Hacker News Reader

Comment by kmeisthax | Hacker News Reader

Everyone here is commenting about overautomation, but this isn't an overautomation problem. It's a secondary sanctions problem. The developer isn't being banned for breaking Google's rules, he's being banned for having hired someone else who later broke those rules; and then that ban was transitively applied to their personal account as well.

This is beyond the pale. Google should not have the power to decide who you are and are not allowed to hire. It both goes against the basic concept of a limited-liability corporation, and harms worker rights.

View on HN

I had a scare last year where Google supposedly gave me 30 days before they would shut off my Google account of 20yrs. Family photos, youtube videos, 20yrs of email, not to mention the treasure trove of personal documents on GDrive. It took two weeks to duplicate the content and back it up elsewhere. This is a paid tier Google account and I've yet to get an explanation on why this happened. It appears to be because of an "associated" (whatever that means) Google Business account for a startup where I worked where they shut off my GSuite account after I resigned, but customer service couldnt provide a real explanation why it would also terminate my personal Google account. The automated websites where you upload photo ID to prove identity didnt work and didnt give an absolute confirm/reject...so i slept uneasily for almost a month knowing that my 20yr account might disappear.

Ultimately it did not disappear in 30 days. Was it because I upload passport photos? Not sure. Because I spoke to customer service? Not sure. Because the original shutdown notice was a mistake? Not sure. The lack of clarity made it worse.

I've heard stories about people losing personal accounts like this due to GCloud usage. At work, where I'm CTO, I have open access +MSAs to the three major cloud providers -- BUT I am very hesitant to use anything but AWS/Azure. The risk of something going wrong with GCloud and that metastasizing to my (or anyone's on the team) personal Google account (or vice versa) is huge and just not worth the risk.

After reading so many posts like this, I decided to bite the bullet and start moving off-Google. Funny thing is, ProtonMail and Obsidian are much better than Gmail and Keep anyway.

I'm still forced to use Google stuff here and there but I'm no longer dependant on them, and coincidentally I've been sleeping much better recently.

So how do you know those services don't pull the same stunt?

I use various google services, and do a monthly backup of everything. I guess that's a sane thing to do with any service, even self hosted ones.

> So how do you know those services don't pull the same stunt?

It's a questions of eggs per basket. Google wants you to keep everything in their one basket, and the result is that if they arbitrarily terminate your account, you lose everything. If they give you 30 days like OP, you have to remember all the different places you need to download content from.

If you split your services up, a sudden termination only affects a few things rather than everything, and a forewarned termination has a much smaller surface area you need to consider.

> If they give you 30 days like OP, you have to remember all the different places you need to download content from.

Google Takeout (takeout.google.com) should give you almost everything in one place. It's a good idea to do this periodically in case you don't get the 30-day notice. Be prepared to download a few dozen GB, though. And there is no "incremental" option.

Takeout is nice, but I am surprised by the lack of features in other products that would easily allow to import the data from Takeout format.

I wanted to migrate from Google Photos to iCloud. Turns out there is no easy way how to import the photos to iCloud without loosing metadata. I gave up and just bought more storage on Google.

I agree with you there. All the data is right there, in fairly open (if not exactly standard) formats. They even include an index document and basic descriptions of the data formats. One would think their competitors would want to make it easy to port exports from Google Takeout into their systems.

I'm a bit surprised that you had trouble importing photos, though. Isn't most of the metadata kept in standard EXIF tags in each file?

Everything has benefits and drawbacks of course. It's true that you can minimize the impact of one service pulling this stunt.

However, I don't agree with "remember all the different places you need to download content from". Google does this with Takeout, so I can have 1 backup of most of my things. When using different services, I need to have various backups.

Reason is: I don't depend on services giving me 30 days. I assume they can block access on the spot.

Obsidian is a self-hosted repository that ultimately stores everything as plaintext markdown (.md). It is 100% portable and by default owned by you.

Protip: you can easily sync obsidian by sharing the top-level vault directory with syncthing. Its entirely transparent, you just start obsidian and open the vault, and changes you make on one system automatically appear on others.

As for protonmail, its better than google -- but you're right in the data ownership. In the case of protonmail, they have a much better track record than Google, but if you are really paranoid choose a service that supports SMTP/SNMP. You can then just have a mail client store the mail as an archive or connect it to any other mail system.

I have mentioned my preferences before, but I'll refrain from turning this comment into an unpaid ad. Drew Devault's recommendations are pretty good though: https://drewdevault.com/2020/06/19/Mail-service-provider-rec...

I think you mean IMAP. Protonmail supports SMTP (the mail-sending protocol; it needs to to interoperate with other mail servers) but not IMAP (the client side mail-reading protocol).

SNMP is something entirely unrelated, afaik.

Ah, yes you're correct. Total brain fart, unfortunately too late to edit so my mistake must live on in infamy...

ProtonMail offers an “IMAP Bridge” application that keeps a local IMAP server running on your machine, while still decrypting your messages on-device.

Depends on the service. For example, if proton bans me I can move my email to a different provider because I own my domain. In case of Obsidian, it's an offline app that uses Markdown, so I can easily migrate to a different note-taking software for any reason.

Your backup note is on point; I highly recommend everyone to do a Google Takeout every few months (or at least years!!). If you've never done one, like most Google users, you're playing with fire.

