7 ms·

Gripes with Google Groups

34 points by wglb 8y ago

awakeasleep 8y ago
Google's APIs make it easy to audit your groups, and if you don't want to write your own program to do it you can use the GAM command line tool. https://github.com/jay0lee/GAM/wiki https://github.com/jay0lee/GAM/wiki
- lvh 8y ago
  GAM is awesome for this. We've also had good luck with Google Apps Scripts. The advantage is that it makes it marginally easier to set up credentials: it does so behind the scenes so you never have creds with admin permissions hit disk. The disadvantage is you're now editing an old-ish version of JavaScript in a janky browser editor that saves to some weird bespoke JSON format. You can also use clasp (https://github.com/google/clasp https://github.com/google/clasp) to edit these files from your favorite editor but now you own a Software Engineering Project. Here's roughly what that looks like to get all the mentioned info out: function getGroups(domain) { var groups = [], pageToken, page; do { page = AdminDirectory.Groups.list({ domain: domain, maxResults: 100, pageToken: pageToken }); if (page.groups && page.groups.length > 0) { groups = groups.concat(page.groups); } pageToken = page.nextPageToken; } while (pageToken); return groups; } function getGroupPerms(groups) { var perms = []; for (var i = 0; i < groups.length; i++) { perms.push(AdminGroupsSettings.Groups.get(groups[i].email)); } return perms; } Disclaimer: I'm the author of the linked blog post.
  - jmathai 8y ago
    Apps Script has a lot of potential when it comes to Groups (and other resources a company has to manage). As you said, clasp is an alternative to the web UI. What’s an ideal platform you’d like to see for easily executing code on to work with groups (Apps Script, Cloud Functions, or other)?
    - lvh 8y ago
      I mean, I'm me, so I want to write Clojure. I haven't tried ClojureScript -> clasp to see if I can use ClojureScript. Does Google Apps Script document exactly what the runtime is? It looks like Rhino from some of the failure modes, but I don't know the exact modern JS features it supports. The huge benefit to GAS IMO is that creds never hit my disk.
- chmars 8y ago
  Does it still provide a list of user access rights for single files and directories on Team Drives?
  - lvh 8y ago
    FWIW I haven't found a way to get access to unshared files until after you remove access from someone. The Admin SDK only provides usage reports. The Drive SDK allows you to get files et cetera, but only for the current user (!) -- so that doesn't help for anything you don't have access to, which I'm guessing from the phrasing of your question you already knew :) I'm guessing this is a feature? As in Google wants it to be easy to just create local sheets/docs/... without them being shared with your org by default and would rather worry about giving admins better features to manage and audit sharing than give admins access to every document under the sun :)
tptacek 8y ago
This is an LVH post, but the basic idea is: if you're using GSuite as a source of truth for identity in your company (lots of people do this, and it's not a bad idea), you have to be aware of the dual duty Google Groups does. People set up Groups to manage communications, like Slack channels, but also to manage authorizations ("can run this application"). It is a little bit crazy that the authorization construct in Google Groups has an "allow the Internet to join" option. I don't think you'll find that particular button anywhere in Okta or OneLogin.
- deleted 8y ago
  [deleted]
- jmathai 8y ago
  This stems from the origin of Google Groups as the OP mentioned. It’s definitely not ideal but we are actively working on making groups more suitable for the various enterprise/business scenarios they are being used for. (I’m a PM @ Google working on some of these efforts)
  - tracker1 8y ago
    I'd be happy if I could just setup an email distro list in google domains, or in the G Suite admin, instead of having to setup groups... I swear it took me half an hour to figure out why my dev@ list wasn't getting email from outside the domain.
    - jmathai 8y ago
      Sounds like the issue might have been confusion with the UI. groups.google.com has a lot of settings and it can be really confusing to know how to set up a group that functions in a particular way (i.e. receive email from outside the domain). G Suite admin has less settings but from what I've heard from customers it doesn't expose enough of them so they end up having to go to groups.google.com anyway. I think some of the updates we're working on will help.
      - 8y ago
lvh 8y ago
I wrote this, underlying work is collaboration with the other Latacora folks, happy to answer questions :)
- jmathai 8y ago
  Thanks for writing this up. I'm a PM working on many of the issues you've raised. Happy to chat via email (jaisen@) or offline as well.
- defen 8y ago
  Out of curiosity, are the "example scenarios" things you've actually seen in the wild?
  - lvh 8y ago
    I can't provide details re: where/when/who of course, but all of these are functionally equivalent to things that have happened. Reality tends to be a bit messier than these scenarios but not in a way that fundamentally changes anything.
jmathai 8y ago
I'm a PM at Google working on groups functionality for enterprise customers. We're working on ways to make groups easier to manage and more secure. Happy to answer questions related to this post or other gripes you may have with Google Groups.
- lvh 8y ago
  Cool! Can you elaborate on what easier to manage and more secure might look like?
  - jmathai 8y ago
    Easier to manage and more secure fall generally end up falling into the same bucket. We're working on ways to ensure that a group contains the people you expect it to have. Sounds like a no-brainer but this is one of the most common pain points we hear from customers. Secondly, there's a slew of group settings exposed through groups.google.com which are not exposed elsewhere (Admin console, APIs). We're working on improving that which will help users know what a group's settings are across all the groups surfaces (groups.google.com, Admin console, APIs).
    - tracker1 8y ago
      I was going to bring up that I wish that groups was more like MS teams, but that leads me into Google Hangouts (Chat, Meet, Allo, Duo, Messenger, Voice, stray dogs everywhere)... Frankly, I loved Hangouts right after the Google Voice integration happened... then they broke it up and made it horrible... I think you (google) should drop them all, bring back "Google Chat" as one named umbrella, get all of it working in one place/system, and do an "update" that points them all to the new app. Having 147 disconnected apps to communicate outright sucks horribly.
- pehaada 8y ago
  We are about to give up on Groups. It is like a stray dog for google. The filtering is hit of miss with groups. Our internal help desk gets 1-2 google group issues / week from our user-base of 70 employees.
egggo 8y ago
It requires JavaScript enabled to read text...
jakeogh 8y ago
Google has an excellent track record closing services, but this one is an outlier. No JS fallback, difficult to scrape, par google, par.

