3 ms·

Author here. I don't think it's malice on their part, but their hammer is too big to be wielded so carelessly.

by gomox 6y ago

freedomben 6y ago
Yes I agree with you (and thank you for your medium post by the way. Our only chance of ever improving the situation is to call attention to it. I fully believe Google leadership has to be aware of it at this point, but it clearly won't be a priority to them to fix until the public backlash/pressure is great enough that they have to). Just to avoid any misreading, I didn't say I thought it was malice on Google's part. My opinion (as mentioned above, is): > I still don't think it's outright malice, but the doubling down on these horrific practices (algorithmically and opaquely destroying people) is so egregious that it doesn't really matter. So they are not (at least in my opinion without seeing evidence to the contrary) outright malicious. But from the perspective of a site owner, I think they should be considered as such and therefore mitigations and defense should be a part of your planning (disaster recovery, etc).
- fakedang 6y ago
  I do not trust management folks, whose paychecks and promotions are dependent on how successful such hostile actions are, to take the right decisions. I also do not think that they are deliberately ignorant/indifferent or that calling attention to it will do any good. These types of individuals got to where they are largely by knowing fully well that their actions are malicious and legal. I used to work under such people, and currently interact with and work with such people on a very regular basis (you could even consider me as part of them tbh). It is very much possible that the management level folks at Google don't have an ounce of goodness in them, and will always see such decisions from a zero-sum perspective. To make it relatable, do you care so much for a mosquito if it's buzzing around you, disrupting your work and taking a toll on your patience? Because your SaaS is a mosquito to Google. After a certain point, you will want to kill the mosquito, and that's exactly what Google execs think so as to get to their next paycheck.
JPKab 6y ago
Great article. It’s not malice, it’s indifference. Googles execs and veeps don’t care about small businesses, because most are career ladder climbers who went straight from elite colleges to big companies. Conformists who won’t ever know what it’s like to be a startup. As a group, empathy isn’t a thing for them.
- nsgi 6y ago
  Don't a lot of startup founders go to elite colleges and come from big companies?
  - wolco5 6y ago
    The funded ones with the 2 year timelines generally are. But most startups are more bootstrap/angel investor with a bright owner who has a fatal flaw.
    - 90minuteAPI 6y ago
      Is this an excerpt from your woefully unpublished startup culture fanfic novella? You can't just leave us hanging.
lucasverra 6y ago
Agree, we can only vote with our clicks. Sadly gmail and google docs are top notch products :(
- bborud 6y ago
  No, we can't vote with our clicks. That's what it means when a handful of companies dominate most of the web and the web playing a dominant role in global economy. We have very little real choice. Occasionally people will pretend this is not so. In particular those who can't escape the iron grasp these companies have on the industry. Whose success depends on being in good standing with these companies. Or those whose financial interests strongly align with the fortunes of these dominant players. I own stock in several of these companies. You could call it hypocrisy, or you could even view it as cynicism. I choose to see it as realism. I have zero influence over what the giants do, and I do have to manage my modest investments in the way that makes the most financial sense. These companies have happened to be very good investments over the last decade. And I guess I am not alone in this. I guess what most of us are waiting for is the regulatory bodies to take action. So we don't have to make hard choices. Governments can make a real difference. That they so far haven't made any material difference with their insubstantial mosquito bites doesn't mean we don't hold out some hope they might. One day. Even though the chances are indeed very nearly zero. What's the worst that can happen to these companies? Losing an antitrust lawsuit? Oh please. There are a million ways to circumvent this even if the law were to come down hard on them. They can appeal, delay, confuse and wear down entire governments. If they are patient enough they can even wait until the next election - either hoping, or greasing the skids, for a more "friendly" government. They do have the power to curate the reality perceived by the masses. Let's not forget that. Eventually, like any powerful industry they will have lobbyists write the laws they want, and their bought and paid for politicians drip them into legislation as innocent little riders. We can't vote with our clicks. We really can't in any way that matters. That being said, I also would like regulatory bodies to step in and do something about it. To level the playing field. If nothing else, to create more investment opportunities.
  - pault 6y ago
    Do you think the 1982 breakup of AT&T would have been possible in today's political reality?
oji0hub 6y ago
They have the option of not wielding the hammer. I for one never appointed them the guardian of the walled internet.
- yuriko_boyko 6y ago
  This. Why is there an implicit agreement that okay Google is the gatekeeper. It shouldn't be. The internet did not appoint Google as the gatekeeper.
  - LordDragonfang 6y ago
    >The internet did not appoint Google as the gatekeeper. Uh, it kind of did, when internet-savvy early adopters (and developers) convinced all their friends, then family, then acquaintances, to switch to Chrome a decade ago. I know there's probably a very large number of FOSS-only types on this site who would disagree with that assessment, and claim that they've always been in the Firefox camp, but the sheer market share of chrome clearly shows that they are the minority. Everyone switched to chrome because they were tired of IE having too much power and not conforming to standards. Nowadays web devs often build chrome-first, using chromium-only features, and the shoe has almost migrated to the other foot.
  - TulliusCicero 6y ago
    > Why is there an implicit agreement that okay Google is the gatekeeper. Because they run a popular browser and don't want their users getting scammed? For each tech savvy person mad about this, there's 10 non-tech-savvy people completely oblivious that could get scammed by phishing sites we'd consider obvious. Sure, they should do a better job, but that blacklist is probably millions of websites big at this point. It's the kind of thing where a perfect job is essentially impossible, and the scale means that even doing a decent job is going to be extremely difficult.
- remus 6y ago
  > I for one never appointed them the guardian of the walled internet. On the other hand, lots of chrome users most likely do trust google to protect them from phishing sites. For those ~3 billion users a false positive on some SaaS they've never heard of is a small price to pay. It's a tricky moral question as to what level of harm to businesses is an acceptable trade off for the security of those users.
treis 6y ago
IMHO, it sounds like it worked. The things you changed sound like it's made your site more secure. In the future, Googles hammer can be a bit more precise since you've segregated data. And you don't know what triggered it. It's possible that one of your clients was compromised or one of their customers was trying to use the system to distribute malware.
- gomox 6y ago
  It's only more secure from Google's blacklist hammer. No significant security is introduced by splitting our company's properties into a myriad of separate domains. This type of incident can be a deadly blow to a B2B SaaS company since you are essentially taking out an uptime sensitive service that a lot of times has downtime penalties written down in a contract. Whether this is downtime will depend on how exactly the availability definition is written.
  - hirsin 6y ago
    To add to this - by splitting and moving domains you've hurt your search rank, eliminated the chance to share cookies (auth, eg) between these domains, and are now subject to new cross-domain security dings in other tooling. Lose-lose.
    - treis 6y ago
      We're talking about user uploads into a ticket system. They should not be publicly available at all. It won't hurt search rank.
  - treis 6y ago
    If you split up your user uploaded material into per client subdomains you will know which one is uploading the malicious files. And your clients can block other subdomains limiting their exposure as well. Is it a huge improvement? No, but at least it's something
    - gomox 6y ago
ehsankia 6y ago
Is this list only maintained by Google? Do Firefox and Bing use the same list, is their process better/different? Is there any sharing happening?
- freeone3000 6y ago
  SmartScreen is a different list. (And has a "This website isn't malicious!" button.)
pnw_hazor 6y ago
That is malice. Accidentally unleashing a process that harms people is negligence. Not caring that you are being negligent is malice.
mr_toad 6y ago
Have you considered not using a 3rd party for hosting your JavaScript? There is always going to be some risk if the code isn’t under your control.