Notice that Google Takeout is broken with regards to non-UTF8 email encodings (for some of you who archive old emails). I noticed it when coding a small tool https://github.com/karteum/gmvaultdb to (among other things) import the mbox from Takeout into an sqlite DB : Google performs some encoding conversions that permanently break all non-ascii characters in non-UTF8 emails (they are all replaced by 0xEFBFBD). In order to archive old emails, I had to use mbsync with IMAP (gmvault does not work anymore with Python 3, and I didn't try yet https://github.com/GAM-team/got-your-back ).

I think for email it makes sense to have an offline IMAP setup (i.e. a copy of all mail is downloaded) on at least one device (e.g. your desktop) so that you can still access things if you are abruptly cut off from the provider. This can come in handy even for temporary outages.

I agree, but an an alternative to mbox/maildir format on your machine : I wrote https://github.com/karteum/gmvaultdb in order to have a single-file SQLite DB with all old email contents (all UTF-8 inside, simple/minimalistic schema), together with a small GUI to consult emails and do queries (full-text not fully implemented yet but this is the target) and all attachments extracted in a side folder so that I can directly browse with a file manager.

If your domain registar bans you, you’ll lose your email all the same.

“GoDaddy has two major problems.

First, their customer service (…).

Second, if there are accusations made against you, they will shut you down and side with your accuser more often than not.“ https://www.warriorforum.com/main-internet-marketing-discuss...

> If your domain registar bans you, you’ll lose your email all the same.

Maybe? I would hope that you could raise the issue with the dowmain registry or ultimately ICANN if the registrar does not let you move the domain elsewhere after banning you. Registrars do not have the same platform ownership over domains that Google has over gmail accounts, they are just middlemen.

Domain registrars are indeed a single point of failure :(. Do you recommend something here? Because I haven't found a proper solution myself.

Fair point. I think in this case relying on a domain registrar or an email service is somewhat inevitable, though.

Proton, or fastmail, or any number of other mail providers for that matter, don't control half of the internet. They don't associate personal accounts with professional accounts, and they can't block necessary services at a whim.

> they can't block necessary services at a whim

why not?

Because they don't _control half the internet_. They only have one service you use, not 50. Your phone (voice), cloud storage (drive), website hosting (sites), chat (not even gonna try), music streaming (YouTube music), video hosting, etc aren't all dependent on the same single point of failure like they are with Google. All your mail provider can do is stop processing your email for you (at which point you switch providers). If Google doesn't like you, you lose _all_ of those things, likely all at once. Google even has a hand in your credit card transactions with Google Pay (though anecdotally, I've never actually seen anyone use Google Pay, so not sure how many people that would affect). Google provides such a diverse range of services that having them all shut down on you is a huge deal. I'm currently in the process of looking for a replacement for my legacy Google apps account, and that's just email.

Thanks for explaining, I was curious too. I only use Google for email hosting out of your list. I can understand how people are deep in that ecosystem though.

When they start growing close to the size of Google you could start worrying about this type of problem. With smaller players you could reach them easier if something happens, especially if they care about their customers. Ultimately nothing is guaranteed so backing up the data regularly is a good idea but that's not the only problem though, a lot of people's identity is tied to some services that if they stop functioning for them they're in a bit of a nightmare situation.

In my case, I moved to Fastmail... and yeah, the hilarious thing is people remember moving from AOL to Gmail over a decade ago, and think Gmail is still so much better than everything else.

Gmail is worst-in-class at this point. It's slow, it's bloated, it's bad at spam filtering compared to the alternatives. They've been riding on people remembering email before Gmail, but not really actually stayed competitive with any modern alternative offering.

I admit I don't have a lot to compare between, but my company switched from Rackspace mail a couple years ago because of the unrelenting spam and seemingly no way to stop it. I suggested Google because I hardly ever see any spam there in my personal account, so we made the switch.

The difference is night and day. I can look in the spam folder for my work email now and there are hundreds of spam messages there for the last 30 days, and absolutely zero false positives. I have seen a handful of spam messages come through, but it's in the single digits over the last two years.

I believe you, but there is still the usual dark side that has been mentioned maaany times here: very often emails sent by small/tiny email providers aren't delivered at all to Gmail receivers.

That's often the case with one of my friends who has a Gmail email address: anything that I send him (once or twice a year) doesn't even show up in his spam list without first making him start an email exchange to me => in my opinion that kind of filtering is just too easy to do (come on Google, at least put it into the spam folder and/or show it as a colored/blinking line and/or put some warnings whatever - don't just delete it), and of course it poses questions about oligopoly etc. How Gmail works is just not fair (in my opinion) :(((

Silently dropping mail is something that should just not be tolerated. We need to enforce that email providers either deliver something (to the inbox or spam folder) or reject the mail at submission time - with legislation if needed.

It's the ones that never come through you need to worry about.

I tried switching to Fastmail (from Gmail) 7-ish yrs ago, and I ended up switching back to Gmail specifically because the spam filtering was far worse with Fastmail. Is it Fastmail's spam filtering actually better now, or does it just seem that way when you start a new account because you're not getting much spam in general?

Another anecdote - I switched earlier this year (prompted because of the ending of my grandfathered Gapps account, but my experiences are largely with the "standard" Gmail account vs. Fastmail).

