Hacker News Reader

Comment by dmathrowaway | Hacker News Reader

Throwaway account for obvious reasons:

As a SRE SWE at Alphabet/Google, I find this assumed-guilt and assumed-lack-of-giving-a-shit irritating.

For the past several quarters we have spent a significant proportion of our effort on DMA compliance, right down to the infrastructure & RPC level. It is top priority mandate level stuff and getting absolute top billing from managers and TLs in planning and day-to-day activities.

I have spent a long time over the past few months working almost entirely on DMA projects so it is pretty aggravating to then see these "probes" into if we are taking it seriously.

Don't get me wrong, I think the DMA is a good thing and it is totally the right thing to do. But this assumption that Google don't care and are ignoring it or whatever is just exasperating when myself and many other good engineers are working their hearts out to implement it.

</rant>

View on HN

> I find this assumed-guilt and assumed-lack-of-giving-a-shit irritating.

Europe's probes works differently w.r.t. US. It's not "assumed guilt", it's "we want a clearer picture".

If you did everything alright, there's nothing to be afraid or be irritated of. You answer your questions and move on.

If you tried to work your way around, then, well...

If there wasn't a DMA, and no prospect of probe or accountability, google, and the likes, wouldn't give a shit. As we can see from the current state of affairs (that led to DMA and all that)

How many other good engineers at Google are working on anti-competitive practice by pushing Google as default browser, providing a worse service on non-Chromium based browsers (like slowing YouTube for Firefox), etc? [Microsoft Edge does worse]

How many other good engineers at Google are working on ethically dubious practices, like tracking users that are in explicit do-not-track mode through browser fingerprinting?

How many other good engineers at Google are working on <insert any other terrible practices>?

Maybe paying a few engineers to clean up their reputation is not enough? Maybe you just picked a bad role and are looking for the wrong culprits?

Do you have a source for any of these?

For the first point: https://news.ycombinator.com/item?id=38345858

For browser fingerprinting, there doesn't seem to be many sources. There is this post:

https://community.brave.com/t/new-version-youtube-fingerprin...

Yet this is very easy to reproduce, and there is no other way to explain the personalized video suggestions in private mode.

Even on a law and implementation effort like this with such large impact there are maybe 10,000 people in the world involved who actually understand it in any significant sense, and they all have a strong reason not to post about it on a public forum, or even a private one.

And even those people will only understand a limited aspect or perspective.

So the people commenting can only comment based on their outside impressions and emotions about generalities and how the specific implementation details seem to affect they as an end user.

I try to take anything said with that in mind. There is information in the comments about user experience but anything else is at the level of bullshitting at the bar with your friends, and not to be taken personally.

Ha! Just because you're only getting flack for this, I once upon a long ago worked on gdpr implementation and it was exactly the same thing.

Our entire team was working overtime and liaising with regulators to figure out what some of those pretty vague statements actually meant when it came down asking user permission for third party analytics and how to ensure we were compliant (what counts as essential, how many non-essential can you reasonably ask someone to review, who creates that list, what happens to the companies not in it, etc.etc.).

Nobody else knew either because they were all looking at us, as we'd be likely to get sued first anyway. Cue the articles after launch on how we either didn't care to do it right or we were actually being our usual evil selves in sneakily not implementing it in properly.

I feel your pain

Sorry for being cynical, but from your message it sounds like you were working hard with regulators to comply as little as possible not to get sued. Which makes sense - I mean it was probably just business - but doesn't mean you were not being "your evil selves" (whoever your were).

Maybe I'm underestimating the complexity at scale, but I've read GDPR in original (it's not long), and the intentions and what's required seem pretty clear. I only have practical experience with it from a regulator side, though.

Genuinely not, though I can understand that you're cynical. How do you prove intention anyway?

As context with these kind of regulations it's not always bad for the big players when it gets implemented across the market. Many smaller companies will not have the regulatory bandwidth to figure out compliance, and as the regulation acts as a way to level or cap what everyone can do, it's not like you will lose customers to someone else.

Complexity was mostly either definitional, e.g. some markets (ironically Germany's big publishers in particular) were absolutely convinced that almost anything they did on their sites fell under legitimate interest, even though we tried to convince them many times that would not fly.

Or it would be on specifics such as how many non-essential data providers can you reasonably ask a user to review? Keep the number too small and you'll be accused of favoring the big players, make it too big and you'll swamp users. Who decides?

By the way I agree that GDPR is pretty well written. Just that implementing these type of things and getting stakeholders to agree to it can be extremely complex. Fun days

> to then see these "probes" into if we are taking it seriously

The probe is to determine if the effort was effective not if you are taking it seriously. If your work was effective then nothing will happen, if it wasn't effective than the fine or lack thereof would be sized appropriately to how serious they believe you are taking it. That is just effective regulation in action.