Author here. I don't think it's malice on their part, but their hammer is too big to be wielded so carelessly.

by gomox 6y ago

Author here. I don't think it's malice on their part, but their hammer is too big to be wielded so carelessly.

Yes I agree with you (and thank you for your medium post by the way. Our only chance of ever improving the situation is to call attention to it. I fully believe Google leadership has to be aware of it at this point, but it clearly won't be a priority to them to fix until the public backlash/pressure is great enough that they have to). Just to avoid any misreading, I didn't say I thought it was malice on Google's part. My opinion (as mentioned above, is): > I still don't think it's outright malice, but the doubling down on these horrific practices (algorithmically and opaquely destroying people) is so egregious that it doesn't really matter. So they are not (at least in my opinion without seeing evidence to the contrary) outright malicious. But from the perspective of a site owner, I think they should be considered as such and therefore mitigations and defense should be a part of your planning (disaster recovery, etc).

fakedang 6y ago
I do not trust management folks, whose paychecks and promotions are dependent on how successful such hostile actions are, to take the right decisions. I also do not think that they are deliberately ignorant/indifferent or that calling attention to it will do any good. These types of individuals got to where they are largely by knowing fully well that their actions are malicious and legal. I used to work under such people, and currently interact with and work with such people on a very regular basis (you could even consider me as part of them tbh). It is very much possible that the management level folks at Google don't have an ounce of goodness in them, and will always see such decisions from a zero-sum perspective. To make it relatable, do you care so much for a mosquito if it's buzzing around you, disrupting your work and taking a toll on your patience? Because your SaaS is a mosquito to Google. After a certain point, you will want to kill the mosquito, and that's exactly what Google execs think so as to get to their next paycheck.

