6 ms·

Then you should have have press release that says “We screwed up, we’re sorry, and we won’t delete your accounts any more”, instead of all this many-lawyered ga

Then you should have have press release that says “We screwed up, we’re sorry, and we won’t delete your accounts any more”, instead of all this many-lawyered garbage about “account management policies”, words that no one is interested in. This post has 7 comments and 11 points after an hour. Compare that to the post that led to this outcome. If your trying to reassure the market that you don’t delete a companies entire back end infrastructure then yes this meets some internal management butt covering goal, but does not tell the market definitively that google cloud no longer deletes your entire computer systems.

TheIronYuppie 8y ago
While we debated that exact thing for a long time, the reality was that we knew customers would want to dig deeper and understand HOW we wouldn't let it happen again. We tried to do that here. We tried not to make it sound too lawyerly, but I'll definitely take your feedback internally. Disclosure: I work at Google on Google Cloud.
- hguhghuff 8y ago
  Amazon does not delete your account as far as I know until some extreme has been reached. You guys need to understand the scale of distrust this issue raises. If you want to fix it, give up on putting lawyers and spin doctors up front. Instead, give this disastrous issue the response it deserves and get the CEO and Chairman of google to make s loud, clear and focused apology and say loudly that we do not delete your entire computer systems over account payment issues until defcon 3 is reached. Why the F would I build my SAAS business on google cloud without that message being yelled repeatedly and loudly and clear from the top level of the company, as much so Google understands it as the market understands it. And by the way, I pay ALL my cloud accounts on credit card. I note carefully that at google this means I have a higher chance of having my entire computer systems deleted than if I use some other payment mechanism. Your policy here appears to me to be using systems deletion add leverage to get me off credit card payment. All of which says to me that google still just doesn’t get it.
  - roblabla 8y ago
    Amazon locked out a seller's account because they changed their Kindle's profile name to "Daddy" (in Chinese). Amazon asked for the seller's ID with that new name, and no amount of support escalation was enough to fix it[0]. It took an absurd amount of bad PR for them to come out and fix it. Google is bad, but Amazon is really just as bad. They both have absurd policies with no recourse, that work in the 80% case and fail very badly in the 20% left. [0] https://www.reddit.com/r/amazon/comments/5gvgdl/using_a_amazon_kindle_fire_destroyed_my/ https://www.reddit.com/r/amazon/comments/5gvgdl/using_a_amaz...
    - saurik 8y ago
      Amazon Web Services is essentially unrelated as a business from Amazon.com. This is even less relevant than someone trying to compare the policies of some random end-user service like Google Photos with Google Cloud Platform. I personally had serious issues (not account suspension problems, but an inability to get things like basic tax paperwork to correct addresses) with Amazon Flexible Payments (which was part of some seemingly unrelated-to-everyone division), but I count absolutely none of them against AWS (which wasn't involved in running the service).
      - ikeboy 8y ago
        I once signed up for AWS, they couldn't verify the card on initial signup and the entire account got blocked, including a login to a seller account that was doing 6 figures/month. Amazon has a big issue in that all their services are linked to a single Amazon account, and if that account is blocked you can be prevented from accessing entirely unrelated services. In that case, maybe it was ok to suspend a brand new AWS account until accounts could be verified, but the linked accounts that were also blocked should have been looked at manually because of their volume.
        rajacombinator 8y ago
        Yep I’ve also had absurd cross Amazon-AWS payment issues they were unable to fix for months. Their ultimate solution “uhhh make a new account.”
- hguhghuff 8y ago
  The worst that happened to me on amazon when I had credit card issues is that I could no longer make changes in the developer console and instead was forced to contact amazon accounts to resolve the issue. I could still see everything and all my systems continued running.
  - TheIronYuppie 8y ago
    As you can see above, I was given three days on AWS to fax (!!!) proof of identity or my account would be deleted.
- zajd 8y ago
  > We tried not to make it sound too lawyerly Who's we? Did you have a part in writing this? What does "not make it sound too lawyerly" even mean? This press release screams "we made a mistake but we're going to use paragraph after paragraph to ensure we don't actually say that". I have a hard time believing that the people who make up the Google Cloud team don't recognize this.
