News for hackers. Stuff that matters.
Re:Am I logged in or not? GDPR case study on the example of ... by rifung on Monday September 24, 2018 @06:47PM (#18062145)
I work at Google; opinions are my own.

> I don't understand why the Chrome team is picking this hill to die on- their team (managers and developers) are all over twitter and reddit trying to explain the privacy violations away as if the people upset about this are just not understanding what's going on.

My impression is that this is the new norm at Google. It happens with everything, internal or external. The sad reality is that most decisions will deeply upset at least some people, and those people likely don't have the context into the decisions but still complain loudly.

From my perspective what happens is that it doesn't matter whether a decision was a good or bad one, there will be people who complain (ESPECIALLY internally as Googlers can be very entitled) and so at some point you're just completely immune to this.

This is not helped by the fact that people externally often think Google is on some evil plan and speculate in wild ways which are completely wrong.

To give you an idea of how these things usually happen.. it goes something like this..

Someone finds a UX problem, and makes a plan to fix it. In this case I guess it's confusion among signed on accounts. Someone on the team probably raises some concerns, likely similar if not the exact ones being raised now, and they debate it but eventually they say well, the proportion of people who seem to care about this is only 0.1% of users (Because we are objective!).

Sadly, even though it's "only" 0.1% of users, those users are extremely negatively impacted in a way that's not really reflected by the small percentage, and 0.1% of a billion is still a considerable amount.

On the other hand, there are many other decisions which were released just fine and we would not be able to do anything if we were always afraid of negatively impacting some small proportion of users. To me this is a weakness of the attempt to have everything be objective and "measurable".

Let me state that I don't think this is good or even acceptable, but I'm definitely not smart enough to know how to solve this on a wider scale than my immediate team. However I hope this at least provides some insight into why these kinds of thing happen.

Re:Am I logged in or not? GDPR case study on the example of ... by kevingadd on Monday September 24, 2018 @07:28PM (#18062369)
'0.1% of a billion is still a considerable amount' is a very important observation, and one my colleagues at Google (before I left) rarely seemed to grasp. People think they can get away with a lot of cutting corners or lack of rigor in their engineering and design when mistakes can impact millions of people... our industry really isn't prepared for deploying products at this scale.
Re:Am I logged in or not? GDPR case study on the example of ... by RobertRoberts on Monday September 24, 2018 @10:58PM (#18063242)
>...people externally often think Google is on some evil plan...

The real bad guys don't ever think they are evil. (consider Al Capone, hero of the people)

Re:Am I logged in or not? GDPR case study on the example of ... by Nitramp on Tuesday September 25, 2018 @05:51AM (#18064846)
> >...people externally often think Google is on some evil plan...

> The real bad guys don't ever think they are evil.

At least seen from the inside, it's often funny (and sad) to see all kinds of crazy speculation about the greater evil goal of nefarious decisions made, all the while whatever is happening is usually a mixture of software bugs and incompetence on our side.

It's like a clown show, where the evil mastermind turns out to just be me incorrectly checking for a null value in some if condition, or my PM having no idea how to rationalize two features together.

I guess that comes with large corporation status, and a certain failure to communicate. Not sure if it's avoidable at all. It does teach you something about perception vs intent, I guess.

Re:Am I logged in or not? GDPR case study on the example of ... by pvorb on Tuesday September 25, 2018 @12:10AM (#18063523)
Yes. Acting evil is what makes you evil.
Re:Am I logged in or not? GDPR case study on the example of ... by kbenson on Tuesday September 25, 2018 @12:33AM (#18063625)
Then again, maybe we shouldn't be throwing around words like "evil", which we all know is hyperbole (even if invited hyperbole because of Google's own prior statements). Someone talks about Google being evil, and then other people push back because it's not really "evil", and they are both right, so neither ever gives an inch.

Sure, there's less impact when statements are less hyperbolic, but there's also less bikeshedding about the problem, so maybe something actually happens in the end.

Re:Am I logged in or not? GDPR case study on the example of ... by toxik on Tuesday September 25, 2018 @01:34AM (#18063848)
You said it yourself, Google’s raison d’etre in some ways into these markets was that they were not evil anticompetetive Microsoft. Today, they very much are. Arguably they were always this way, but dark patterns like this is a new low.

And no you don’t need to be North Korea to be evil. That is a meaningless comparison. Coincidentally Google has started working with regimes similar to NK; The PRC. Is that not evil?

