News for hackers. Stuff that matters.
Re:Don’t Mess with The Google by kajecounterhack on Wednesday November 16, 2016 @11:56PM (#12974438)
Disclaimer: I don't speak for Google and don't have any real context into why this occurred. Speaking as myself, a private citizen.

I work in Spam & Abuse and it's possible that this is the result of some clustering algorithm that was trying to take down sharders / phone buying rings. It's very possible that the SWEs responsible didn't consider this possibility (that legitimate customers would be used to shard purchases) and I'm pretty sure if the affected customers appeal they'll be reinstated, maybe with a warning. I certainly wouldn't characterize this as intentionally punishing the individuals who purchased phones on Google's part -- notice that only users who directly sent their phones to the reseller's address were taken down. Smells like automation to me.

The "deleting all their data if the appeal doesn't go through" thing is actually because of privacy policy and Google can't keep your data around for longer than 90 days give or take after your account is suspended. Again it seems heavy-handed but is more a perfect storm of big-company policy decisions with good intentions overall. Know that if you ask Google to remove your account, you'll actually get everything wiped! (That's a good thing imho!)

It really is unfortunate that FPs (or "mostly-FP"s) in Google's systems impact people so badly. FWIW for most Google services if you abuse them you usually get a service level suspension rather than your entire account suspended, probably for this exact reason.

Re:Don’t Mess with The Google by ubernostrum on Thursday November 17, 2016 @12:28AM (#12974620)
It's very possible that the SWEs responsible didn't consider this possibility

"Very possible"? More like "guaranteed". Everybody who pays the slightest bit of attention knows Google has a gigantic blind spot when it comes to thinking through the consequences of algorithms and automation. And there's no sign that the company is interested in fixing that, ever.

Re:Don’t Mess with The Google by mistermann on Thursday November 17, 2016 @12:34AM (#12974652)
Wait until they get into the thought police business for some real interesting situations.

All jokes aside, for those who remember, it's pretty amazing what Microsoft got punished for (bundling a browser with the OS, with no other restrictions) compared to what Apple and Google get away with.

Re:Don’t Mess with The Google by cowl on Thursday November 17, 2016 @03:03AM (#12975385)
Bundling a browser with the OS that had 98% of all user share at the time. neither Apple not Google come anywhere close to that market domination with their iOS or Android systems. Also the case was much more broad that just the browser it was for software that runs on the OS. Antitrust is not just about what a company does but mainly about what other alternatives are out there. In Microsoft's case there were no other alternatives while today you can choose between several.

EDIT: One more thing that everyone seems to confuse is that antitrust cases should protect CONSUMER rights not PRODUCER rights. A case can be made that Google and Apple are hurting other companies by offering free services with their products but they ARE NOT HURTING CONSUMERS.

Re:Don’t Mess with The Google by kuschku on Thursday November 17, 2016 @03:55AM (#12975655)
Google only has about 85% marketshare in phones, 96% in Search, still problematic.

And Producer rights are affecting Consumer rights.

Without a free market, we're all worse off — the only justified monopoly is a governmental one.

Re:Don’t Mess with The Google by cowl on Thursday November 17, 2016 @05:19AM (#12976111)
Key word here is "phones". 85% of phones is still less than half of all users seeing as mobile just surpassed desktop use sometime in 2015. And no, producer rights are not affecting consumer rights since this is a free market. I don't care how many Russian search engines or vertical product marketeers go out of business. They are going out of business because they are not offering a good enough service and I don't want google or any other search engine to channel my experience in not good enough channels just to keep their business afloat. that is not free market. When I and a plenty like me like a service we keep using it no matter if Google promotes it or not. If google had the power you are fear-mongering about we would not have FB, Twitter, Instagram, etc.
Re:Don’t Mess with The Google by kuschku on Thursday November 17, 2016 @06:01AM (#12976318)
> If google had the power you are fear-mongering about we would not have FB, Twitter, Instagram, etc.

All of them were started before Google even started competing with them.

Show me a company started after Google had already established a presence in a market that’s either competing with Google (and having a positive prediction) or that has thrown Google out of the market at all.

Re:Don’t Mess with The Google by cowl on Thursday November 17, 2016 @06:51AM (#12976587)
it doesn't matter is they are established before or after. all it matters is that users have the choice and choosing these (and other) products over the Google provided ones. Google has bundled a form of messenger app since forever with its services. People just keep choosing other better ones. Google has tried 2-3 time to break into the social scene but even though Google Buzz was bundled with gmail it was not used. although everyone with the gmail account had a G+ account it is not even close to FB or Twitter. The simple fact of bundling is not a problem when there are choices. Amazon even takes Android, takes out EVERY SINGLE REFERENCE to google services and uses it for it's own products. So android can not be considered in any form monopolistic because it offers choices does not block them.
Re:Don’t Mess with The Google by kuschku on Thursday November 17, 2016 @06:56AM (#12976618)
> it doesn't matter is they are established before or after.