From the press release:

> The Commission has opened proceedings against Alphabet, to determine whether Alphabet's display of Google search results may lead to self-preferencing in relation to Google's vertical search services (e.g., Google Shopping; Google Flights; Google Hotels) over similar rival services.

I will admit to not having used google search for ages because of these practices and other modifications making it worse and worse, so off I go to search for "hotels paris" the sort of search I might make when planning a trip to Paris and I want to avoid booking.com for similar reasons.

And the top is google maps followed by some excerpt of google lodging links redirecting through google. So yeah, seems like google lodging is being preferenced over booking (which I also don't want) and tripadvisor, hotels.com, expedia etc. all prioritised over organic results that I would actually want.

So google search certainly preferences google maps and google lodging, maybe that is a preference consistent with the DMA but I feel like maybe it shouldn't be. If you were involved in a project to depreference google maps or lodging in a way consistent with the DMA, then I feel like you were targeting a little too deep into the grey area or didn't have enough time. As others pointed out, this is just a probe to determine if compliance has been achieved or not. There is no assumption of guilt.

> I find this assumed-guilt and assumed-lack-of-giving-a-shit irritating

Web Environment Integrity.

Those three words burned up a lot of what little goodwill was left for google.

"past several quaters". The DMA entered force November 1. 2022.

There are multiple parts to it --

"The 2 May 2023, 6 months later, the regulation started applying and the potential gatekeepers had 2 months to report to the commission to be identified as gatekeepers. This process would take up to 45 days and after being identified as gatekeepers, they would have 6 months to come into compliance, at the latest the 6 March 2024.[8][32] From 7 March 2024, gatekeepers must comply with the DMA. [33]"

https://en.wikipedia.org/wiki/Digital_Markets_Act

Google can spend a lot of money on it, and still be non-compliant. How much time has been spent on it, or how seriously it's being taken, is not really indicative of anything relevant.

Google only cares about DMA compliance because they don't want to get in trouble. Otherwise you wouldn't be so busy with it right now, you'd already be compliant.

I have sympathy for you as a SWE, but I have no sympathy for megacorporations - they should never be trusted.

Looks like the EU are investigating Alphabet for "Alphabet's rules on steering in Google Play and self-preferencing on Google Search".

Is it possible Alphabet has complied with some parts, but not all?

This might not be pedantic. Maybe they're missing important details?

Shows how NON compliant Alphabet was before DMA ;)

"Make infra compliant, but try to pull some shit with billing, to see how serious the EC is about DMA. That way, if they're serious, we're ready, but if not, we can still make money."

Heh, a lot of comments here make it clear they don't understand working at a megacorp, but I can actually believe this one.

Google is one of the reasons why this law had to be created in order to protect the users from its systemic dark patterns. I'm glad they're spending significant effort on DMA compliance, it means the law is working.

> Don't get me wrong, I think the DMA is a good thing and it is totally the right thing to do.

This is the part that you and Google don't agree. If you look at your comment from that perspective, you can see why probe makes sense.

So are we all going to just trust your word? That ship has long sailed, the trust is not there anymore.

This is what tech companies deserve to get (not just Google) when they try to play the different laws and circumvent them.

It's possible that both are true at the same time: 1. Google doesn't really give a shit and will do the very least they think can get away with, 2. They have some people working on it out of the 27k engineers they have.

I'm not even sure how it's controversial, I assume you are biased and emotional as a Googler, but every company will do the very least possible to loosen their grip on the market.

I book flights with Google Flights. It’s way better than anywhere else. I’d be annoyed if it isn’t the #1 result when I do a search for flights.

I book flights with Google Flights and other options (Kayak, my credit card’s travel portal, airlines directly), and Google Flights is kind of mid. It’s annoying that Google pushes it to the #1 result for lots of searches that it shouldn’t be.

I guess it depends on what you look for. I haven't bought a flight in a while, but I just looked at kayak and google flights for comparison. Google flights is a much simpler, more direct UI, and it feels a lot more responsive. In particular, kayak violated one of my huge personal pet peeves: page content moving around while it's loading.

That said, the gap is a lot smaller than it used to be. There was a time in the past where google flights was light years ahead of priceline, kayak, etc. in bloat, bugginess, responsiveness, etc. That gap has shrank considerably and it's more a matter of preference today.

I don’t see what is better about google flights. Sometimes I get the cheapest price on the airline’s website and sometimes on Expedia. Google flights’ price is almost always the same as the airline website’s price.