Spam filtering on Fastmail has been the same/better than Gmail was - including possibly fewer false-positives on the Fastmail side. Gmail was getting worse about those, both with mailing lists and individuals' emails.

Like many on HN, I'm diversifying my data/access risk across more providers. Too many wake-up calls recently about Google locking people out. There are still some services Google is compellingly better enough that I still use them (Android, Maps, YouTube, Google Sheets), but Email was too precious to tie up with them. I also wanted to finally kick myself into stoping using the `gmail.com` address at all anymore (maybe 20% of my emails before the migration).

So, I moved to Fastmail in 2016, and I'd say I've never had to get a legitimate email out of my spam folder, and I've never seen obvious spam hit my inbox. I do occasionally get the "my husband left me five mil overseas" type garbage, it's always spam-binned correctly. (Meanwhile, my Gmail account I retain in case someone tries to reach out to it, regularly has emoji-subject-filled spam and other garbage Gmail fails to classify, and also has a deluge of garbage spam coming in... at this point, Gmail is 98% spam for me?)

One important point here, and I don't know how long you used Fastmail when you tried it, is that Fastmail uses a personalized spam filter. It probably took me six to eight months to receive enough spam on Fastmail to actually train it. (In the interim, they use a non-personalized filter, which as I said, still worked!) Gmail doesn't seem to be able to make personal spam decisions: When I was regularly using Gmail, some types of regular messages would spam-bin no matter how many times I marked them not spam or classified them as a particular category of mail.

I switched to Fastmail (with my own domain) about a year ago, and haven't had any issues with spam so far.

Many people consider Gmail as consenting to spyware. Unfortunately, lots of people don't know any better or haven't bothered to take a good look at the account settings or Google's policies.

Anybody that knows better, will avoid Gmail like the plague or use it for only the minimum.

That's so true. Switched to Mailfence recently. I still can't get used to it that whenever I click on something, the action gets done immediately. Its web/mobile client is a bit limited but crazy fast.

How is ProtonMail better than Gmail in your opinion? I use ProtonMail but find the UI meh, the spam filter worse, and the calendar bad (not to mention it's costing me $). I like the privacy aspect of course, which is what drew me to it in the first place.

I’m happy with Proton right now too. Really just need a mobile app for the calendar and I’ll be all set.

There is a mobile Proton calendar app.

There is an Android one, but not an iOS one (at least last time I checked a few weeks ago)

I use it, but the requirement to be online in order to add or update entries is quite annoying

Not yet for iOS from what I’ve seen.

EDIT: Verified. Not yet for iOS.

the editor for Google Docs is the one really good thing I can't get elsewhere, but I don't do that much important stuff in it - just like planning vacations, etc. Once I'm done editing something, if I want to back it up I can just export it elsewhere

I've really pared down my Google usage with the end of grandfathered GAFYD accounts as the last straw, so down to Sheets, YouTube, and Android as my last google usage. YouTube has no alternative, Android has too much sunk cost, Sheets I'm probably going to go back to Syncthing + Libreoffice I guess. Office 365 is the equivalent alternative, but not sure I feel much better about MS's consumer products than I do about Google.

Just use Invidious links instead of going directly to YouTube (for example, yewtu.be for the same remainder of the URL) for viewing. If you're talking about hosting videos, use Vimeo. Even when people post youTube links I use the Invidious alternative to stop feeding Google data. Also invidious has embedded download capability on their various sites.

What’s the sunk cost with Android? Apps? It’s very easy to switch to iPhone, I did it a year ago.

Apps and well the alternative to Android for me would be Plasma Mobile or something anyway. Many apps I use (Syncthing, Firefox, file manager, emulators) are forbidden or crippled by Apple policy.

While I have a work iPhone 12 so I use both iOS and Android daily, I do actually prefer the Android ecosystem, plus iOS being locked down in terms of installing third party apps is a disqualifier for my personal device. Also bugbears like the headphone jack, though I might be out of luck there in Android in another device rotation.

Microsoft has a very usable online version that's free (with a bit of upsell here and there). Arguably more capable than Google Docs.

Out of the frying pan and into the fire. Of course, I'm being a little flippant, but the MS ecosystem is not without its problems. A colleague has 3 MS accounts for dealing with 3 different things (a government contract, a 3rd party company contract, our company account). Because of this, he was in hell for days because of some fubar on the MS side. I have (seemingly!) different MS accounts, for Azure development and Office 365 and I am regularly confused by the various MS websites.

MS Azure accounts always seemed odd and overly convoluted to me. I had an issue with my personal Microsoft account where I couldn’t sign up for an Azure trial (wanted to kick the tires on Codespaces before it moved to GitHub). Turned out, my account got associated to my kids’ schools MS account because that email address was on a school mailing list. That was a pain (and many hours) to get figured out.

my friends that have one MS/Outlook account at their jobs, which have enterprise support reps for their big enterprise accounts sometimes have multi-day lockout for unknown reason, 2FA failure for days, absurd issues with timezones being inconsistent across MS services, etc.

Wait until you're locked out of your Outlook.com account. No way back.

For Google docs I switched to using a Synology server. Very nearly as good (better, in some ways) and I don’t have to worry about what Google is up to.