Yes, it does, that’s the entire point.

Will we still see as much innovation in 10, 20 years? For that, this part is very important.

> The simple fact of bundling is not a problem when there are choices.

Google forbids OEMs from selling custom Android forks. That’s not choice.

As said, both the EU and US consider this anticompetitive, and are investigating it. If you believe you – which apparantly are unable to use correct orthography – are more knowledged than the top lawyers of the two largest economies, then, sure, go on.

Even Google has admitted they are doing anticompetitive bundling, their defense is that it’s required to fund Android at all. That alone should say everything.

Re:Don’t Mess with The Google by cowl on Thursday November 17, 2016 @08:15AM (#12977131)
Google forbids OEMs from un-bundling it-s other services not android. OEMs have the choice to build an Android with no Google service whatsoever like Amazon or some Chinese OEMs are doing. What they can not do is offer an Android while picking what google app they offer. Google apps are take it all or leave it for OEMs. for users they can choose to install what they like. I do not believe that I am more knowledged that Lawers but seeing already in plenty other examples that EU is more worried about businesses than consumers I can say that these is just another misuse of the antitrust rules.
Re:Don’t Mess with The Google by Whitestrake on Thursday November 17, 2016 @09:09AM (#12977535)
Wouldn't it be more accurate to say that Google does not license the Google Play Services to be bundled by OEMs who sell custom Android forks?
Re:Don’t Mess with The Google by kuschku on Thursday November 17, 2016 @09:22AM (#12977636)
Not really, because Google also retroactively removes the license for devices already in production if the OEM later on decides to sell forked devices, as was threatened with Acer.

Or even just delivers parts for such a device, as was threatened with SAMSUNG and Amazon.

Re:Don’t Mess with The Google by bad_user on Thursday November 17, 2016 @03:28AM (#12975532)
I really don't want to defend Microsoft, but Internet Explorer won all that market share because back in the day IExplorer really was the best browser available. And given what happened next, I'm actually grateful for the IExplorer monopoly, because Firefox wouldn't have happened otherwise.

We tend to forget that even natural monopolies can be broken by new technology and innovation. And even big companies can be beaten by smaller ones. Microsoft tried to beat Google at search while Google was smaller and much less powerful than it is today. They couldn't, because big companies have a priority to protect their cash cows and don't necessarily have the talent or the focus required to tackle new markets (i.e. the innovator's dilemma). Google tried to beat Facebook at social. They also failed by being too conservative, while at the same time fucking their users. Can you spot a pattern?

Re:Don’t Mess with The Google by simonh on Thursday November 17, 2016 @04:37AM (#12975901)
I accept Microsoft followed many predatory and anti-competitive practices. They were a nightmare and deserved a good anti-trust kicking.

But hammering them for bundling a browser was just plain stupid. If they didn't bundle a browser, how would people download a competing browser? You'd have had to get hold of a browser on CD somewhere and install it manually just to use the internet. How would that have been an improvement for consumers? It was a misconceived, user-hostile decision.

Re:Don’t Mess with The Google by yuubi on Thursday November 17, 2016 @09:05AM (#12977505)

    ftp ftp.netscape.com
Re:Don’t Mess with The Google by simonh on Thursday November 17, 2016 @12:03PM (#12979184)
You've convinced me. Ordinary consumers should be expected to know how to use command line tools and have memorized service addresses, without having browser access to look any of it up. That's clearly the answer to improve usability and expand consumer access in this situation. How could I not have seen it sooner.
Re:Don’t Mess with The Google by robotresearcher on Thursday November 17, 2016 @01:08PM (#12979811)
Life before bundled browsers and Google:

"Sue, how do I get that browser thingie?"

"Erm, Jane wrote it down for me... here's the Post-It"

"Thanks."

We survived OK.

Re:Don’t Mess with The Google by efreak on Thursday November 17, 2016 @12:22PM (#12979370)
Windows explorer supports ftp. Type ftp://ftp.mozilla.org into your run menu or explorer address bar and you'll get a folder view pop-up. From there it should be rather trivial to find Firefox from inside their ftp directory (not as simple as clicking a download button, but still). I'm not sure if getfirefox.com runs an ftp server.

