From what I hear, this is due to the promo driven culture at Google. You can good reviews/promos based on new products that get pushed to market, nobody cares about maintenance at Google.

I heard that Facebook and Google collect engineers and let them do whatever because its better than them being productive at a competitor.

One of the most senior engineers here (someone with his name on many research and whitepapers from his tenures at Amazon, Microsoft et al), left Google for precisely this reason. He was bored of working on stuff that would never reach the light of day. It happened multiple times to him in his time there.

any pointers of who you might be referring to?

Textbook anti competitive behavior. Google needs to be broken up.

Yeah, let´s break Google into a bunch of smaller companies, all managed by Alphabet.

When people say this, what exactly does this mean? If you break Google up into Gmail, Search, Calendar, etc... what stops those from within, who have intimate knowledge of the innerworkings and HR related matters within Alphabet as a whole, from simply secretly colluding and sharing resources off the books?

I’ve asked this question an bunch of times and never got a serious reply. There’s no strong anti-trust angle or end game to these things, it’s purely vindictive because it’s trendy to hate on SV.

Sometimes companies are shitty but it doesn’t justify such a strong hammer. If anything their search products or mobile products would themselves need to be broken up, (or FBs network and Instagram) not the whole company... but even then it’s not like they will go away.

So I don't necessarily support it, and I agree a lot of technical people just hate SV and have no idea what it'd mean, but as a developer I can see some benefits.

Here's an example from Apple:

Only Apple Maps can show you maps on a locked screen.

Until iOS 13 Siri tightly integrated with Apple Music ways no other app could.

Apple Pay is the only payment method that can work with a locked phone.

Only Apple's app store can install apps.

Only Apple's messaging apps can create new contacts.

All built-in apps only call other Apple apps for supporting functionality, for example Reminders will only open Apple Maps, Siri smart suggestions for ETA only work with Apple Maps as well.

All Apple apps get an immense head start of integrating with new APIs and OS features.

-

So if you create a competitor to one of those Apple apps, from day 1 you're at a disadvantage.

If they were broken up, all competitors would be on a much more even playing field with Apple's apps.

And Apple is just an easy example, Android is much more open than iOS, but Google Play Services is still a guillotine over anyone who dares to go against Google's wishes.

Imagine if Google services were separate companies so a claimed misdeed on one couldn't end what is the core of billions of people's online existence...

> it’s trendy to hate on SV.

Perhaps, but the vast majority of the hate lands on those companies that are actively screwing over their users, so... I'm happy with vindictive against a billion dollar monolith that I have no hope of ever controlling.

The idea is that breaking up a company will reduce both their resources available to behave badly (cash, infrastructure, people etc.) as well as getting the people in the newly independent organizations to start thinking competitively with each other as well as other companies in the market. If done right, the newly formed entities wouldn't be viewed as the 'same old people under a new name' but rather an entity no longer working toward the same goals if not an outright competitor. (that's in a perfect world... it rarely is perfect) What would keep them from colluding would typically be government/regulatory oversight for some period of time after the breakup with civil and/or criminal penalties being the stick for doing what you describe.

You mean other than the laws that were used to break them up?

Generally, just because someone may find a way around a law is not a justified reason for not having the law.

Simply, that's an extremely difficult criminal enterprise to pull of especially on an ongoing basis and for what gains? I would only see to do so for spite and active defiance of the law. Is that worth hefty fines, investigations, possible charges and jail time?

A break up usually means many of these people are laid off or move on. Every separate company would have its own books that would either need to be public if they remain public entities or have audited financials that match expenses to revenue and investments. Not an easy thing to hide QTR over QTR. Furthermore, depending on how the companies are broken up, they will be acquired by other companies or PE rather than be stand-alone enterprises. Lastly, whistleblowers.

TL;DR It's not worth it for spite and any significant gains or advantages that are imagined, are probably significant enough to be noticed by the government or some enterprising analyst.

Doesn't seem like they do "whatever", but rather "whatever they're told" - otherwise they'd be free to maintain passion projects (like our beloved Reader.)

I got my first promotion in Google for preventing a half-forgotten system from imploding.