Re:Am I logged in or not? GDPR case study on the example of ... by kbenson on Tuesday September 25, 2018 @01:58AM (#18063951)
> Coincidentally Google has started working with regimes similar to NK; The PRC. Is that not evil?

No, it's not, because evil is a negative ideal, but I don't think it actually exists in reality.

Even Hitler wasn't evil, he was insane, and the whole situation is a case study of what happens when people, regular people, are given an easy explanation for all their problems. Placing something in the category of "evil" is placing it apart from behavior that you expect normal people to be capable of, since I think most people thing the majority aren't evil. All that does is help us feel better at the expense of helping us be better.

Evil is for fairy tales, where things are black and white. Normal people rightly get defensive when called such, because the road to hell actually is paved with good intentions. Hyperbole isn't a useful way to communicate.

Sorry to go full Godwins on this, but if you can't pull out Hitler and Nazi's when talking about evil (even to counter the point), then when can you...

Re:Am I logged in or not? GDPR case study on the example of ... by Twisell on Tuesday September 25, 2018 @03:54AM (#18064383)
You just implied that Hitler was insane, a slang and disrespectful word for mentally ill people.

I can’t even start to consider that it’s an appropriate analogy so Godwin point is dully granted.

PS: If it please your mind regexp replace "evil" by "ill intentioned" in Google related threads. But don’t forget that it’s Google that originated this terminology in the first place with their moto "Don’t be evil"...

Re:Am I logged in or not? GDPR case study on the example of ... by eksemplar on Tuesday September 25, 2018 @01:23AM (#18063806)
Evil sort of loses it’s meaning when it’s thrown a google in a world where Pennsylvania just banned books that aren’t sold through their systems from prisons, where ICE kills children in concentration camps, and that’s talking domestic issues only.

I mean, if google is evil then what do you call North Korea? Super duper evil?

Re:Am I logged in or not? GDPR case study on the example of ... by pvorb on Tuesday September 25, 2018 @02:42AM (#18064125)
I was just referring to Google's own phrase: "Don't be evil."

Google is evil in the same way now, that Microsoft was back in the day.

Re:Am I logged in or not? GDPR case study on the example of ... by hulahoof on Tuesday September 25, 2018 @03:30AM (#18064281)
Tellingly, it was changed to "Do the right thing." after the alphabet split.
Re:Am I logged in or not? GDPR case study on the example of ... by reilly3000 on Tuesday September 25, 2018 @01:51AM (#18063916)
I'm glad you're here talking. This is hard to navigate as an employee. A company as large as Google must make it nearly impossible to anticipate every downstream effect it may have on seemingly unrelated areas of the business.

As an example in this case, I am an IT decision maker for a small group of people, I'm not that active on social media as a contributor, and losing an Apps subscription because of a browser auth decision could be one of those impacts. Its likely not, but if it were it would be impossible to understand in the aggregate, and of infinitesimal impact.

Be that as it may, user PII is now on the liability side of the ledger, and some businesses just haven't adapted to start operating like that is reality. Beyond financial hazard, the moral harm of a leak, the risk of telling the secrets of millions to the world (or a dangerous few) should be of grave concern. The best way to be trustworthy is to not know the secrets in the first place.

Bulk data collection doesn't affect 0.1% of users, that is the only group of people that understand enough to be concerned about. It affects everybody who signed up as a user. Their secrets and their safety are now in your hands.

This IS an engineering problem. I have full faith that with the right will, Google could figure out a way to offer web scale services to all manner of users and still deliver on its ambitions to deliver intelligent experiences with provable privacy at the heart of it. It probably involves data living at the edge; it probably involves renting datums from customers; it definitely involves a radical shift in business models.

Engineering a solution to a privacy-at-scale repository of human knowledge cannot happen without leadership that truly sees privacy as profit, at every level of the company.

Re:Am I logged in or not? GDPR case study on the example of ... by CaptainZapp on Tuesday September 25, 2018 @01:42AM (#18063881)
I think that any decision, which impacts user privacy in any way, shape or form should be especially carefully vetted.

Unfortunately, and with a long list of "accidental" blunders Google is long beyond the point of deniable plausability.

Re:Am I logged in or not? GDPR case study on the example of ... by bad_user on Tuesday September 25, 2018 @12:50AM (#18063685)
I’m very sympathetic to your situation, delivering software that’s this popular can’t be easy however in this case it’s really not that hard ...

When I’m doubt, Google should err on the side of privacy.