I'm not aware of any popular OS that doesn't have ftp support on the main UI (except Android, which doesn't have a file management app anyways; not sure about iOS). Nautilus has ftp support. So does thunar, dolphin, konq, etc. You can type ftp addresses into the address bar in osx, iirc.

Re:Don’t Mess with The Google by i336_ on Thursday November 17, 2016 @03:47PM (#12981381)
I recall a couple occasions:

- Didn't want to open a browser one day but wanted to download the latest version of FF. Thought I'd try FTP. Ultimately gave up on trying to find the right path and Googled it.

Another time (later), I vaguely recall being at a kiosk with IE disabled in various boring ways, and I tried to see if I could download FF (just to see if it was possible) after successfully managing to open the FTP site. I might be misremembering, but I think the only reason I was able to locate the dir properly was because I'd previously made a careful mental note where it was. (It downloaded, but executables were disabled. Those sysadmins did a good job.)

Re:Don’t Mess with The Google by Spoom on Thursday November 17, 2016 @07:43PM (#12983299)
True story: Back when I was doing desktop tech support, downloading Ad Aware via command line FTP was a favored method of mine when the user's browser was so fucked by spyware that it was inoperative.
Re:Don’t Mess with The Google by yuubi on Thursday November 17, 2016 @05:57PM (#12982554)
At the time, before browsers were standard equipment, ftp was a normal way to obtain software. There were gui ftp clients available at the time, but I have no idea how people usually got those (whether dialup bbs, downloading with the bundled default ftp utility, passed on a disk by a friend, or bought on a disk).
Re:Don’t Mess with The Google by 7Z7 on Thursday November 17, 2016 @08:55AM (#12977423)
By bundling competing browsers
Re:Don’t Mess with The Google by holri on Thursday November 17, 2016 @12:41AM (#12974676)
Wait if they get into the automated car driving business for some real sad situations.
Re:Don’t Mess with The Google by simonh on Thursday November 17, 2016 @04:48AM (#12975975)
Due to suspension of your Google account this GoogleCab service is no longer available to you. Please be careful exiting the cab on this narrow strip of interstate hard shoulder 50 miles from anywhere. We have also disabled google authentication access to your phone. Have a nice day.
Re:Don’t Mess with The Google by Asooka on Thursday November 17, 2016 @04:05AM (#12975711)
> please drive me to the hospital, I broke my arm

> I can't do that, the hospital is within 50 miles of a school and you're banned from being within 50 miles of a school, because you commented "she's very pretty" to a picture of your 5-year-old niece and we've decided you're a paedophile.

Re:Don’t Mess with The Google by foxX on Thursday November 17, 2016 @05:03AM (#12976055)
Try this one http://craphound.com/scroogled.html by Doctorow.
Re:Don’t Mess with The Google by i336_ on Thursday November 17, 2016 @06:45AM (#12976542)
Wow, the HTML for that page fell through a bit of a can opener there.

Also, I must frankly admit my great curiosity at the fact that your last comment was posted 3.61 years ago. Alt account? Deleted comments?

Re:Don’t Mess with The Google by ocdtrekkie on Thursday November 17, 2016 @01:27AM (#12974902)
It's amazing what owning the FTC can do. Obama appointee Joshua Wright was a paid Google shill... and Trump just picked him up for the FTC transition team. Google's ability to infect our justice system transcends partisan politics.
Re:Don’t Mess with The Google by tdkl on Thursday November 17, 2016 @04:27AM (#12975846)
But AI is the future and our AI is the only which is true, embrace it! /s
Re:Don’t Mess with The Google by i336_ on Thursday November 17, 2016 @06:39AM (#12976505)
Hopefully you haven't given up on reading the comments to your post and you see this. Small practical suggestion, no flames.

It might be a very very good idea to lobby to get company policy instated that says "if the system thinks a user has gone rogue/bad, their account gets locked and all, but the data gets kept around until the user says to kill it, or for 6 months."

Because if Google thinks the account has gone bad, that's not the user saying "delete me," so the privacy policy (and associated laws) don't apply! There's nothing stopping you even stashing the data away indefinitely until the user explicitly asks for it to be killed (but that's scary).

At the end of the day though, algorithms fail, and IMO this is a practical edge-case policy glitch in the business architecture that should have been countered for.

Or does "user account gone rogue" have to be interpreted as "delete me" for crazy obscure Reasons™?