The up-front cost and setup time is a stiff investment, but I’m much easier in mind now.

The other side of the coin is my wife’s gmail, which is going to be deleted come May. So... we gotta figure that out.

What sort of collaborative editing does Synology allow? Is there a Nextcloud / Owncloud alternative to Docs / Sheets for collaborative editing?

> Is there a Nextcloud / Owncloud alternative to Docs / Sheets for collaborative editing?

Yes, NextCloud and Owncloud both integrate with OnlyOffice Community Edition[0][1] which supports collaborative editing of text documents, spreadsheets, and presentations.

[0] https://www.onlyoffice.com/office-for-nextcloud.aspx

[1] https://www.onlyoffice.com/office-for-owncloud.aspx

Same as Google, afaict. It has a slightly better permissions model, imo (I can create a doc with a password and share the link freely, or I can give specific permissions per user, like Google). Same editing/commenting/viewing interface.

My collab needs are pretty light, I only work with a few family and friends, but I haven’t run into anything I wanted to do in Synology that I couldn’t.

DropBox has a hook into Office's editors.

Protonmail specifically seems to have strange problems with some old and busted email systems, ex: I've seen several government ministries in Taiwan (roc) that for some reason can not send email to protonmail or domains MXed there and no one has been able to explain it to me.

Protonmail seems to routinely get flagged by fraud, spam, and security systems. You emails are probably getting eaten by a security appliance before it even reaches the government exchange server or whatever.

Protonmail is one of the few remaining email hosts that let you create a free account without a verified mobile phone number. It probably does get used for spam quite a bit - relatively to gmail/outlook/etc., not in absolute terms that is, IME most spam is from compromised hosts and botnets. Then again, the major mail providers, especial Microsoft, are really trigger happy and don't seem to care about the damage they do to smaller providers so it could just as well be lazyness or intentional anti-competitive behavior. I think at some point we will need legislation to keep email an open federated system.

> It probably does get used for spam quite a bit - relatively to gmail/outlook/etc., not in absolute terms that is

Not really, big players have the advantage that nobody is going to block them. Most of them spam regularly by thousands of letters before some automation of theirs triggers (or the spammer stops).

That is not the case as this is messages sent TO protonmail. It may be related anti-whatever measures, but is not typical anti-spam.

If you like markdown note taking apps and want to move completely from being dependent on a 3rd party, I would suggest Joplin.

Currently I'm syncing to a s3 bucket with e2e encryption but of course you could sync to a server you setup yourself including a basic windows box.

Seconded on the Joplin recommend.

I've been using it for a little over 3 years and it serves all my note-taking/storage needs, especially with the relatively recent addition of extensions/add-ons. I have had no issues syncing through either dropbox or Nextcloud.

ProtonMail doesn't do e-mail categorization like gmail, so "much better" is very subjective. Their IMAP gateway is also a paid feature, which is really sucky.

Obsidian?

I'm assuming they are referring to the note taking software: https://obsidian.md/

Correct, it's pretty great and by design immune to Google-like rug pulls.

Nice, thanks!

Did you actually leave Google then? It’s not clear from your story, and it would be a shame that you decided to stay on such a hostile platform.

For my personal accounts, I've stayed but now I have backups of everything elsewhere. I'm also now double-replicating everything across other providers. The value add having everything so beautifully in my Google account is enticing, so I continue to have that as my primary personal account.

For my corporate accounts there is NO WAY i'd use GCP. I have the privilege of MSAs with all three major cloud providers and we're doing most things with AWS. So on the corporate front, I didn't leave because I just didn't enter in the first place.

I tend to only use cloud drive as a mean to share files, but I do not trust them for permanent storage. Always keep offline copy (on multiple storage devices)

Customer service? For a Google account?

Yes, they do have customer service and I did get on the phone with someone. I'm not sure if this is universal, or because I had a paid tier Google account.

That said, the rep failed to provide any definitive guidance on issue or resolution.

Good to know, thanks.

For Google Workspace (previously called GSuite), you do get support. Anecdotal but I recently used their live chat and the person was very helpful and helped me figure out a weird issue with a lot of patience. I would say it was a pleasant experience but this was the only time I needed them so far so you never know :)

I've also reached reasonable-quality support due to being a paid consumer of GoogleOne, which includes phone support for most (all?) google consumer products.

I even had them call me within an hour of opening a ticket.

Is this an issue with all cloud providers? Or just large ones like Google, Amazon, Microsoft?

I'm currently thinking of migrating from Google for productivity to Office 365. Wondering if I'm just re-branding the risk of my counterparty.

>>> Is this an issue with all cloud providers? Or just large ones like Google, Amazon, Microsoft? >>> I'm currently thinking of migrating from Google for productivity to Office 365. Wondering if I'm just re-branding the risk of my counterparty.

With AWS/Azure, you typically wouldnt have extensive personal data with them, so you dont have the risk of work and personal accounts colliding. I dont know anyone with personal emails/accounts/photos on the Microsoft ecosystem. With Amazon, whats the worst that can happen? You lose your connected Amazon purchasing account, doesnt seem terrible.

With Google you often have email/documents/photos with them. If you have an Android phone, you have almost everything with them.

The old rules still apply: if you don't control the computer, you don't control the data on it.