34 points by wglb 8y ago

Google's APIs make it easy to audit your groups, and if you don't want to write your own program to do it you can use the GAM command line tool. https://github.com/jay0lee/GAM/wiki https://github.com/jay0lee/GAM/wiki

lvh 8y ago
GAM is awesome for this. We've also had good luck with Google Apps Scripts. The advantage is that it makes it marginally easier to set up credentials: it does so behind the scenes so you never have creds with admin permissions hit disk. The disadvantage is you're now editing an old-ish version of JavaScript in a janky browser editor that saves to some weird bespoke JSON format. You can also use clasp (https://github.com/google/clasp https://github.com/google/clasp) to edit these files from your favorite editor but now you own a Software Engineering Project. Here's roughly what that looks like to get all the mentioned info out: function getGroups(domain) { var groups = [], pageToken, page; do { page = AdminDirectory.Groups.list({ domain: domain, maxResults: 100, pageToken: pageToken }); if (page.groups && page.groups.length > 0) { groups = groups.concat(page.groups); } pageToken = page.nextPageToken; } while (pageToken); return groups; } function getGroupPerms(groups) { var perms = []; for (var i = 0; i < groups.length; i++) { perms.push(AdminGroupsSettings.Groups.get(groups[i].email)); } return perms; } Disclaimer: I'm the author of the linked blog post.
- jmathai 8y ago
  Apps Script has a lot of potential when it comes to Groups (and other resources a company has to manage). As you said, clasp is an alternative to the web UI. What’s an ideal platform you’d like to see for easily executing code on to work with groups (Apps Script, Cloud Functions, or other)?
  - lvh 8y ago
    I mean, I'm me, so I want to write Clojure. I haven't tried ClojureScript -> clasp to see if I can use ClojureScript. Does Google Apps Script document exactly what the runtime is? It looks like Rhino from some of the failure modes, but I don't know the exact modern JS features it supports. The huge benefit to GAS IMO is that creds never hit my disk.
chmars 8y ago
Does it still provide a list of user access rights for single files and directories on Team Drives?
- lvh 8y ago
  FWIW I haven't found a way to get access to unshared files until after you remove access from someone. The Admin SDK only provides usage reports. The Drive SDK allows you to get files et cetera, but only for the current user (!) -- so that doesn't help for anything you don't have access to, which I'm guessing from the phrasing of your question you already knew :) I'm guessing this is a feature? As in Google wants it to be easy to just create local sheets/docs/... without them being shared with your org by default and would rather worry about giving admins better features to manage and audit sharing than give admins access to every document under the sun :)