That's actually a bad sign, as it shows how notable it is at Google when something like this is prevented... ️

Preventing Products from failing should be SOP.

It's bad that there are half forgotten systems but almost every sizable business that has been around for many years will have this. On mobile, but there's a famous story of a server that had been drywalled over and had been running just fine, unnoticed and unattended, for years.

It's good to see that maintenance is rewarded at Google at least occasionally. I only ever hear that it is only new products that are rewarded. And I notice new people piling on to issues in their product trackers that I've been following for years.

> On mobile, but there's a famous story of a server that had been drywalled over and had been running just fine, unnoticed and unattended, for years.

This one?

https://www.theregister.co.uk/2001/04/12/missing_novell_serv...

But consider incentives. If nobody gets promoted for doing it, nobody does it. Promotion for maintenance isn't a bad sign if your corporate culture is "hire the smartest people in the room and let them build great products;" you're going to have to incentivize maintenance somehow, and "maintain it or you're fired" is counter to your cultural goals.

Promoting people who notice impending implosions should also be SOP.

Leading to a black market in manufactured implosion-causing problems!

It’s not at all a bad sign. Any large and complex system will have parts rot from lack of maintenance, and giving awards to people who identify and correct this ahead of disasters is a good thing.

So... people shouldn't be promoted for keeping existing services running, but they should keep those services running as SOP? Sounds like a recipe for misaligned incentives to me.

Nobody cares about maintenance at most places.

> They certainly dont inspire trust in anything but their flagship brands like Gmail that have been with us for decades.

Even Gmail is a giant blob of garbage.

> Even Gmail is a giant blob of garbage.

Sadly from a UX point of view I can't disagree. Google inbox (and other products) showed how the UX for mail clients can be tremendously improved. But they shut it down and only migrated some of the more irrelevant features. IMHO the UX of gmail is so bad that I wonder if they want to phase out email altogether.

This doesn't even include some of the thing inbox (and maybe gmail, idk) supported wrt. metadata and live updates and now is discontinued "because it's no longer needed with dynamic amp pages". Just that amp kinda misses the whole point of email :( .

I really want to write my own client. But I know it's way to much work to get to the point where it's nice _and_ that is pointless if the people sending mails will stop including thinks like json-ld sections in mail. Really sad, as that had a lot more potential then the amp * they want to ship now.

There is a hamburger icon (top-left), 9-dot icon (top-right), gear icon (top-right) and 3-dot icon (top-left). What do they all do? (I actually know).

Google Play music is like this in Android Auto:

https://twitter.com/JasonCWalton/status/1065631146090868736

They've replaced the hamburger menu in the upper left with a "back arrow", which does the same thing as the hamburger menu did, while making even less sense.

Don't forget the menu with a picture of your face on it (probably).

And that's before you open up the compose field. To this day I click the wrong button every time when I want to forward an email. Every time. Despite knowing I do it every time, I still click the wrong one.

Huh, I imagine that internally nobody notices this type of problem because they all use keyboard shortcuts and hit 'f' to forward.

What?

Eh, I agree with him. I've been with gmail since middle school (going on... a LOT of years now, back when it was invite only).

Somewhere in the last 10 years or so it feels like the gmail team switched from "Make a good email client" to "Shove all the enterprisey things into gmail!".

It's gotten SO slow to load and is incredibly bloated.

I was a happy inbox user until... drumroll... they shut that down too.

I still use Gmail because old habits die hard, but I won't ever suggest a google tool at work. Fool me once, shame on you...

Actually for work Gmail has gotten (and is getting) better. My workplace switched from Outlook to Gmail recently and I felt like it was a net improvement.

Google has a vested interest in reading your email. Google lets users think that setting up a mail server is difficult, that email is a dead end communication medium compared to walled gardens, and that phishing is difficult to combat effectively.

FWIW though, setting up a mail server is difficult. Setting up a mail client with reasonable spam filtering to make email usable is also difficult. Compare the list of steps on either of those tasks to the list for getting email via Gmail: "1) Sign up to a Google account, 2) visit gmail.com"; it's obvious almost all users are going to do the latter (or its equivalent at a Google competitor).

