Comment by computer23 | Hacker News Reader

Comment by computer23 | Hacker News Reader

Parent Full thread

I have had a Google sheet I created years ago and edit periodically that has also been flagged but not removed. It has a number of URLs. I suppose it's possible at least one of the URLs is no longer legitimate.

There is a yellow banner "This file looks suspicious. It might be used to steal your personal information" and an option to "Request a review".

It also says "This file can still be viewed, edited, and shared, but users will see a warning that alerts them that the content may be harmful. These restrictions were put in place because this content violates Google Drive's Phishing policy."

There is no indication of why the file was flagged.

Despite my concerns about a human looking at my personal file, I bit the bullet and clicked review several times but the banner remains after several months. Google support hasn't been helpful even though I'm a paid user.

I have now received 5 emails from "Google Drive Safety" notifying me of this alleged violation.

screw this technocratic neofeudalist garbage. ive been encrypting my entire google drive for a while now for exactly this kind of overreach in the past.

https://dev.to/petarov/store-encrypted-files-in-google-drive...

More people need to be as angry as you are about this kind of shit. If people keep viewing these issues as one-offs, we'll soon find ourselves "owning nothing, and being miserable."

Life as a service or freedom as a service?

A monopoly on liberty. Hayek RPMs increasing...

It would likely be called a "new technological freedom" from hackers and scams etc. Like how the marxists like to call marxist monetary policy a "new economic freedom".

"Freedom from choice" as opposed to "freedom of choice." Words are so important.

This is a notification that your requested “being miserable” service will be billed to your government tokens account on a recurring basis at a rate of $23,465 per month.

Thank you for your purchase. Sincerely, your caring daddy, government.

The only people who are being miserable are the ones complaining about this shit. Rest of the world is happily leading their lives or have other real world problems that they have to deal with and not worry about some elite, upper-class problems

I can care about politicians trying to legislate me out of existence and about the privacy and integrity of my data at the same time. In fact, the two concerns are tightly interwoven.

I can also recommend Cryptomator (F/OSS) for this client-side encryption, which also supports other services than Google Drive.

https://cryptomator.org

How have I not heard of this? Doing a quick HN search I see it's been posted multiple times over the years, but with minimal uptake.

https://hn.algolia.com/?q=https%3A%2F%2Fcryptomator.org%2F

Perhaps the problem is that the privacy conscious have already deplatformed & do their own syncing to private cloud, whereas the others are still using the platform & don't care as much.

I'm in the first group, but have become increasingly weary of keeping servers online (I self host everything) & I'm see a lot of promising results in Crytomator... but there's one inevitable gotcha: those very platforms can cut you off at some point in the future. So, you'll need to multi sync across multiple platforms for redundancy.

That said, cryptomator looks good!

And at least on iOS it works nicely with the native file system

Oh wow, I didn't realize it worked seamlessly with file systems like this. Definitely considering this now.

It's only open-source on desktop.

rclone is good too, particularly for people using the command line, and supports client-side encryption.

https://rclone.org/

Yes. The issue is that security and privacy are tragedies of the commons. Individuals rarely have the time or skill to improve the situation, and it's almost never rational for individuals to do so — the benefit to them is probabilistic and low-probability, and the cost in hours of time is high.

But the benefit to society is great of doing better on security and privacy.

This is why governments should regulate security and privacy. The whole point of governments is to solve collective problems together.

How long until they flag your encrypted files because encrypted files are suspicious?

Just got a Synology 4-bay NAS (their SHR hybrid raid is pretty neat) to keep a full backup of everything I've ever put in cloud storage for this exact reason.

Plus side is plugging in hard drives whisked me back to building computers as a kid.

What synology model by chance?

I am using a synology ds418 (current model is ds420, probably releasing the DS422 soon) and it has been an absolute joy for the last four years, of all my technology devices, it requires the least care and feeding, it is the closest thing to a technolgical toaster I own. It backs up to aws glacier, but really nice having all my stuff on a 2 x 1gigabit interface here in the house.

There is a whole ecosystem of plugins and stuff, but out of the box it works fantastic.

420+ with 4 8TB IronWolf drives providing just under 24TB of usable space (with SHR-1 which is single drive failure). Way more than I'll ever need personally. Also desperately trying to pretend I didn't read the comment below about a 422+ (last 2 digits are the release year).

I turned my old desktop into a NAS drive with 3 8tb drives shucked from a discount bin at Best Buy a few years ago. Total cost (out the door) was about $400 for the drives and the time to set it all up, and it has way more storage and convenience than I think I can use in a long time.

Probably 920+!

GP's file is shared with others, so your proposal doesn't work.

Just share the password with others?

You mean "just" require everybody else to read that article and follow the setup instructions with shared keys _and_ set up a different sharing folder and shared key for each distinct set of people you share with.

If I were you I'd back the whole of your Google account up ASAP. It wouldn't be unheard of for Google to suspend your entire account for a violation on a single product.