Re:Don’t Mess with The Google by throwaway98237 on Thursday November 17, 2016 @12:55AM (#12974752)
If you watch an old tech talk re: Google disaster recovery topic, the Googler explains that a user's info is never fully deleted because it's too expensive to do so given back-up duplication is processed multiple times in multiple locations and sometimes over multiple technologies. In other words, cancel your google account today and your data may be "deleted" but it's really, as in actually really, still on magnetic back-up in several locations, but it's just really hard to get to and put back together, so is considered "gone". Unless you're a really big organization with the means to go to such troubles, like maybe the government or Google.
Re:Don’t Mess with The Google by josephg on Thursday November 17, 2016 @04:58AM (#12976021)
It would be easy to setup a backup system where all backups are encrypted with a set of randomly generated keys. (1 key for each user/service pair or something). The keys are going to be (relatively) tiny, so they could be kept on non-archival storage.

If a user's data needs to be deleted for whatever reason, simply discard the user's corresponding encryption keys. That way you can effectively wipe the user's archive without needing to touch the tapes themselves.

Re:Don’t Mess with The Google by majewsky on Thursday November 17, 2016 @02:31AM (#12975206)
How is that compatible with legal requirements for deletion? I think that, at least in Germany, you can demand that a company delete all data associated with you, and the company has to comply with it.

(Whether German data protection law applies in Google's datacenters is a wholy different story though.)

Re:Don’t Mess with The Google by easychris on Thursday November 17, 2016 @05:13AM (#12976092)
It's not required in Germany either. The data protection law allows to "lock" data instead of really deleting it from all devices. And IMO that's the only sane solution to deletion requests.

Otherwise, any kind of backups would be unlawful for a company.

Re:Don’t Mess with The Google by toennisforst on Thursday November 17, 2016 @02:52AM (#12975319)
Though this requirement is moot even in Germany, as it is impossible for you to verify such a deletion.
Re:Don’t Mess with The Google by mikejb on Thursday November 17, 2016 @03:18AM (#12975473)
Can you point me to that tech talk? I think this info is outdated, at least it conflicts with what I believe to know.
Re:Don’t Mess with The Google by jfindley on Thursday November 17, 2016 @04:50AM (#12975990)
I agree, AIUI this is no longer the case.
Re:Don’t Mess with The Google by kajecounterhack on Thursday November 17, 2016 @02:56PM (#12980863)
<Blah blah disclaimer IANAL & speak for myself>

I think this may have changed since that talk. I think Google still doesn't technically guarantee full deletion (who knows if someone's GC process messed up or has a bug) but in practice it happens, at least AFAIK. It is expensive. And it does take time, I wouldn't expect all my stuff to be purged until at least 180 days (the 90 days they are supposed to delete after + ~90d for the delete to fully propogate).

It also drives every engineer nuts when they're asked is your service wipeout compliant and they realize omg I can't store this data longer than x days?! shit shit shit

European Privacy Shield compliance is yet another bag of legal worms every service has to deal with. More deleting, encryption at rest, etc.

Re:Don’t Mess with The Google by i336_ on Thursday November 17, 2016 @03:38PM (#12981286)
Huh. I now get the focus on pure-HDD storage as opposed to using tapes.
Re:Don’t Mess with The Google by bluecmd on Thursday November 17, 2016 @02:23AM (#12975162)
Things change
Re:Don’t Mess with The Google by wstrange on Thursday November 17, 2016 @03:21PM (#12981105)
From watching a tech talk a few years ago by Googler on backup, my understanding is that they just delete the encryption key (I believe everyone's data is encrypted with a per user key).

Your data may still live out on some server - but it is effectively unrecoverable.

Re:Don’t Mess with The Google by stegro32 on Thursday November 17, 2016 @10:29AM (#12978245)
I also remember that talk. I haven't verified by watching again, but if anyone's interested I suspect this is the one: https://youtu.be/eNliOm9NtCM
Re:Don’t Mess with The Google by ocdtrekkie on Thursday November 17, 2016 @01:20PM (#12979924)
I recommend the takeaways you get from this thread (especially as someone in Spam & Abuse) to communicate with those you work with and your superiors at El Goog.

- Automation is going to be the end of your job. Not because your job will be replaced by an algorithm, but because overuse of algorithms is leading to the collapse of trust people place in Google. Major actions like the banning of someone's Google account should never be done by algorithms. If you can't afford the humans[0], you shouldn't be in the business of holding people's valuable data.

- The support and appeals process must be human. Ever tried Microsoft's Answer Desk? Talking to humans isn't difficult even with one of your largest scale competitors, even for free tier products. Humans want to talk to humans, and Google's customer base consists of humans. FastMail ticket support? Incredible. It feels like Google isn't even trying to treat customers well in comparison.