Setting up a mail server isn't difficult. It's about as easy as installing and configuring a web server, and just about as technical.

Email has been around for decades. The fact that Gmail, Yahoo, Hotmail, and many paid services have had one-click email addresses for twenty-plus years should demonstrate that it's not difficult. Businesses just don't want to make it easy for lay people to do it.

Unless email servers have gotten a lot more turnkey in the last few years, I'm gonna disagree with this, sorry. :) I can get nginx running on most systems with literally a couple commands ("package-manager-thing install nginx" and "service-manager-thing start nginx"). Getting a mail server running -- at least in any form that qualifies as "Gmail replacement" -- seems to involve "install postfix, immediately edit the configuration because it has no out-of-the-box defaults, create multiple configuration files beyond that because that's how postfix rolls, install dovecot, immediately edit its configuration because it has no out-of-the-box defaults either, create some directories and user accounts and more configuration files because that's how dovecot rolls, then test that everything's working." And I'm leaving out the "install MySQL" part that many guides you'll find online will also have you do. Also, I haven't talked about running a spam filter and YOUR HARD DRIVE IS ALREADY FULL OF NIGERIAN PRINCES TRYING TO SELL YOU PENIS-ENLARGING BITCOIN I'M SO SORRY.

I would love it if "package-manager-thing install mail-server-thing" and "service-manager-thing start mail-server-thing" could get things going with sensible defaults like they do with nginx, even if you'd probably need to tweak things after they were going just like you're almost certainly going to do with a web server. But AFAIK, that just ain't the case.

While I don't have to set up a mail server any time soon, I am absolutely bookmarking this. :)

I've run a mail server, and still help out with one, and getting consistent deliverability is hard. We've wanted to move to another hosting service for years, but the only reason we're doing ok right now is that our dedicated IP has a solid history and we just can't give that up in a migration.

The services you mention all have entire large teams devoted to tackling spam, reputation, uptime, etc. That it's easy and cheap on a marginal basis for them to add one more inbox to their millions doesn't mean the overall infrastructure is easy to keep running.

> The services you mention all have entire large teams devoted to tackling spam, reputation, uptime, etc.

Can you provide specific numbers to the count of people devoted to tackling spam, reputation, uptime, etc? I suspect the number's a lot smaller than you think. I also suspect the peoples' duties are less devoted than you think.

If Google, for example, truly worked to tackle spam then it wouldn't have a spam problem today. If Yahoo truly worked to tackle reputation, people wouldn't have trouble sending email using an email client instead of a browser.

I'll grant you that uptime does have dedicated people. But it's not to tackle spam or reputation. It's because offline services don't make a profit.

I work with these teams at Google.

There are teams that actively (and solely) work on spam and abuse detection. They're larger than you seem to believe, though I won't give exact numbers. There's also obviously sre teams that maintain uptime. (Note I said teams, and there's a public approximate minimum size for an are team at Google of 8-12 people)

The problem is that spam can't be "solved". Reputation is easy to solve: only accept email from a known list of good senders. Gmail, Yahoo, MailChimp (or not), etc. But that makes people on HN complain. So your have to try and infer reputation of mailservers on shared hosts. And spammers are always trying to beat you, and there are thousands, maybe tens of thousands of spam outfits. Af they're sneaky. They try to use awa or gcp to send email, or even send spam from Gmail, prevent trickier things. So you're left to defend from a spam campaign from Yahoo while also trying to not block everyone at Yahoo, and detect the spammers who are using Gmail to spam Yahoo too.

And the spammers are always innovating, so you have to as well.

My personal belief is that Google likely considers spam detection to be an area of competitive advantage so investments are warranted.

> The problem is that spam can't be "solved". Reputation is easy to solve: only accept email from a known list of good senders. Gmail, Yahoo, MailChimp (or not), etc. But that makes people on HN complain. So your have to try and infer reputation of mailservers on shared hosts. And spammers are always trying to beat you, and there are thousands, maybe tens of thousands of spam outfits. Af they're sneaky. They try to use awa or gcp to send email, or even send spam from Gmail, prevent trickier things. So you're left to defend from a spam campaign from Yahoo while also trying to not block everyone at Yahoo, and detect the spammers who are using Gmail to spam Yahoo too.