In a way, this is sort of a digital-era generalization of "freedom of the press belongs to those who own one."

What did you use to backup your google photos?

BlackBlaze. It required some manual effort and scripting. It is on a manually triggered batch that i'm running quarterly. I wish there was a service that could do it, ideally on a more regular cadence.

Does photos have an api, or are you doing some cursor/screenspace stuff?

> Everyone here is commenting about overautomation, but this isn't an overautomation problem. It's a secondary sanctions problem.

It's both. When you work with tech companies this kind of overautomation is rife. When you work with any other type of business they give you an account manager and you manage these issues openly together with a relationship. If there was a human at Google who picked up the phone and worked out the problem with the developers before this ban was imposed, this could have all been nipped-in-the-bud before an account was terminated.

My current account doesn't have much money in it, but my bank would call me if there is an issue which would terminate my account, and I'm confident that they would work with me to offer up solutions rather than instantly terminate it. Google should provide developers more respect than my bank offers average consumers.

There is no excuse for them not picking up the phone and just talking these things through before they implement the bans (unless there is active malicious behaviour in an app, in which case I would expect a suspension to happen and be followed up with a phone call straight away).

Google is much more profitable than your bank, and this is why. The reason tech companies sit all at the top of most valuable companies is essentially because they've automated away a ton of tasks which normally require hiring a lot of employees.

The only way to fix this is to legally require it, because nobody's going to stop the profit train by themselves.

>because they've automated away a ton of tasks which normally require hiring a lot of employees

Or they've simply removed those tasks under the rubric of automation.

> Google is much more profitable than your bank, and this is why.

That's not correct. Google is more profitable because it is a monopoly and routinely engages in illegal anti-competitive behavior.

It's precisely because this is the case that it's able to have nonexistent customer service and stay in business.

Ahh yes, Google the bastion of unethical business practices in comparison to.... checks notes banks....

Well, yeah. Bankers would go to jail [1] for the kind of market manipulation google does on ad markets [2]. The realization may not have dawned on our industry yet, but the abuses big tech is currently into are the kind that gave banks their reputation, and also their regulation.

[1] e.g.: https://www.bbc.com/news/business-36737666

[2] among others: https://www.forbes.com/sites/enriquedans/2021/01/19/jedi-blu...

In both cases the organizations would eventually descend into using the skin of newborn infants for making snack food if they thought it would make them an extra dollar.

Which is why both need aggressive regulation.

They're not as evil as e.g. Goldman Sachs, but they're significantly more evil than several local banks that I actually use.

> The only way to fix this is to legally require it, because nobody's going to stop the profit train by themselves.

I don't know what Google's rates of customer service failures actually are, but even a minuscule of rate of horror stories seems to hurt brand, judging from HN comments.

I wonder whether fixing half of, say, 0.00000001% of cases that would otherwise be PR horror stories, could translate into measurable boost to brand value.

Maybe all the math has already been done, and all possible wins for creative automation motivated by business payoff (and promo bids) have already been achieved, or maybe not.

> Maybe all the math has already been done,

I doubt it. Brand value is a notoriously fuzzy concept, and corporate decision-making features a heavy measurement bias. A toxic brand might be measurable by the time it's influencing enough purchaser decisions to show up on "would you consider?" surveys, but that's an advanced stage of the problem.

Good points.

And even if they have a human customer department that you are able to track down it's just some student at a callcenter.

> this kind of overautomation is rife

I've never worked with or for Google, but having worked for software companies my whole life, I suspect that it's overautomation, combined with "silo-ing". Even if somebody identifies the problem from the user's perspective, it becomes a rats nest of responsibilities to untangle to figure out who or what group(s) can address it and how. The people who actually understand how a particular component works and can change it are limited to their particular component and the people who are nominally in charge of "everything" have no detailed visibility into anything at all.

There's also folks that justify their behavior and choices based on the size of their paychecks. As long as they get big numbers it doesn't matter if others lose their livelihoods arbitrarily and without recourse.

> Google should not have the power to decide who you are and are not allowed to hire.

Especially not retroactively.

"Your former employee broke the rules at their next job, so you're banned" is just bizarre.

Google is dealing with a very real problem. There are bad actors, particularly internationally, who systematically and at scale try to subvert / cheat. This includes multiple accounts, and businesses that hire folks who try to cheat the system. Google almost certainly has statistics supporting the increased risk of working with developers / businesses that hire folks who break various rules. Certainly there are false positives as well.

A lot of folks are offended by $100 / year developer fees. If Apple et al charged $10,000 to get going as a developer, they would probably be better positioned to deal with all this less automatically. In fact, game dev historically might have followed a bit of this model (xbox etc).

Anyways, my own thought, there should be a pathway to a $5,000 fee where you get a higher level of human interaction.

>> Google is dealing with a very real problem. There are bad actors, particularly internationally, who systematically and at scale try to subvert / cheat.

I really dislike this explanation because there are so many obvious things they can do. Example:

1. Force uploads of Passport/ID for identity confirmation. If you have 100 accounts with the same passport...ok...issue, but if not, is it worth human review at least?

2. Force credit card payment with address verification, ideally match to passport. Same credit card used across 1000 accounts...ok...issue, but if not, perhaps worth a review at least?