- misterbowfinger 8y ago
  Thanks for the replies. Despite the incessant whining that can happen on HN, I assure you that there's many here who appreciate the response. I'm sure it was a big deal for your team. While you're right people will want an actual plan on how things are going to change, they also want a genuine expression of contrition. As hguhghuff noted, deleting someone's business is a serious, serious issue. The _only_ admissions of guilt or wrongdoing was were these lines: "Here’s what we are doing to be as good as our word, and provide a more careful, accurate, thoughtful and empathetic account management experience for our GCP customers." "We sincerely apologize to all our customers who’ve been concerned or had to go through a service reinstatement. Please keep the feedback coming, we’ll work to continue to earn your trust every day." Which, if you yourself were scared that your livelihood could be wiped away, would you think that was a sufficient apology? It doesn't help that Google tends to lack a human touch when it comes to its image. But here, now, you all have an opportunity to change that. I know it sounds "politics" or "public relations" or whatever, but all we need to know is that you fully understand the fear GCP customers felt and what that means for us.
- becauseiam 8y ago
  Let me break down exactly why I think the language in what appears to be a lawyer-driven PR pot-bashing is so terrible, because if your plan was to go back to internal G+ with "someone on HN said a lawyer wrote it" little will probably change. > Established GCP customers... > Online customers with established payment history... What exactly qualifies as being "established"? In the first example, additional stipulations around billing arrangements are imposed, but in the latter it remains unclear. > ...review for flagged fraud accounts... > ...event that fraud or account compromise activity is detected... You gotta stop using the f-bomb like that. This piece is supposed to be a follow on to a story of a customer who apparently was conducting completely non-fraudulent activity within their account. Your copy should, like your culture, assume "innocent until proven guilty". Saying something is "flagged for fraud" in a PR piece breaks that rule. > We will provide ways for customers to pre-verify their accounts with us if they desire... Sounds very passive-aggressively optional. Nor does it tell me what I actually gain here, or even a hint of what might be involved for verification or how potentially simple or easy it may or may not be - do I need my counsel to post via registered service on company letterhead confirmation of my organisation's official trading details, or do I click an link in an email? > There are also steps that customers can take to help us protect their accounts including... The word "protect" is suitable if you were a bank, and you wanted to encourage customer behaviour to prevent them being victims to fraudsters. But you're not, so really this language is suggesting customers need to "protect" themselves from your algorithms and automated systems, which is kind of inappropriate to be saying.
  - ebikelaw 8y ago
    I suspect they'll treat it as a secret since telling you the magic formula for established accounts will compromise their anti-abuse regime. It is the same reason there are no docs about how to become a high-reputation email origin from Gmail's perspective. It's a trade secret.
    - kajecounterhack 8y ago
      > they'll treat it as a secret since telling you the magic formula for established accounts will compromise their anti-abuse regime This is accurate. >> Online customers with established payment history... > What exactly qualifies as being "established"? In the first example, additional stipulations around billing arrangements are imposed, but in the latter it remains unclear. They can't tell you. Bad actors will even binary search the parameters of your fraud detection (source: I worked in fraud detection). Minimizing the information feedback loop to the baddies is super important to avoid becoming a loss function they can optimize against. This is true of every fraud department. Abuse detection is cat-and-mouse. Say as a provider I track your true IP through proxies by embedding some flash that calls home. You figure it out and block flash or do some clever sandboxing. I work with proxy providers to build blacklists. You somehow get the blacklist and just avoid all proxies on it. Etc etc.
- CodeWriter23 8y ago
  > While we debated that exact thing for a long time, the reality was that we knew customers would want to dig deeper and understand HOW we wouldn't let it happen again. One saying I’m sorry isn’t an amends. Neither is offering a contrition-free remedy for past bad acts. Amends requires both contrition and a remedy. For example, inserting the following (or anything similar) after the first sentence would have demonstrated some contrition: “We have truly been humbled by our prior lack of insight, and we are very sorry for what happened to any customers affected in any way by our shortcomings in this area. We realize we need to regain your trust and with that in mind, have thoughtfully examined all the feedback we received.” Learning you all actually thought it through and consciously chose to save face does not inspire confidence. Nor does the underlying subtext that customers big enough to pay by check and get an account rep get a free pass, while little bootstrapped guys like me can still have the hammer dropped on them, albeit with slightly more scrutiny than last week.