Spam absolutely can be solved.

1) enforce identity. If the sender isn't authentic, then the sender is spam.

2) enforce reportability. If the user reports the sender as spam, then don't permit the sender to send more messages to the person who complained. if a lot of people report the problem, then block the sender.

3) enforce liability. if an ISP hosts spammers, then block the ISP.

If someone complains then walk them through the process. Just like people shouldn't drive vehicles without understanding that vehicles are dangerous, the same should be done with computers.

The world is so much more complicated than this.

Everything Joshua Morton said but also:

What is identity? A name? An SSN? How do you verify that for people in all the countries of the world?

How do you do that at scale? With hundreds of millions of users, you can't exactly call them up.

How many users are you going to have after you start adding measures to verify their identities at signup? How will the board of directors feel about that? And feel free to run your own company into the ground doing the right thing, but there are other email providers in the world who will happily accept the users you drive away.

What happens when people have their accounts taken over and start spamming? Were the accounts ever "real"? How can you even know?

What happens when the reports themselves are spam? Spammers will report other spammers to remove the competition. Or they'll just overwhelm it with useless fake reports to DOS your human reviewers.

You have to realize that every input to your system is a potential avenue for abuse. There are people sitting there all day thinking about how to prevent you from achieving your goals. Humanity went to the moon, we're problem solvers. If there's a way to manipulate and undermine your spam defenses it will be found.

> If the sender isn't authentic, then the sender is spam.

What's your definition of authentic? Is a self-hosted email server authentic? How do you decide?

> If the user reports the sender as spam, then don't permit the sender to send more messages to the person who complained.

If 10000 yahoo accounts are sending spam emails to other websites, what do you do? Block all yahoo senders? Try to block the yahoo accounts as they appear?

> 3) enforce liability. if an ISP hosts spammers, then block the ISP.

All major ISPs host spammers. Often they don't know that they do. Is it worth cutting off all comcast users nationwide from being able to use email? If anything, this would further centralize on one or two trustworthy email hosts, because those providers are essentially their own ISPs.

> What's your definition of authentic? Is a self-hosted email server authentic? How do you decide?

Authentic in terms of DNS. That means using and enforcing DKIM at the minimum.

Also in terms of from: and reply-to: addresses matching each other.

> If 10000 yahoo accounts are sending spam emails to other websites, what do you do? Block all yahoo senders? Try to block the yahoo accounts as they appear?

If 10000 yahoo accounts are sending spam emails, then that's a Yahoo problem. Yes, I would refuse to accept incoming mail from @yahoo.com until they've fixed their complicity.

> All major ISPs host spammers. Often they don't know that they do.

I disagree about not knowing that they do. ISPs must respond to fraud and abuse reports or they would lose the ability to do business. ISPs not responding to spam reports are offloading the cost of policing their users onto you.

> Authentic in terms of DNS. That means using and enforcing DKIM at the minimum.

Sure, these are basic things that are generally used as strong signals, but all this does is filter out the incompetent spammers. If you're sending from yahoo or from gmail, you've already solved the reputation problem. And there are other ways of doing the same.

> If 10000 yahoo accounts are sending spam emails, then that's a Yahoo problem. Yes, I would refuse to accept incoming mail from @yahoo.com until they've fixed their complicity.

I'd expect that this is approximately the baseline number of yahoo accounts sending spam when they aren't being actively targeted. Its less than 1% of 1% of the active monthly accounts on yahoo. So you'd like to just block yahoo constantly?

> I disagree about not knowing that they do.

Sure they know, in the sense that I also know that there are always people spamming from every major ISP. That doesn't mean that they can immediately address things. And while you're busy blocking all comcast users from sending your users email, your users are busy moving to a different email provider that identifies individual spam senders so that they can still receive legitimate email.

In closing, a simple question: if solving spam is this straightforward, why hasn't an upstart competitor (yahoo, protonmail, etc.) taken advantage of this strategy to fix the spam problem? It appears you're presuming a centralized system, which defeats the point of email and significantly simplifies the problem.