3. Still an issue? Force user to pay $100 for verification and run credit check routine.

The idea that blanket account terminations are the only way to handle issues seem lazy.

The solutions you suggest would prompt more outrage than anything Google does in this space today.

Those are still secondary sanctions.

Op wants to be able to hire somebody with a history of abuse without google enforcing them

OP wants to be able to hire somebody with a future of abuse because they're not psychic...

Even if Google were paying support engineers $100/hr, in what universe is the average developer going to need 50 hours of support per year? In reality, it's at most averaging to 2 hours, and typically only in situations where Google messed up and should really be fixing it for free anyway, because it was their mistake. So, at most, it would be a labor cost of $300/yr including benefits and taxes, and more realistically that number is much closer to $100/yr.

And that's pretending they don't already make obscenely high profits per developer, and can absolutely afford to provide the necessary support for these situations, which again, are largely their mistakes to begin with.

They charge a one time fee of $25 to get a developer account. They provide full SDK / tooling and other resources for that $25 fee.

I don't know what universe android app developers are living in, this is basically "free" for most significant businesses.

For that $25, you are NOT going to get white glove support / treatment. Not happening.

You are conveniently ignoring that developers create apps which are sold in Google's marketplace, of which Google takes a minimum of 15%. They are making more per developer than $25. Please take your inflammatory nonsense elsewhere.

Not to mention that Android would be worth a lot less if there were no third-party apps for it.

> there should be a pathway to a $5,000 fee where you get a higher level of human interaction

That sounds like extortion...

"We're going to ban your account because we want to, unless of course you pay us $5,000 so you can talk to a human to resolve this issue."

This type of setup is routine in most real businesses.

If you want to talk to a tech company engineer for bug fixes, you pay for that level of service.

There is something a bit almost scammy about all these "businesses" demanding white glove custom treatment, but complaining loudly about even being asked to pay a one time $25 fee to get on platform.

It used to be to deploy to a platform / get SDKs for the platform the costs were FAR higher.

There are something like 5M+ android developers. If you want to support this developer pool with 2-3 hours of work per developer per year, you are looking at 15M hours of work per year. And these people also become a risk - they can be socially engineered, they can be paid off etc. We've seen this over and over again.

If you look at phone co employees who are supposed to protect you from sim swap attacks etc, they have a large number of employees, so service is "good", but security? Not so much.

What you are proposing is that google should offer a human service in a very adversarial and tricky area (ie, your own staff may be working against you) and that asking to get paid for that is "extortion" that would result in jail time. This is perhaps why they don't even offer a way to pay (a lot) for a very careful high level review. Folks like you would demand jail time for them. Instead we are stuck with automation.

Google love the extortion business model.

"Bid more than your competitor on AdWords for the literal name of your business or else they'll get the customers who intended to do business with you."

Some users like being made aware of competitors to businesses. In new SAAS app areas, I'm sure the top 3 results will all be competitions to the business I'm looking for. Works reasonably well.

You would think something like this would increase competition between businesses (competitors surfaced immediately for users). Instead I guess this is seen by a bad thing - though it's not been clear to me recently that the FTC is looking out for users, they seem to have gone BIG into protecting businesses for some reason.

I agree but it would actually be better than the status quo.

Would you rather have a neighbourhood mafioso who is amenable to financial incentives or a local random psychopath?

Exactly. I don't think people appreciate how actively all of Google's policies are being attacked and attempted to be circumvented. I'm very suspicious of any developer that claims total innocence.

> Google should not have the power

I can't help but notice the "they're a private company, so they can do whatever they want" folks that pop up whenever somebody's account gets banned for political views are strangely silent right now...

They were cheering it on a week or two ago when it was against Russians.

My favorite was when they were licking their lips and reaching ecstasy over Parler getting deplatformed but then throwing a tantrum like a week later when Terraria dev got banned by Google.

Terraria guy and this guy simply need to build their own Google, Gmail, Play Store, and Android, easy! ;)

> They were cheering it on a week or two ago when it was against Russians.

Also celebrating that Google was ‘on their side’. Until they are not.

> My favorite was when they were licking their lips and reaching ecstasy over Parler getting deplatformed but then throwing a tantrum like a week later when Terraria dev got banned by Google.

That was my favorite one. Basically the chickens cheering on the wolves eating the other chickens that disagreed with them. Now the wolves are eating them as well and they are complaining why they are ‘not on their side’ anymore.

They thought it could never happen to them. Just use the same ‘private platform’ logic towards them for everyone else that is getting banned after Parler and now they are all crying in the comments here.

These companies are not on anyone’s side and these bans can happen to anyone on their platform. They won’t change.

> They were cheering it on a week or two ago when it was against Russians.

Tired of seeing people equate war crimes to Google screwing over some company.

Tired of people not complaining about war crimes in Yemen, Libya, Somalia, Afghanistan, Iraq, etc.

Maybe people getting banned from twitter for their political views is a bit different from people getting banned from their work means because the son of an ex-coworker abused youtube in some way?

This is the exact reason stuff like what Google is doing has gone unchallenged. Any attempt to say "Google needs to put more effort into avoiding false positives with content moderation" inevitably gets met with "Yes, I agree. The two of us both believe that I should be allowed to send death threats and dox random minorities without any criticism of my behavior."

