Hacker News Reader

Hacker News

Comment by corentin88 | Hacker News Reader

Full thread

corentin88

I believe many comments here will criticize Google. But objectively, Google is at its best here:

- in terms of privacy, applications that have access to your Gmail inbox now require a security audit.

- the audit is not required for MVP (<100 users) or applications internal to a Google Workspace org.

Of course, you have to pay for the audit. But:

- it’s only required when you ask for restricted user data (i.e. reading my emails).

- Google doesn’t take 30% of your revenue to use its API - which is free by the way.

To me, Google has created the perfect world for developers here. And that says a lot when I read the developer of Pegasus Mail doesn’t want to record a 2min long YouTube screencast to get approved.

Also, just wanted to kudos the Google OAuth team that has greatly improved their process in the past years. If you follow the guidelines, you can get approved within a day now.

View on HN

My issue with this is that to access my own email I get countless warnings, and always have a 'You have recommended actions' Security Checkup for 'Remove risky access to your data'.

This is after jumping through a bunch of hoops to create a GCP app. It even complains about the pseudo-app being from an 'Unverified developer' despite that developer being me.

If you want to create a video, you’re one of the 17 developers in the world that does.

Your criticism was completely unnecessary. It doesn’t say anything about the Pegasus dev except that he’s normal.

You _have_ to create a video. That’s a requirement. You don’t event have to talk or show your face on it though. I agree many people doesn’t like to record videos, I’m one of them, but you are a developer and your app is going to be available to 1.5 billion users of Gmail. Complaining about having to record a video (which is what Pegasus dev did) is not _normal_.

> You _have_ to create a video. That’s a requirement.

How is that in any way related to your comment that he shouldn't complain about it? If it wasn't a requirement then there would be no reason to complain in the first place.

And that's not even what his main complaint, his main complaint is that he shouldn't have had to record the video in the first place because the warning about this feature costing money should have been documented somewhere together with all other requirements.

Basically Google is behaving like that website that tells you "your password should be more than 8 characters", change password submit, "your password should be less than 16 chararcters", change password submit, "should contain at least one upper character", change password submit, "should contain a special character", change password submit, "should not contain single quotes or other characters that are too special", repeat ad nauseam. If you have requirements document them up-front and all in one place.

> And that says a lot when I read the developer of Pegasus Mail doesn’t want to record a 2min long YouTube screencast to get approved.

Congrats on misreading the article. That's not the problem. The problem is having to spend a lot of money for a security audit for free software.

Is it my inbox or Google's inbox?

Is it your car or the government’s?

Google will be blamed if someone's data is misused even if that person authorized giving permissions to that app. If you want evidence supporting that, take a look at how much flak Facebook received with the Cambridge Analytica scandal.

If it's Gmail then it's Google's inbox, they're just letting you use it.

It is part of Google's tracking and advertising system. They let you use it as an inbox.

> the audit is not required for MVP (<100 users)

100 lifetime signups isn't anywhere near enough to know whether or not an app is commercially viable. If the cap were something like 10,000, or even 2,500, then there would be a lot less complaints.

Reply on news.ycombinator.com