- Google shafted 200 of their customers, and from the looks of it, this thread has another 200 ready to leave. The Guardian just picked up the story, so expect this effect to continue. One bad behavior by automation can cost you multiples of damage, especially if someone writes a blog post about the incident.

[0]Google can definitely afford the humans, especially with that princely sum they have stashed in offshore accounts.

Re:Don’t Mess with The Google by rebootthesystem on Thursday November 17, 2016 @02:58AM (#12975355)
You are kidding, right?

Human decency dictates that, at the very least, someone be warned that their account is now headed for non-negotiable suspension and be given 30 days to clear out their stuff and move on.

I couldn't care less what algorithm decided what. At some point a person coded-in the rules and, for some incomprehensible reason, this person or people decided it would be perfectly fine to take the path of most damage to consumers.

Your company, Facebook, Amazon and others deserve to get hit with a massive class action lawsuit that results in equally massive financial penalties and requires corrective actions. Maybe then you'll learn how to behave like human beings.

Re:Don’t Mess with The Google by eloisant on Thursday November 17, 2016 @03:54AM (#12975650)
I can confirm that I heard many stories of Android developers getting their Google Play dev account suspend for various reasons (which is already really bad in itself, if you have a popular app that makes a significant part of your revenue), but I rarely heard about full Google account suspension for a Play Store violation (maybe once or twice among dozens of Play Store suspensions stories).

I'm still puzzled that they take such a drastic measure automatically, without having one human checking whether the account is actually a real person's account.

I really want to see what comes out of this, if everyone gets his account reinstated and how long they had it suspended.

Re:Don’t Mess with The Google by bujak on Thursday November 17, 2016 @09:54AM (#12977903)
Yeah my account was wiped without warning after what I suspect was an automatic app review that Google introduced in Play Store at that time. It was just a niche hobby app but damn, it's not like I was a free user. I paid for the dev account. Good thing I had a separate google account for that.

I had some sloppy ndk computer vision running there, maybe it triggered something? I have no idea really. It's not like you can appeal anywhere. I was very busy with other things and let it slide at the time. I got away with a very cheap lesson I guess

Re:Don’t Mess with The Google by forgottenpass on Thursday November 17, 2016 @09:02AM (#12977477)
is more a perfect storm of big-company policy decisions

Naming storms like this is about rare they are. A "10 year storm" or "100 year storm" only happen once in that period. So they refer to a 10% or 1% chance that an X-year storm that would happen in any given year.

Is this cock-up is so bad that you don't expect a Google company to make a similar or more severe cock-up for DECADES? Then it's not a perfect storm. This was a common storm. In fact, I'm very doubtful it was as a "storm" inside of google at all. This is just another "whoopsie" bug fix, isn't it?

This right here is why people get the impression google thinks it's farts don't stink. Not only that you act as if this is a "perfect storm" but the arrogance it takes to design a system where just because an engineer didn't consider a use case, you're perfectly happy to assume it must be abuse.

Yes, this case will probably be fixed, but would it have been if it didn't pop up on the right back channels to get Googlers attention?

Re:Don’t Mess with The Google by brlewis on Thursday November 17, 2016 @12:14AM (#12974548)
Retention should be longer if an account is suspended on Google's initiative than on the user's initiative.
Re:Don’t Mess with The Google by lifthrasiir on Thursday November 17, 2016 @12:02AM (#12974486)
I believe automating a whole account suspension is not a good idea at all.
Re:Don’t Mess with The Google by calcifer on Thursday November 17, 2016 @02:21AM (#12975156)
What does "FP" stand for?
Re:Don’t Mess with The Google by spotirca on Thursday November 17, 2016 @03:15AM (#12975451)
False Positive
Re:Don’t Mess with The Google by kutkloon7 on Thursday November 17, 2016 @01:31AM (#12974920)
Yay for algorithms without any human supervision! In googles defense, you can't really expect them to spend such a small company to pay a human when the task is so trivially automated and handled so well.
Re:Don’t Mess with The Google by Pigo on Thursday November 17, 2016 @11:10AM (#12978652)
Honestly, I feel like if you start trying to game the system with some shady practices, you should be ready for eventualities like this. That's almost as careless as putting your real info up on an .onion site, and almost exactly like torrenting without any kind of proxy. I hope they get off with a warning, but these people were up to some shenanigans.
Re:Don’t Mess with The Google by BorisMelnik on Thursday November 17, 2016 @12:01AM (#12974478)
thanks for clarifying, I thought the same thing right away as well: smells exactly like automation. I could never see Google suspending an entire account for one person selling one phone.