That’s the safe way to go. And in this case you can clearly see that some people will freak out if their browser syncs their history to the wrong identity or that it syncs at all.

Re:Am I logged in or not? GDPR case study on the example of ... by wickedwiesel on Tuesday September 25, 2018 @04:43AM (#18064558)
As you probably know, Google does have quite clear policies on the matter.[0]

You and your colleagues could raise that these are there for a reason, approved by senior management, and there to help you respect your users' rights.

I like the sound of "Applications that affect or change your user experience should make clear they are the reason for those changes." or "It should be clear to you when you are installing or enabling software on your computer and you should have the ability to say no." or "We believe you should be asked explicitly for your permission in a manner that is obvious and clearly states what information will be collected or transmitted."

All of these sound relevant to the grievance of the OP.

[0]: https://www.google.com/intl/en/about/software-principles.htm...

Re:Am I logged in or not? GDPR case study on the example of ... by tumetab1 on Tuesday September 25, 2018 @06:04AM (#18064902)
Thanks for that insight, it makes sense.

Big corporations usually pick some good rule of thumb (use data based decisions) and pervert it until it's a blind rule.

Now I can see some understand some of Google bad decisions, sentiment and grudges aren't easy to measure. I can find some aspect of a google product annoying but not bother me much. Still, annoying thinks add up and most users, like 99,9% users don't write complains publicly so they can't never tell. It's also harder to account for network effects like the family geek stop caring about chrome and moved the whole family and friends to firefox.

An estimated negative impact in 0,1% can really mean last push for 1% of users. Add several episodes like this and you can destroy a company.

Re:Am I logged in or not? GDPR case study on the example of ... by quickben on Monday September 24, 2018 @07:37PM (#18062413)
Use checkboxes?
Re:Am I logged in or not? GDPR case study on the example of ... by Tracist on Monday September 24, 2018 @07:59PM (#18062518)
When you have a checkbox for every possible customisation option, you end up with a commercial airliner cockpit - hundreds of flashing lights and switches, that you need a comprehensive manual and years of experience to properly operate.
Re:Am I logged in or not? GDPR case study on the example of ... by screaminghawk on Monday September 24, 2018 @08:32PM (#18062653)
Or you end up with `about:config`. Doesn't solve the impossible to comprehend everything problem, but it still gives people to option.
Re:Am I logged in or not? GDPR case study on the example of ... by pilif on Tuesday September 25, 2018 @12:06AM (#18063502)
And then you end up with people complaining about bloat because the browser contains code for every possible state of all these settings.
Re:Am I logged in or not? GDPR case study on the example of ... by snaky on Tuesday September 25, 2018 @12:17AM (#18063558)
It's clearly not the case when the checkbox you adding is an option to turn off some feature enabled by default.

No, not the feature all other components do need so much you have to work around by adding another zillion lines of code in other places of your program to deal with the case it turned off.

Re:Am I logged in or not? GDPR case study on the example of ... by reitanqild on Monday September 24, 2018 @11:16PM (#18063318)
Spoken like a true modern ux designer ;-)

I won't say you cannot make toys but I'd be happy if ux designers everywhere could take a break and stop dumbing down working applications, thanks.

PS: they don't need to be flashing.

Re:Am I logged in or not? GDPR case study on the example of ... by TeMPOraL on Tuesday September 25, 2018 @12:57AM (#18063713)
> PS: they don't need to be flashing.

In fact, in modern aircraft, they're not flashing. The trend today is to not light a light unless it's important to pay attention to it. It's called "dark cockpit".

Re:Am I logged in or not? GDPR case study on the example of ... by snaky on Monday September 24, 2018 @10:37PM (#18063144)
Windows have a registry, Firefox - about:config, Linux - kconfig and sysfs. You don't need to make it Boeing way, but you need it.
Re:Am I logged in or not? GDPR case study on the example of ... by edoceo on Monday September 24, 2018 @11:39PM (#18063395)
Airplane control are complex and require training for many valid reasons. The cluster is actually a great study in UX design.

Also, it's Boeing or I'm not going.

Re:Am I logged in or not? GDPR case study on the example of ... by snaky on Tuesday September 25, 2018 @12:06AM (#18063501)
> The cluster is actually a great study in UX design.

Agreed. But it's UX design for power users clearly.

But I was talking about the way to combine 'a regular users UX' with a ton of options you need for power users. The vast majority of the people who have Ubuntu on their laptops never recompile the kernel or even know about sysfs, the vast majority of the Windows and Office users never touch the registry editor - but removing them would be a huge mistake.