Yikes

why assume that the review would be done by a human?

I'd wager the "reviewer" it's merely a more computationally expensive process

I suppose you're right that it doesn't explicitly say a human is doing the review.

It says:

Review process

If you think this is an error, or if you've modified the file to comply with Google Drive's Terms of Service, you can request a review.

1. Your file will be reviewed

This file will remain restricted during the review.

2. A decision will be made

If the file is found to be safe, all restrictions will be removed and you’ll be able to use and share it with others. If it's found to be unsafe, the restrictions will remain in place.

I find this kind of language positively disgusting:

> Your file will be reviewed

> A decision will be made

> If the file is found to be...

> ... restrictions will be removed ...

It is the archetypical "mistakes were made".

Note the constant use of passive voice, intended to hide the actor, and to keep you from even thinking about who is doing these things and thus who is responsible.

By the way, no better is the most likely alternative "Google will review...". I'll leave deducing the reasons why as an exercise for the reader.

Google has created the idea that "an algorithm is responsible" for something. This is never the case. An algorithm is programed by human beings, therefore the humans who created and approved the algorithm are responsible for its decisions. It is just a form of hiding their intent under the disguise of an algorithmic intelligence. I'm pretty sure that if something is bad for Google, it will not be approved despite what "the algorithm" thinks.

This is spoken by someone who is really clueless about AI and Machine Learning

Or someone who understands that it's not magic, and there's still humans choosing the dataset, labelling the data and picking the loss function. This is exactly the kind of gaslighting GP was talking about.

Just because there are more edge cases where the human has no idea what their algorithm does, doesn't absolve them of responsibility. You don't get to go free after running a bunch of pedestrians over by claiming you were too drunk to know where the road was or which direction your car would turn when you moved the wheel. If I put a running metal lathe in a kindergarten, I don't get to throw my hands up and say 'you clearly don't understand machining' when some children get dismembered.

How do you define 'expensive'?

Because if it's measured in watt hours, this computational process is almost certainly drastically cheaper than using humans to do the same work, especially if you account for 20+ years of unprofitable training time per compute unit and 76% weekly downtime even at peak productivity.

I think parent comment mean "a longer automated check than the one that flagged the content". I think he meant no human would make the call, but another routine.

Humans are involved at some point, if only while developing the software or writing up the spec. They ought to figure out how to do better.

but ultimately, the "executives" making the decisions of what software to develop, which bugs to hunt, and so on, are all basing their decisions on data, reports, and many sorts of 'metrics'.

Additionally, I suppose in a company as big as Google, all this decision making is backed by written communications.

All this written stuff is subject to legal scrutiny. All must abide by 'approved' rules, guidelines, etc..

Squinting a little bit (maybe some may need to squint harder) it's clear that in the end everything is being done according to a computational (written) process.

this is essentially what 'skynet' (from the terminator) or the matrix actually means. if every human involved is following data and written guidelines, the decisions are being made by a computer program running across many hundreds of humans pushing "paper" around.

Far more scary is that Google already has automated systems to classify content and probably very closely works with government to keep a close eye on citizen.

> It has a number of URLs. I suppose it's possible at least one of the URLs is no longer legitimate.

> "These restrictions were put in place because this content violates Google Drive's Phishing policy."

> There is no indication of why the file was flagged.

Isn't your answer in the warning (albeit lacking some specificity)? If you have a bunch of URLs in there and admit not knowing about their legitimacy, it seems reasonable that at least one of them matches a database of known phishing URLs. Isn't it also reasonable to expect (and in many cases want) a company hosting publicly-shared files to notify users when content matches some heuristics for unsafe content, especially given the prevalence of phishing attempts?

That said, there may still be a case to argue that the review process, heuristic, lack of transparency, and other implementation details are flawed. But I don't have a problem with them posting a warning message on content that looks suspicious.

Complete removal, on the other hand (as in the case of OP) is another story, especially given Google's laughable process (or lack thereof) for appealing such cases.

What, pray tell, is a “legitimate” url ?

What is wrong with a list of phishing urls ?

Sounds simultaneously useful and innocuous to me …

You're right - a URL is either a technically valid URL or it isn't, but in this context, we're clearly talking about links to phishing sites (or not).

As someone who operates a service that allows people to create and share lists of links on a public site, I can tell you from experience that it's not as innocuous as you might think. Scammers routinely use a trusted domain to host a link to their malicious final destination since the initial, trusted domain in often the one given the most scrutiny (e.g., from an email). It sounds silly to more technical users who understand how the web works, but unfortunately it's effective and super popular in phishing campaigns.

To your point, yes - a list of phishing URLs would be useful in a lot of cases, but it's difficult for automated tools to tell the difference between those legitimate use cases and the much more common cases used for phishing, so they err on the side of caution. As mentioned, the human review / appeal process surely has room for improvement.

Reply on news.ycombinator.com