tptacek 8y ago

This is an LVH post, but the basic idea is: if you're using GSuite as a source of truth for identity in your company (lots of people do this, and it's not a bad idea), you have to be aware of the dual duty Google Groups does. People set up Groups to manage communications, like Slack channels, but also to manage authorizations ("can run this application"). It is a little bit crazy that the authorization construct in Google Groups has an "allow the Internet to join" option. I don't think you'll find that particular button anywhere in Okta or OneLogin.

deleted 8y ago
[deleted]
jmathai 8y ago
This stems from the origin of Google Groups as the OP mentioned. It’s definitely not ideal but we are actively working on making groups more suitable for the various enterprise/business scenarios they are being used for. (I’m a PM @ Google working on some of these efforts)
- tracker1 8y ago
  I'd be happy if I could just setup an email distro list in google domains, or in the G Suite admin, instead of having to setup groups... I swear it took me half an hour to figure out why my dev@ list wasn't getting email from outside the domain.
  - jmathai 8y ago
    Sounds like the issue might have been confusion with the UI. groups.google.com has a lot of settings and it can be really confusing to know how to set up a group that functions in a particular way (i.e. receive email from outside the domain). G Suite admin has less settings but from what I've heard from customers it doesn't expose enough of them so they end up having to go to groups.google.com anyway. I think some of the updates we're working on will help.
    - 8y ago

lvh 8y ago

I wrote this, underlying work is collaboration with the other Latacora folks, happy to answer questions :)

jmathai 8y ago
Thanks for writing this up. I'm a PM working on many of the issues you've raised. Happy to chat via email (jaisen@) or offline as well.
defen 8y ago
Out of curiosity, are the "example scenarios" things you've actually seen in the wild?
- lvh 8y ago
  I can't provide details re: where/when/who of course, but all of these are functionally equivalent to things that have happened. Reality tends to be a bit messier than these scenarios but not in a way that fundamentally changes anything.

jmathai 8y ago

I'm a PM at Google working on groups functionality for enterprise customers. We're working on ways to make groups easier to manage and more secure. Happy to answer questions related to this post or other gripes you may have with Google Groups.

lvh 8y ago
Cool! Can you elaborate on what easier to manage and more secure might look like?
- jmathai 8y ago
  Easier to manage and more secure fall generally end up falling into the same bucket. We're working on ways to ensure that a group contains the people you expect it to have. Sounds like a no-brainer but this is one of the most common pain points we hear from customers. Secondly, there's a slew of group settings exposed through groups.google.com which are not exposed elsewhere (Admin console, APIs). We're working on improving that which will help users know what a group's settings are across all the groups surfaces (groups.google.com, Admin console, APIs).
  - tracker1 8y ago
    I was going to bring up that I wish that groups was more like MS teams, but that leads me into Google Hangouts (Chat, Meet, Allo, Duo, Messenger, Voice, stray dogs everywhere)... Frankly, I loved Hangouts right after the Google Voice integration happened... then they broke it up and made it horrible... I think you (google) should drop them all, bring back "Google Chat" as one named umbrella, get all of it working in one place/system, and do an "update" that points them all to the new app. Having 147 disconnected apps to communicate outright sucks horribly.
pehaada 8y ago
We are about to give up on Groups. It is like a stray dog for google. The filtering is hit of miss with groups. Our internal help desk gets 1-2 google group issues / week from our user-base of 70 employees.

egggo 8y ago

It requires JavaScript enabled to read text...

jakeogh 8y ago

Google has an excellent track record closing services, but this one is an outlier. No JS fallback, difficult to scrape, par google, par.