Re:Am I logged in or not? GDPR case study on the example of ... by edoceo on Tuesday September 25, 2018 @12:30AM (#18063616)
Agreed
Re:Am I logged in or not? GDPR case study on the example of ... by eudora on Monday September 24, 2018 @09:18PM (#18062826)
So make an advanced options screen divided into categories.

It's not hard.

And you don't have to do every possible customisation options, just the ones that people are enraged about.

Re:Am I logged in or not? GDPR case study on the example of ... by pvorb on Tuesday September 25, 2018 @12:12AM (#18063536)
This is hard to do as an afterthought. I bet Firefox had it from the start.
Re:Am I logged in or not? GDPR case study on the example of ... by hrktb on Tuesday September 25, 2018 @01:35AM (#18063853)
I wonder if we’re not already at this point though, and it might not be a bad thing.

Not everyone uses a browser the same, but a decent part of people here will spend their working life in the browser. I think for people here it won’t be rare to have dozen of windows with each dozen of tabs, some logged in different acconts within the site they show, some in incognito, some with in developer mode.

Even with just the browser filling multiple windows worth of buttons and stuff to interact with is easy, without even going to hidden preferences and configs.

I’d argue in complexity level we’re already on par with a airliner cockpit, it’s our job to deal with that, and we do it professionaly for years. Of course not everyone needs that complexity, but at least we do.

What I am getting at is, I think we should accept we’re not a t the point where it is simple anymore, embrace the complexity and give tools to effectively manage it.

Airliner cockpit are so because it’s efficient to have individual switches to important action and state indicators. We shouldn’t shy away from showing important info in the interface just because we’d end up with more stuff. Having it hidden can be a worse tradeoff.

Re:Am I logged in or not? GDPR case study on the example of ... by brokenmachine on Tuesday September 25, 2018 @02:19AM (#18064029)
The problem is that you're in the 0.001% of people who want their software complicated like an airline cockpit.

Most people don't give a shit, they just want to check their gmail and couldn't care less. They don't even read the alert boxes that do pop up. They just click almost anything blindly.

As a result, companies get away with dark patterns and privacy-compromising changes like this.

I'm somewhere in the middle. I don't want airline-cockpit controls, but I do want the ability to not sync to the cloud/NSA if I want.

I also don't want to be tricked into syncing by some dark pattern silent update that makes an ambiguous clickbox that doesn't clearly say what the privacy implications are either.

Re:Am I logged in or not? GDPR case study on the example of ... by hrktb on Tuesday September 25, 2018 @02:47AM (#18064142)
Yes, I think the middle ground will be the majority. All the more so actual “casual” users that want stuff that “just work” will use their phone or tablet, or the default browser already installed and is good enough.

Chromebooks are in an interesting position, with a chance to have newer users. But then they will literally live their life in the browser.

In that sense, Chrome users are already set apart I think.

Re:Am I logged in or not? GDPR case study on the example of ... by beenBoutIT on Monday September 24, 2018 @08:36PM (#18062668)
I'm convinced that most users would prefer having zero options or checkboxes.
Re:Am I logged in or not? GDPR case study on the example of ... by TeMPOraL on Tuesday September 25, 2018 @12:55AM (#18063709)
Yes, they would prefer the software to always be perfectly tuned to them, even as they change their own... preferences.
Re:Am I logged in or not? GDPR case study on the example of ... by gcb0 on Monday September 24, 2018 @10:03PM (#18063012)
that's a huge silly fallacy.

if you are operating something as complex and dangerous, you need the Comercial airliner cockpit! it's that way for a reason! or would you rather board a 747 with a huge colorful button "fly" and another "land"?

if you have something like a browser, that is your last line of defense accessing online banking etc, you need to see into the miriad of options. if you just browse facebook, use the default and be happy. Knowing about:config shouldn't be a gate keeper to anything! going to settings then advanced should be more than enough to communicate the concept of advanced options. anything different you are just being an entitled , incompetent UX designer.

about:config is lazy, but get some of the job done. your oh-so-perfect two options google chrome setting page, is lazy and useless.

Re:Am I logged in or not? GDPR case study on the example of ... by eudora on Monday September 24, 2018 @09:17PM (#18062821)
Oh man, this always Madden's me when a company takes away some option in the name of simplifying for the majority of users.