  - TheIronYuppie 8y ago
    I understand, and, though it's not in the original post, I will say again. We screwed up. We are really sorry. This was a confluence of unexpected events that slipped through our systems (which included both humans and algorithms). We know it will take a long time to rebuild the trust we've burned, and we are committed to doing it. In addition, as I said earlier, the options to ensure that you have additional protection (WHICH YOU SHOULDN'T HAVE TO DO, I'M JUST OFFERING IT) are at no cost: - Provide a valid phone number where we can reach you in the event of suspicious activity on your account. - Provide one or more billing admins to your account. - Provide a secondary payment method in case there are problems charging your primary method. - Contact our sales team to see if you qualify for invoice billing instead of relying on credit cards (this is much lower than you would generally think)

TheIronYuppie 8y ago

While we debated that exact thing for a long time, the reality was that we knew customers would want to dig deeper and understand HOW we wouldn't let it happen again. We tried to do that here. We tried not to make it sound too lawyerly, but I'll definitely take your feedback internally. Disclosure: I work at Google on Google Cloud.

hguhghuff 8y ago
Amazon does not delete your account as far as I know until some extreme has been reached. You guys need to understand the scale of distrust this issue raises. If you want to fix it, give up on putting lawyers and spin doctors up front. Instead, give this disastrous issue the response it deserves and get the CEO and Chairman of google to make s loud, clear and focused apology and say loudly that we do not delete your entire computer systems over account payment issues until defcon 3 is reached. Why the F would I build my SAAS business on google cloud without that message being yelled repeatedly and loudly and clear from the top level of the company, as much so Google understands it as the market understands it. And by the way, I pay ALL my cloud accounts on credit card. I note carefully that at google this means I have a higher chance of having my entire computer systems deleted than if I use some other payment mechanism. Your policy here appears to me to be using systems deletion add leverage to get me off credit card payment. All of which says to me that google still just doesn’t get it.
- roblabla 8y ago
  Amazon locked out a seller's account because they changed their Kindle's profile name to "Daddy" (in Chinese). Amazon asked for the seller's ID with that new name, and no amount of support escalation was enough to fix it[0]. It took an absurd amount of bad PR for them to come out and fix it. Google is bad, but Amazon is really just as bad. They both have absurd policies with no recourse, that work in the 80% case and fail very badly in the 20% left. [0] https://www.reddit.com/r/amazon/comments/5gvgdl/using_a_amazon_kindle_fire_destroyed_my/ https://www.reddit.com/r/amazon/comments/5gvgdl/using_a_amaz...
  - saurik 8y ago
    Amazon Web Services is essentially unrelated as a business from Amazon.com. This is even less relevant than someone trying to compare the policies of some random end-user service like Google Photos with Google Cloud Platform. I personally had serious issues (not account suspension problems, but an inability to get things like basic tax paperwork to correct addresses) with Amazon Flexible Payments (which was part of some seemingly unrelated-to-everyone division), but I count absolutely none of them against AWS (which wasn't involved in running the service).
    - ikeboy 8y ago
      I once signed up for AWS, they couldn't verify the card on initial signup and the entire account got blocked, including a login to a seller account that was doing 6 figures/month. Amazon has a big issue in that all their services are linked to a single Amazon account, and if that account is blocked you can be prevented from accessing entirely unrelated services. In that case, maybe it was ok to suspend a brand new AWS account until accounts could be verified, but the linked accounts that were also blocked should have been looked at manually because of their volume.
      - rajacombinator 8y ago
        Yep I’ve also had absurd cross Amazon-AWS payment issues they were unable to fix for months. Their ultimate solution “uhhh make a new account.”
hguhghuff 8y ago
The worst that happened to me on amazon when I had credit card issues is that I could no longer make changes in the developer console and instead was forced to contact amazon accounts to resolve the issue. I could still see everything and all my systems continued running.
- TheIronYuppie 8y ago
  As you can see above, I was given three days on AWS to fax (!!!) proof of identity or my account would be deleted.
zajd 8y ago
> We tried not to make it sound too lawyerly Who's we? Did you have a part in writing this? What does "not make it sound too lawyerly" even mean? This press release screams "we made a mistake but we're going to use paragraph after paragraph to ensure we don't actually say that". I have a hard time believing that the people who make up the Google Cloud team don't recognize this.
misterbowfinger 8y ago
Thanks for the replies. Despite the incessant whining that can happen on HN, I assure you that there's many here who appreciate the response. I'm sure it was a big deal for your team. While you're right people will want an actual plan on how things are going to change, they also want a genuine expression of contrition. As hguhghuff noted, deleting someone's business is a serious, serious issue. The _only_ admissions of guilt or wrongdoing was were these lines: "Here’s what we are doing to be as good as our word, and provide a more careful, accurate, thoughtful and empathetic account management experience for our GCP customers." "We sincerely apologize to all our customers who’ve been concerned or had to go through a service reinstatement. Please keep the feedback coming, we’ll work to continue to earn your trust every day." Which, if you yourself were scared that your livelihood could be wiped away, would you think that was a sufficient apology? It doesn't help that Google tends to lack a human touch when it comes to its image. But here, now, you all have an opportunity to change that. I know it sounds "politics" or "public relations" or whatever, but all we need to know is that you fully understand the fear GCP customers felt and what that means for us.
