sorry.." in loop is completely bullshit and main reason to avoid Google.

And I'm definitely not "so sorry" about.

That’s just unfair business practice that works against ill educated. Way to keep it to nice people, but nice in the context ultimately means established.

Running a government is also a challenging endeavor. Does that mean that the laws should be left obscure?

I'll play the devils advocate

Why?

Because it is necessary to develop a "theory of mind" to figure out why some entities behave the way they do. You'll encounter fewer surprises that way :)

edit: also, I have the battle scars from moderated a few niche online forums/properties that were mildly popular. People who abuse services are surprisingly tenacious and creative. If there is the potential to make money - even a little - you get abusers who are tenacious, creative and sophisticated

I don’t think anyone suggested moderating shouldn’t happen or that it isn’t hard. This situation isn’t the result of unpaid mods of a web forum - Google has incredibly vast resources at its disposal.

Unfortunately the devil’s advocate has brought us no closer to an understanding of the problems posed by OP: how to appeal an unknown violation, how to regain access to ones data, etc.

My point was not that I was overwhelmed or under-resourced: it's just that trolls/assholes/rule breakers force you to regress to "I know it when I see it" because they can break the spirit of the granular rules without breaking the letter. The solution is to make the "spirit" the rules (i.e. be super-broad about what constitutes abuse)

Because considering and understanding other perspectives is important for actually getting things done?

Reply on news.ycombinator.com