5 ms·

Google makes breaking change to publishing Sheets as data

90 points by donohoe 6y ago

gaogao 6y ago
Reminds me of the CORS issue from few months back - https://support.google.com/docs/thread/56845119?hl=en https://support.google.com/docs/thread/56845119?hl=en
etaioinshrdlu 6y ago
Wow! I used this api a few months ago and it was really helpful. Of course I knew it was undocumented and could break at any time; here we are.
simonh 6y ago
Sharing resources from web applications securely is hard work. It doesn’t surprise me at all that they end up having to lock down some forms of access from time to time. Most likely they found a vulnerability and this was a side effect of mitigating it.
jakear 6y ago
Link requires google account, anyone have a synopsis?
- advisedwang 6y ago
  Someone reported the bug, a @google.com replies verifying they reproduced it and have forwarded internally (attaching a private "blocked by" bug). So it sounds like they accept this is an issue.
  - brundolf 6y ago
    Note that a comment further down says: > I have heard that this appears to not be a bug, rather an intentional change that they didn't announce in advance. Not sure where "I have heard" comes from, but
- diabeetusman 6y ago
  Created issue. A short description of the issue: Private Sheet public CSV export requires authentication when set not to What steps will reproduce the problem? 1. create a private(!) Google Sheet 2. set public CSV export publication 3. access the endpoint without credentials What is the expected output? What do you see instead? If you see error messages, please provide them. You should receive a CSV file, you get HTML5 login form. Please provide any additional information below. Setting the Sheet to Public with a link fixes the problem, there's an obvious bug with the permissions taken from the Sheet, not the Export.
  - jakear 6y ago
    Thanks! Perhaps the issuetracker and sheets teams will be able to work together on a new permission-less access policy. ;)
dmje 6y ago
Is this what broke http://timeline.knightlab.com/ http://timeline.knightlab.com/ ?
danso 6y ago
Huh, so when it comes to getting a URL to sheets as CSV, going through the GUI (i.e. going into the Publish to Web dialog) is no better than just using the endpoint of `https://docs.google.com/spreadsheets/d/KEY/export?format=csv&gid=SHEET_ID https://docs.google.com/spreadsheets/d/KEY/export?format=csv...`, which also requires authentication if the underlying sheet is set to private.
brundolf 6y ago
This broke our production app last week. The only solution was to move our CSVs off of Sheets completely.
- crazygringo 6y ago
  Why? Couldn't you have just set them to public view access? Seems like it would have been a drastically simpler change.
  - brundolf 6y ago
    We didn't know about that workaround at the time, we just needed to get our app back online.
  - brudgers 6y ago
    Removing an external dependency on Google is a sound engineering choice for many use cases (and maybe not for others). One reason it might a sound engineering choice is what happened here. Sure moving off Google is work. So is implementing the work around. Breaking changes always either require work or make user code obsolete. Breaking changes generate work for users. They externalize the cost of making changes non-breaking to end users.
    - brundolf 6y ago
      Fortunately it was a transition we'd already talked about making; we were approaching that threshold where the agility/reliability tradeoff was about to flip. But still, it sucked having a few hours of unexpected downtime while we scrambled to make the change.
  - djtriptych 6y ago
    OR a CI step using the docs CLI?
johnklos 6y ago
Google not giving a shit is news?
- c0achmcguirk 6y ago
  Huh? Where did you get that?
  - voodootrucker 6y ago
    Despite being sarcastically phrased, the GP is very warranted. Google is so renowned for making breaking changes, there's a site to track not just their dead code, but their dead products: https://killedbygoogle.com/ https://killedbygoogle.com/ I think experienced engineers have learned not to depend on Google a long time ago, and the GP is stressing that lesson: this is not "news" in that it happens _very_ frequently. Also, for the company that invented the protobuf IDL, you'd expect them to maybe use swagger to catch these things in an automated fashion, if they have admitted it's a bug by accepting a support ticket for it.
breck 6y ago
At the same time looks like they've updated this page (https://www.google.com/search/howsearchworks/mission/ https://www.google.com/search/howsearchworks/mission/): "Our company mission is to organize the world's information and make it universally accessible and useful, as long as you are logged in and we can show you personalized ads".
gowld 6y ago
Title "Google makes breaking change to publishing Sheets as data" is slightly misleading/speculative as to intent. Linked page title is "Private Sheet public CSV export requires authentication" with a reply from Google: "This has been forwarded internally, any updates will be posted here."
iamsungminpark 6y ago
This also broke my dashboard... which got bunch of data from spreadsheet :/
ineedasername 6y ago
Shouldn't an integration that relied on this sort of things simply have been done properly using the sheets API to begin with? The bug to me seems that it was ever possible to access data in a private sheet without authentication.