Internet systems are one part technology and one part social.

If my mail server is banning mail from Yahoo, I can't communicate with my grandparents and I stop using that mail server. Enough people do that and the mail server has no users.

inetknght, I get the sense that you run a mail server of your own. Have you taken your own advice here and blocked @yahoo.com incoming? Is it inconvenient? Is it more inconvenient than the two-step process of setting up a Gmail account?

> If my mail server is banning mail from Yahoo, I can't communicate with my grandparents and I stop using that mail server. Enough people do that and the mail server has no users.

Why are your grandparents using Yahoo instead of your mail server?

> Have you taken your own advice here and blocked @yahoo.com incoming? Is it inconvenient? Is it more inconvenient than the two-step process of setting up a Gmail account?

I haven't had any correspondence from anyone who uses @yahoo.com. Or, if I have, they haven't complained about me not receiving their email. Or, if they have, their complaint was also not received in which case it doesn't exactly matter. If it did matter then I would address it then. And, importantly, it also means there's another (less noisy) communication medium available already.

> Why are your grandparents using Yahoo instead of your mail server?

Because internet systems are one part technology and one part social. My grandparents already have Yahoo accounts and are unwilling to change that.

And if your solution to interoperating with Yahoo servers is "I don't have anyone to talk to using Yahoo servers," then I'm afraid it sounds like you're trying to solve a problem other than the one email is designed to solve.

When your real-world proof is the safety of automobiles, you might want to rethink your position.

The simplest web server I'm aware of is `python http.server 8080`

... and even for that, I had to disable / re-enable the firewall and fish around in the docs just last night to get the dang thing to accept connections from a source other than localhost (PROTIP: when running on a pretty-out-of-the-box Windows 10 config, the default options bind listeners to IPv6, not IPv4). And I definitely wouldn't recommend that configuration for production; you'll open yourself up to a universe of pain.

But as an analogy for setting up an email server vs. just subscribing to Google or whoever, I accept it. ;)

Phishing is difficult to combat effectively. Part of the problem is technological in that we never adopted a way of verifying senders are who they claim to be, but a large part of it is that humans are really good at fooling other humans, at least enough of the time to cause trouble.

Ironically, it is the technical problem of verification that makes it difficult to run (not setup) a mailserver: no one wants to trust it.

I don't think verification of sender is the problem (see PGP), it's that email was built such that anyone can contact anyone without setup ahead of time. I can give my address to some guy I meet at a conference and he can email me later with no issues, we don't need to agree ahead of time that we know who each other are. If he uses PGP, I need to accept the first communication is him, which means anyone can send me anything claiming to be anyone. Unfortunately, as soon as you solve this part of the issue with technology, I think you've just reinvented social media.

He said "adopted". Not "invented". PGP is not main-stream and probably never will be.

Such technologies have to be done behind the scenes and presented seamlessly, or they will probably never take off.

I wasn't trying to discuss whether or not PGP is a good or widely used technology. My point was that even if something like it were widely adopted and made seamless, it would not be able to solve the problem of bootstrapping the verification connections without eventually become social media itself.

> Part of the problem is technological in that we never adopted a way of verifying senders are who they claim to be, but a large part of it is that humans are really good at fooling other humans, at least enough of the time to cause trouble.

Tell me more about how DKIM and SPF and TLS with client certificates don't verify senders.

I didn't say they didn't, I said we haven't adopted a way of verifying senders. If DKIM, SPF, and TLS were universal, it would be a solved issue, but they aren't for a whole lot of reasons.

P.S.: However, come to think of it, they don't. You can receive a perfectly legit and verified email from [email protected] with the name displayed as "Mr. Your CEO".

> Google lets users think that [...] phishing is difficult to combat effectively.

It sure is when they don't even bother to show the From address, there's no way to make links unclickable as an email administrator.

At this point, between Microsoft and Google ruining it in different ways, email has very little hope as a medium.

Gmail cannot even do threading, and it makes threads burst into flame when a threaded mailreader tries to interact with people using gmail.

Stadia .net 2003.