It's both (over-automation and secondary sanctions).

The secondary sanctions exist because it's near-trivial to automatically create dozens of proxy accounts for a bad actor to launder reputation through. So in addition to direct fraud detection, Google has had to automate secondary "Is this account probably the same bad actor" detection.

That system, like any such system (including human review), has false-positivies where two accounts are believed to be the same owner when they are not. But the automation-with-insufficient-human-review problem is specifically Google's mistake, and there's room for improvement.

As somebody whose worked in the large scale anti-fraud area… I always make sure my team knows that the real people who fall through the cracks matter big time.

Anti-fraud is a tough space because you can never be 100% sure which actors are legit and which are scammers… after all if you knew who the scammers actually were you’d have blocked them all ready.

I always make sure there is some kind of escape hatch for legit users who get caught in our system. These escape hatches might not be super awesome for real users, especially if they fell into a bucket that strongly labels them as scammers, but at least they have an out.

I suppose the best practice solution to this is to try to keep company Google Play accounts as "sterile" as possible?

Give access to as few employees as possible, and have all access to Google Play go through a designated, trusted release manager or "play account manager"? And don't log in to Google Play from random browsers and IP addresses which could create an association with other Google accounts?

Or just don't link personal and company accounts. Even these issues aside , there are so many reasons to keep them separate and unrelated. That's not unique to Google but goes for GitHub, AWS, and whatever else.

Use company e-mail addresses to register for everything. Enforce it for your employees. This is in the interest of both the company and the employee. Yes, the summer intern gets a corp email too, which at minimum gets access to internal resources beyond the OT chatroom revoked when they are out.

(Your advise is not bad though: grant granular access as it's needed)

It sounds like Google have other means to establish links between accounts, though? An employee using their personal account and a company account from the same browser is likely to result in a "link" or association being established between those accounts.

From what's written here, it's not clear if such links have been used for these terminations.

But yes, my point of not mixing accounts does go that far - if you don't have separate hardware, at least use separate browsers or browser profiles.

Don't put the cookies in the same jar.

Most likely yes, but as usual it's a black box, we don't really know how it works.

> just don't link personal and company accounts

Easier said than done, in my experience. Years ago I had to log into my Company's Play account on my computer for some specific reason, one time, and more than a year after that, my daughter purchased a game on my android phone and the CEO sent me a message saying "FYI, we just paid $3 for a princess coloring book app, please enjoy it with our compliments but please delete the Play Store login info from your devices." I still have zero idea how that could possibly have happened. That company will be shutting down and now I'm worried that my google account is somehow "linked" to it.

Guess: Logged in using Chrome? IIRC Chrome has specific functionality regarding retaining and linking Google account information. This is how you get the account-selector.

As mentioned in a sibling comment: Utilize browser profiles (Chromium-based/Firefox) or Multi-Account Containers (Firefox).

This may very well be the case, but it was years ago so I don't really know. This type of linking is something that always gives me the willies when it happens without warning and makes me think I should stay away from using components that are too "smart." I got really freaked out once when I was using a portable wireless access point owned by my employer (for on-call duties) in a starbucks and it told me a second device had attached to it. Turns out I had just bought a new iphone and Apple had stashed away the wifi password and automatically given it to the new phone, rather than the explanation being some hacker sitting near me in starbucks. I completely understand why they did this, but it really would have been nice to be asked if I mind if they store a copy of my password in the cloud.

> I suppose the best practice solution to this is to try to keep company Google Play accounts as "sterile" as possible?

This is probably "best" practice, but Google has randomly closed accounts for our mobile test devices. They're only used to run our (non-shady) apps on a single device that is never used with other accounts.

> he's being banned for having hired someone else who later broke those rules

FWIW: there's some reason to suspect that the "later" bit is being spun here. Per the timeline in the article, there were only 5-6 weeks between the employee being fired and Google taking action against the employer[1].

That's pretty tight, and from an enforcement perspective is going to make it extremely difficult to distinguish which entity is doing the bad things. And, frankly, given the spin elsewhere in the story, I'm inclined to suspect more ambiguity here and not less.

What's the ask here, that Google (which correctly detected the association between the accounts) audit the IT permissions logs of accounts that commit bannable offenses before taking action? That just doesn't seem feasible.

[1] They further spin this by trying to claim that the employee left in 2019, but have to admit that he was still present as a consultant.

If you are referring to this section:

Mar 2019 - H. Left the company, all permissions removed except on one game which we were still using H.'s consultation on - The app was unpublished later on

04 Dec 2021 - Termination of H. (Former Employee) account because of multiple policy violations

26 Jan 2022 - Termination of our company account (Raya Games Ltd - AKA TOD Studio) without prior notices and warnings

I think the 04 Dec 2021 is Google's termination of the "H" account.

By that timeline they never fully terminated the association with H. H went from FTE to consultant, who had privileges for what he was working on.

And this is why they got hit with the banhammer. A known bad actor had access to their account.

Guilt by association is the kind of thing people create when they want to terrorize a population for control. It not existing is a basic human right.

What we are seeing is a monopolist abusing its power by directly harming somebody and the civil society refusing to acknowledge any harm. And it's doing so by the most visible power demonstration it can.

Google has freedom of association. If they don't want to work with you based on your employees, that's their prerogative. That's not controlling who you can hire.