becauseiam 8y ago
Let me break down exactly why I think the language in what appears to be a lawyer-driven PR pot-bashing is so terrible, because if your plan was to go back to internal G+ with "someone on HN said a lawyer wrote it" little will probably change. > Established GCP customers... > Online customers with established payment history... What exactly qualifies as being "established"? In the first example, additional stipulations around billing arrangements are imposed, but in the latter it remains unclear. > ...review for flagged fraud accounts... > ...event that fraud or account compromise activity is detected... You gotta stop using the f-bomb like that. This piece is supposed to be a follow on to a story of a customer who apparently was conducting completely non-fraudulent activity within their account. Your copy should, like your culture, assume "innocent until proven guilty". Saying something is "flagged for fraud" in a PR piece breaks that rule. > We will provide ways for customers to pre-verify their accounts with us if they desire... Sounds very passive-aggressively optional. Nor does it tell me what I actually gain here, or even a hint of what might be involved for verification or how potentially simple or easy it may or may not be - do I need my counsel to post via registered service on company letterhead confirmation of my organisation's official trading details, or do I click an link in an email? > There are also steps that customers can take to help us protect their accounts including... The word "protect" is suitable if you were a bank, and you wanted to encourage customer behaviour to prevent them being victims to fraudsters. But you're not, so really this language is suggesting customers need to "protect" themselves from your algorithms and automated systems, which is kind of inappropriate to be saying.
- ebikelaw 8y ago
  I suspect they'll treat it as a secret since telling you the magic formula for established accounts will compromise their anti-abuse regime. It is the same reason there are no docs about how to become a high-reputation email origin from Gmail's perspective. It's a trade secret.
  - kajecounterhack 8y ago
    > they'll treat it as a secret since telling you the magic formula for established accounts will compromise their anti-abuse regime This is accurate. >> Online customers with established payment history... > What exactly qualifies as being "established"? In the first example, additional stipulations around billing arrangements are imposed, but in the latter it remains unclear. They can't tell you. Bad actors will even binary search the parameters of your fraud detection (source: I worked in fraud detection). Minimizing the information feedback loop to the baddies is super important to avoid becoming a loss function they can optimize against. This is true of every fraud department. Abuse detection is cat-and-mouse. Say as a provider I track your true IP through proxies by embedding some flash that calls home. You figure it out and block flash or do some clever sandboxing. I work with proxy providers to build blacklists. You somehow get the blacklist and just avoid all proxies on it. Etc etc.
CodeWriter23 8y ago
> While we debated that exact thing for a long time, the reality was that we knew customers would want to dig deeper and understand HOW we wouldn't let it happen again. One saying I’m sorry isn’t an amends. Neither is offering a contrition-free remedy for past bad acts. Amends requires both contrition and a remedy. For example, inserting the following (or anything similar) after the first sentence would have demonstrated some contrition: “We have truly been humbled by our prior lack of insight, and we are very sorry for what happened to any customers affected in any way by our shortcomings in this area. We realize we need to regain your trust and with that in mind, have thoughtfully examined all the feedback we received.” Learning you all actually thought it through and consciously chose to save face does not inspire confidence. Nor does the underlying subtext that customers big enough to pay by check and get an account rep get a free pass, while little bootstrapped guys like me can still have the hammer dropped on them, albeit with slightly more scrutiny than last week.
- TheIronYuppie 8y ago
  I understand, and, though it's not in the original post, I will say again. We screwed up. We are really sorry. This was a confluence of unexpected events that slipped through our systems (which included both humans and algorithms). We know it will take a long time to rebuild the trust we've burned, and we are committed to doing it. In addition, as I said earlier, the options to ensure that you have additional protection (WHICH YOU SHOULDN'T HAVE TO DO, I'M JUST OFFERING IT) are at no cost: - Provide a valid phone number where we can reach you in the event of suspicious activity on your account. - Provide one or more billing admins to your account. - Provide a secondary payment method in case there are problems charging your primary method. - Contact our sales team to see if you qualify for invoice billing instead of relying on credit cards (this is much lower than you would generally think)