Put it on a screen called advanced options or something, even about:config, and let us decide!

That is, if you're really not just manipulating your users.

Re:Am I logged in or not? GDPR case study on the example of ... by Zarel on Monday September 24, 2018 @11:01PM (#18063260)
I mean, this _is_ on the advanced options screen. It's in chrome://flags/#account-consistency
Re:Am I logged in or not? GDPR case study on the example of ... by eudora on Tuesday September 25, 2018 @12:09AM (#18063521)
So it is

But will it be there forever?

Some other post on HN on this topic implied these options tend to vanish over time. (I'm not sure if they so or don't)

Re:Am I logged in or not? GDPR case study on the example of ... by 0x54D5 on Monday September 24, 2018 @07:40PM (#18062431)
That 0.1% doesn't take into account hours spent using the actual app. Power users tend to spend all day in a browser whereas a typical grandma might look at it for 15 minutes and close it. Meanwhile people who have multiple Google accounts and who spend literally all day in the browser are the ones that get the short end of the stick? That makes zero sense and it's why people are starting to hate Google just like any other corporation that makes decisions by committee. There should have been a product owner on the browser team that said "No this is a browser. Not an extension of GSuite."

The total indifference to people's valid use cases is what really grinds my gears.

Chrome is still the only browser that ruins my UX by putting a profile picker into the title bar. A place it has no business being. I literally made a patch and compiled my own version of Chromium for a while to get rid of it. https://github.com/hparadiz/chromium-disable-profile-button-...

I'm so tired of the arrogance. Chrome used to be a beautiful simplistic browser. Now it's just bloat. I'm done. Get off my computer. You guys had your chance and blew it.

Re:Am I logged in or not? GDPR case study on the example of ... by zbentley on Monday September 24, 2018 @10:04PM (#18063020)
If all the power users leave, the app makers do not care. If all the typical grandmas leave, their margins are significantly impacted.

You can figure out the rest.

That’s not a problem or an indictment. Just an observation of how systems work st scale.

Re:Am I logged in or not? GDPR case study on the example of ... by TheKarateKid on Monday September 24, 2018 @10:24PM (#18063092)
How do you think Firefox and Chrome overthrew IE? The power users (us) who set up and fix everyone else's computers spent years telling others why IE is terrible and installed a different browser, and it slowly but surely worked (along with strong developer and media/press support).
Re:Am I logged in or not? GDPR case study on the example of ... by snaky on Monday September 24, 2018 @10:32PM (#18063119)
That's very short term focused observation though. Power users are influencers. When power users leave - especially being annoyed and angry - they start to actively advise against the product left and right, to the regular users and to other power users.
Re:Am I logged in or not? GDPR case study on the example of ... by TeMPOraL on Tuesday September 25, 2018 @01:01AM (#18063726)
But that's unfortunately how this works. I think people forget market players can, and are, self-destructive, when short-term profits interfere with long-term survival.

It's also part of the reason for the pace of the industry. You pump out as much money as you can from some space, and then move on to focus on the next thing.

Re:Am I logged in or not? GDPR case study on the example of ... by zlotnydiev on Monday September 24, 2018 @08:02PM (#18062538)
Why would they repeat the Google+ linked accounts nightmare though? I never wanted a fucking chrome account, and linking my business and private accounts is the stupidest thing you idiots could have done.

I never wanted my youtube account tied to my business email.

Re:Am I logged in or not? GDPR case study on the example of ... by dang on Monday September 24, 2018 @11:45PM (#18063413)
> the stupidest thing you idiots could have done

Would you please read the site guidelines and follow them when commenting here?

https://news.ycombinator.com/newsguidelines.html

Re:Am I logged in or not? GDPR case study on the example of ... by zlotnydiev on Tuesday September 25, 2018 @10:04PM (#18072117)
Those guidelines were followed. Given the chance I would say that to their faces.
Re:Am I logged in or not? GDPR case study on the example of ... by dang on Wednesday September 26, 2018 @04:32AM (#18073931)
Between this and https://news.ycombinator.com/item?id=18072106 it seems clear that you don't want to use HN as intended, so I've banned this account.

If you don't want to be banned, you're welcome to email [email protected] and give us reason to believe that you'll follow the rules in the future.

Re:Am I logged in or not? GDPR case study on the example of ... by autocorr on Tuesday September 25, 2018 @03:51AM (#18064369)
Or before that, Google Buzz! The opt-out social network which nobody asked for that automatically shared your contacts.