90 points by donohoe 6y ago

Reminds me of the CORS issue from few months back - https://support.google.com/docs/thread/56845119?hl=en https://support.google.com/docs/thread/56845119?hl=en

etaioinshrdlu 6y ago

Wow! I used this api a few months ago and it was really helpful. Of course I knew it was undocumented and could break at any time; here we are.

simonh 6y ago

Sharing resources from web applications securely is hard work. It doesn’t surprise me at all that they end up having to lock down some forms of access from time to time. Most likely they found a vulnerability and this was a side effect of mitigating it.

jakear 6y ago

Link requires google account, anyone have a synopsis?

advisedwang 6y ago
Someone reported the bug, a @google.com replies verifying they reproduced it and have forwarded internally (attaching a private "blocked by" bug). So it sounds like they accept this is an issue.
- brundolf 6y ago
  Note that a comment further down says: > I have heard that this appears to not be a bug, rather an intentional change that they didn't announce in advance. Not sure where "I have heard" comes from, but
diabeetusman 6y ago
Created issue. A short description of the issue: Private Sheet public CSV export requires authentication when set not to What steps will reproduce the problem? 1. create a private(!) Google Sheet 2. set public CSV export publication 3. access the endpoint without credentials What is the expected output? What do you see instead? If you see error messages, please provide them. You should receive a CSV file, you get HTML5 login form. Please provide any additional information below. Setting the Sheet to Public with a link fixes the problem, there's an obvious bug with the permissions taken from the Sheet, not the Export.
- jakear 6y ago
  Thanks! Perhaps the issuetracker and sheets teams will be able to work together on a new permission-less access policy. ;)

dmje 6y ago

Is this what broke http://timeline.knightlab.com/ http://timeline.knightlab.com/ ?

danso 6y ago

Huh, so when it comes to getting a URL to sheets as CSV, going through the GUI (i.e. going into the Publish to Web dialog) is no better than just using the endpoint of `https://docs.google.com/spreadsheets/d/KEY/export?format=csv&gid=SHEET_ID https://docs.google.com/spreadsheets/d/KEY/export?format=csv...`, which also requires authentication if the underlying sheet is set to private.

brundolf 6y ago

This broke our production app last week. The only solution was to move our CSVs off of Sheets completely.

crazygringo 6y ago
Why? Couldn't you have just set them to public view access? Seems like it would have been a drastically simpler change.
- brundolf 6y ago
  We didn't know about that workaround at the time, we just needed to get our app back online.
- brudgers 6y ago
  Removing an external dependency on Google is a sound engineering choice for many use cases (and maybe not for others). One reason it might a sound engineering choice is what happened here. Sure moving off Google is work. So is implementing the work around. Breaking changes always either require work or make user code obsolete. Breaking changes generate work for users. They externalize the cost of making changes non-breaking to end users.
  - brundolf 6y ago
    Fortunately it was a transition we'd already talked about making; we were approaching that threshold where the agility/reliability tradeoff was about to flip. But still, it sucked having a few hours of unexpected downtime while we scrambled to make the change.
- djtriptych 6y ago
  OR a CI step using the docs CLI?

johnklos 6y ago

Google not giving a shit is news?

c0achmcguirk 6y ago
Huh? Where did you get that?
- voodootrucker 6y ago
  Despite being sarcastically phrased, the GP is very warranted. Google is so renowned for making breaking changes, there's a site to track not just their dead code, but their dead products: https://killedbygoogle.com/ https://killedbygoogle.com/ I think experienced engineers have learned not to depend on Google a long time ago, and the GP is stressing that lesson: this is not "news" in that it happens _very_ frequently. Also, for the company that invented the protobuf IDL, you'd expect them to maybe use swagger to catch these things in an automated fashion, if they have admitted it's a bug by accepting a support ticket for it.

breck 6y ago

At the same time looks like they've updated this page (https://www.google.com/search/howsearchworks/mission/ https://www.google.com/search/howsearchworks/mission/): "Our company mission is to organize the world's information and make it universally accessible and useful, as long as you are logged in and we can show you personalized ads".

gowld 6y ago

Title "Google makes breaking change to publishing Sheets as data" is slightly misleading/speculative as to intent. Linked page title is "Private Sheet public CSV export requires authentication" with a reply from Google: "This has been forwarded internally, any updates will be posted here."

iamsungminpark 6y ago

This also broke my dashboard... which got bunch of data from spreadsheet :/

ineedasername 6y ago

Shouldn't an integration that relied on this sort of things simply have been done properly using the sheets API to begin with? The bug to me seems that it was ever possible to access data in a private sheet without authentication.