Alphabet is under investigation for, among things:

> Whether Google preferences the firm's own goods and services in search results

Are you saying that Google doesn't preference it's own goods and services on the 'Google' platform ahead of it's other competitors on that platform?

I mean, if you did a good job, then this is no extra work for you. But there's very little reason to trust any of you right? Especially after stunts Apple is constantly pulling, everyone in EU leadership would have to be a brain dead moron to believe whatever US corps are telling them without any kind of verification.

If you pass with flying colors, that doesn't diminish any of your work - it confirms that you did it well.

You've very clearly never participated in an audit if you believe this. Audits are a ton of work, to prove in excruciating detail that things actually work the way you claim they do.

I have participated in such audits (and actually worked on things like GDPR compliance on rather large corporations). Yes, they're a ton of work. But that's what the job is, sorry if now developers need to work to undo anticompetitive crap they pulled in their products.

You're again assuming remediation work. Just the work required for an audit that you end up passing can take weeks.

Yes, I know. What of it? Comes with the size and money.

Just like when we were building medical stuff that came with it's own audits and how banking also does.

Cost of earning all that sweet cash.

You started off with

> I mean, if you did a good job, then this is no extra work for you.

And now we're at

> What of it? Comes with the size and money.

which is quite the difference. It no longer matters if you did a good job, suck it up and take the audit?

It also wholly misses what the root-comment Googler was complaining about. You may feel that Google as a whole "deserves" this somehow, but the engineer was saying it feels like a slap in the face to everyone who was working hard on DMA compliance.

> Why should trillion dollar companies get a pass? Because some engineer will feel bad about a probe that is a mile over their head?

No, but this is a remarkably unsympathetic take to someone who is venting. You're looking to Google-bash, and that's fine, I'm usually happy to join you in that, but look past the megacorp to the person who is pissed that their hard work and that of their team seems pointless.

I'm sure a trillion dollar company can manage to do that. Why should the EC trust these companies? My local government will go through any plan I make for modifications to my house. Why should trillion dollar companies get a pass? Because some engineer will feel bad about a probe that is a mile over their head?

And yet all the gatekeepers have publically taken action to actively try to undermine the DMA. Admittedly Google is nowhere near as bad as Apple, but it's still happening. So of course investigations have been launched

What's irritating is your pearl clutching. Google either turns the things it touches to shit or kills them. Guilt is assumed because it is fucking deserved. Seethe about it.

> I have spent a long time over the past few months working almost entirely on DMA projects so it is pretty aggravating to then see these "probes" into if we are taking it seriously.

Well just because you take it seriously does not mean you have done a good job in implementing the changes? I dont know about google but apple certainly flaunted the rules completely so its a good thing that they are not letting it go.

Except Google isn't complying.

Google charges 12-17% for "linking out" to a web purchase screen (aka "external offers").

> has opened proceedings to assess whether the measures implemented by Alphabet and Apple in relation to their obligations pertaining to app stores are in breach of the DMA. Article 5(4) of the DMA requires gatekeepers to allow app developers to “steer” consumers to offers outside the gatekeepers' app stores, free of charge

This reminds me of a conversation from Dune, between Count Fenring and the Baron:

"The Emperor does wish to audit your books," the Count said.

"Any time."

"You... ah... have no objections?"

"None. My CHOAM Company directorship will bear the closest scrutiny."

The point is if everything is in order (or made to look as if it's in order), then Google has nothing to fear, no matter how many probes the EU launches. And the Baron didn't take it personally, and neither should Google. It's all in the game, after all.

Thinking of your last paragraph it's rather interesting to see how, when corporations hurt people, a lot of people just say "it's business, they're making profit"... but when it comes to these laws, it gets strangely emotional instead of just saying "well, it's business".

You rant feels unnecessarily emotional and victim assuming.

"WAH! WAH! The EU doesn't apreciate the job at Google I signed up for and getting paid $400k+ to do."

If you don't like your job, quit and find something you'll find fulfilling because you're not gonna get any sympathy for you not getting public government appreciation for the very well paid job you singed up to do at a private company. Go out and get some perspective, there's people out there with real problems in their lives, breaking their backs and barely scraping by. Seriously, the entitlement of some well paid big-tech workers is astonishing.

The EU hasn't got any beef with you or your job. Nobody at EU said that Google engineers aren't working hard on DMA compliance.

It's Google's (management's) responsibility to prove to regulators that they're DMA complaint, not their employee's to go public under burner accounts to say this.

"Trust AND verify".

Blame your management for lack of (proactive) action and lack of communication to the authorities, not the EU for looking into your employer.

Reply on news.ycombinator.com