5 ms·

This situation is obviously a casualty of desktop computer security abstractions (e.g. Apple’s sandboxing) leaking into web/oauth to the point of utter user co

This situation is obviously a casualty of desktop computer security abstractions (e.g. Apple’s sandboxing) leaking into web/oauth to the point of utter user confusion. The picker/chooser idea is interesting because it’s also mimicking how desktop sandboxing gives apps the ability to read any one file at the users discretion. My electron app supports importing XLS/CSV (bound by limitations of sandboxing) and have had users request Google Sheets support. A few weeks ago I built up a Sheets POC and I too was surprised with the v4 drive requirements. I agree with op, it seems silly to request full read permission when all I need is a list of metadata to integrate with the Sheets API. I’m trying to think ... does any desktop have a file API that has the ability to return only files of a certain kind (perhaps that app’s registered extension) while presenting the user with a dialog that makes sense for that context? It’s an interesting idea.

philprx 7y ago
If I was Google, and I would be doing this, it would be not based on security requirement but rather: CYA: so that users can't sue Google in case of wrongful usage of data by a bad app Uniformization / homogenization of permissions names. Reduction on the CPU load with removal of costly and non billable processing (eg structured queries). Ps: I've been a security guy for 30+ years.
- tlogan 7y ago
  If there is no threat from Office 365 then yes. However, Office 365 is the real threat and moves like this are not helping...
toyg 7y ago
Nothing to do with abstractions, everything to do with “streamlining” the Google backend to save on maintenance and running costs (which will instead accrue on the integrators’ side). If, by doing so, they also lose a bunch of minor integrations who cannot afford the new burden, further freeing resources, it’s even better. Google is the new ‘00s-Microsoft, they just don’t care.

philprx 7y ago

If I was Google, and I would be doing this, it would be not based on security requirement but rather: CYA: so that users can't sue Google in case of wrongful usage of data by a bad app Uniformization / homogenization of permissions names. Reduction on the CPU load with removal of costly and non billable processing (eg structured queries). Ps: I've been a security guy for 30+ years.

tlogan 7y ago
If there is no threat from Office 365 then yes. However, Office 365 is the real threat and moves like this are not helping...

toyg 7y ago

Nothing to do with abstractions, everything to do with “streamlining” the Google backend to save on maintenance and running costs (which will instead accrue on the integrators’ side). If, by doing so, they also lose a bunch of minor integrations who cannot afford the new burden, further freeing resources, it’s even better. Google is the new ‘00s-Microsoft, they just don’t care.