Really, it's a monopoly problem. You shouldn't be affected by whether google wants to work with you or not

I'm not buying this line of reasoning entirely.

The problem isn't that you don't have options with regard to hosting, email, etc (with the notable exception of google play store), the problem is that once you've picked your option it's hard to migrate out, and as a customer you have a right IMO, whether in the terms or not, to a good faith effort on the part of the service vendor to sort our any problems you encounter with the service. If a robot just shuts you down no notice and there's nobody to reach to sort it out that's a negligent business practice and I believe any vendor of any service that operates this way is liable.

If they want to offer migration tooling, notice and access to your data I can see it being alright. A pain in the ass, but at least not the end of your business one morning while making coffee.

As far as google play goes, I think there's the monopoly aspect to work on and hopefully legislation brings a resolution to this problem, like offering independent repositories as a default option or something like that, til that time though, do not rely on it entirely. If you have to open source it and put it on f-droid, maintain an aptoide repo, apk download on your site and market that heavier than your google play account, whatever you have to do, just do not rely primarily on the play store because you're basically giving google the keys to your kingdom.

Pick a provider with that option. Building a business on top of a business that can shut you without recourse is risky.

So no one should make an Android app, since the persistence of Android (with or without the play market) relies on Google not trying to lock it down into something similar to what Apple has.

GDPR Article 22

> The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.

> In the cases referred to in points (a) and (c) of paragraph 2, the data controller shall implement suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision.

https://gdpr-info.eu/art-22-gdpr/

GDPR Art. 4:

„ personal data’ means any information relating to an identified or identifiable natural person (‘data subject’)“.

This is a business, not a natural person.

> and that ban was transitively applied to their personal account as well

Data can be both, in which case GDPR right still apply. Several GDPR fines have been handed down for processing business data about a person. Especially (but not only) data about sole proprietors/solo traders.

Got a link? Because while I don't doubt the logic, it just seems too esoteric to be an actual "issue" that people know about. Plus, I can't find anything.

Cool sounds like this guy can open a police case, a detective or police person looks into it, finds "yeah, sure enough, we audited Google's code and they broke rule 2c, so we'll give you X-million in compensation for this." And then the detective (because it's an open-shut case mind you) goes further with: Getting an extract of 12,393,333 other people affected by this "problem" so they issue a court order to charge Google 12,393,333 * X-million in damages. And then further also issuing a court order for Google to stop all operations immediately until they deactivate this automated process.

As if that will ever happen. We don't live in a world of rules and logic until things play out as simply as above.

Agree with everything.

Just clarifying that the concept of a limited liability company has nothing to do with this. It is about not having company liabilities (e.g. debt) reaching stockholders (e.g. banks seizing your personal car and house to pay for your business defaulted debt).

The timeline makes me wonder if the personal account ban triggered an audit of their previous actions and found similar activity from when they were an employee.

I can feel the downvotes coming deep in my bones.

But Google has its own reputation (and users) to protect. It's taking a risk whenever it allows a developer on its platform. If a developer with low name recognition uploads malicious software, it's not the developer's name that makes the headline.

Crucially, there's no information on what the employee (and later contractor) 'H.' did to get themselves banned. Or fired. From the OP's own timeline, the ban came less than two months after they severed their relationship with 'H.' Google isn't swinging around the ban hammer years after the OP separated with 'H.'

The OP's games could still include code contributed by 'H.' And 'H.' is apparently untrustworthy. Is that a risk Google should be forced to take as the curator of the Google Play store? I don't think so.

Yes all large websites that provide financial incentives to run scams on them have this problem. Whenever there are $$$ to be made at scale the scammers will work very hard to get their cut.

The problem lies in the people who implement these anti-fraud measures forgetting that not every account their system flags is actually a scammer. The goal should always be to fuck over the scammer as hard as possible. However you must always make sure the real humans that get caught in the net can always get out of jail.

Assuming that the 1% of real humans that get flagged in your system don’t matter is how you piss people off. Always provide ways to get real people out of jail! Those people are honest people doing the right things. They are the ones you are trying to protect!

There’s a difference between banning an app and banning an account.

Are you suggesting that Google ban all current apps in their account? Google has no idea which apps 'H.' contributed to. Or whether 'H.' still has a relationship with Raya Games.

If 'H.' is a malicious developer, then all apps that were extant while 'H.' was associated with Raya should be considered suspect. Google (and its user base) have no idea what apps 'H.' touched. The very least Google should do is ban all apps uploaded and/or updated during 'H.'s employment.

And even then Google has no way to know whether 'H.' still works at the company, or will work again there in the future. Google doesn't (and can't reasonably) have any insight into personnel decisions at Raya Games.

Is Google throwing the baby out with the bathwater? Yeah, probably. But Google can't differentiate between baby and bathwater when it comes to malicious developers. Google has an affirmative responsibility to protect its userbase. It doesn't have an affirmative responsibility to let any individual publisher sell apps on the Google Play store.

That’s whole another sentence dude.

I get what you're saying, but if 'H.' did something bad, Google should be telling companies that hired him to check their source code for malware. They shouldn't be accusing his former employer of being a shell company for 'H.' to continue doing bad things.

Reply on news.ycombinator.com