JPKab 6y ago

Great article. It’s not malice, it’s indifference. Googles execs and veeps don’t care about small businesses, because most are career ladder climbers who went straight from elite colleges to big companies. Conformists who won’t ever know what it’s like to be a startup. As a group, empathy isn’t a thing for them.

nsgi 6y ago
Don't a lot of startup founders go to elite colleges and come from big companies?
- wolco5 6y ago
  The funded ones with the 2 year timelines generally are. But most startups are more bootstrap/angel investor with a bright owner who has a fatal flaw.
  - 90minuteAPI 6y ago
    Is this an excerpt from your woefully unpublished startup culture fanfic novella? You can't just leave us hanging.

lucasverra 6y ago

Agree, we can only vote with our clicks. Sadly gmail and google docs are top notch products :(

bborud 6y ago
No, we can't vote with our clicks. That's what it means when a handful of companies dominate most of the web and the web playing a dominant role in global economy. We have very little real choice. Occasionally people will pretend this is not so. In particular those who can't escape the iron grasp these companies have on the industry. Whose success depends on being in good standing with these companies. Or those whose financial interests strongly align with the fortunes of these dominant players. I own stock in several of these companies. You could call it hypocrisy, or you could even view it as cynicism. I choose to see it as realism. I have zero influence over what the giants do, and I do have to manage my modest investments in the way that makes the most financial sense. These companies have happened to be very good investments over the last decade. And I guess I am not alone in this. I guess what most of us are waiting for is the regulatory bodies to take action. So we don't have to make hard choices. Governments can make a real difference. That they so far haven't made any material difference with their insubstantial mosquito bites doesn't mean we don't hold out some hope they might. One day. Even though the chances are indeed very nearly zero. What's the worst that can happen to these companies? Losing an antitrust lawsuit? Oh please. There are a million ways to circumvent this even if the law were to come down hard on them. They can appeal, delay, confuse and wear down entire governments. If they are patient enough they can even wait until the next election - either hoping, or greasing the skids, for a more "friendly" government. They do have the power to curate the reality perceived by the masses. Let's not forget that. Eventually, like any powerful industry they will have lobbyists write the laws they want, and their bought and paid for politicians drip them into legislation as innocent little riders. We can't vote with our clicks. We really can't in any way that matters. That being said, I also would like regulatory bodies to step in and do something about it. To level the playing field. If nothing else, to create more investment opportunities.
- pault 6y ago
  Do you think the 1982 breakup of AT&T would have been possible in today's political reality?

oji0hub 6y ago

They have the option of not wielding the hammer. I for one never appointed them the guardian of the walled internet.

yuriko_boyko 6y ago
This. Why is there an implicit agreement that okay Google is the gatekeeper. It shouldn't be. The internet did not appoint Google as the gatekeeper.
- LordDragonfang 6y ago
  >The internet did not appoint Google as the gatekeeper. Uh, it kind of did, when internet-savvy early adopters (and developers) convinced all their friends, then family, then acquaintances, to switch to Chrome a decade ago. I know there's probably a very large number of FOSS-only types on this site who would disagree with that assessment, and claim that they've always been in the Firefox camp, but the sheer market share of chrome clearly shows that they are the minority. Everyone switched to chrome because they were tired of IE having too much power and not conforming to standards. Nowadays web devs often build chrome-first, using chromium-only features, and the shoe has almost migrated to the other foot.
- TulliusCicero 6y ago
  > Why is there an implicit agreement that okay Google is the gatekeeper. Because they run a popular browser and don't want their users getting scammed? For each tech savvy person mad about this, there's 10 non-tech-savvy people completely oblivious that could get scammed by phishing sites we'd consider obvious. Sure, they should do a better job, but that blacklist is probably millions of websites big at this point. It's the kind of thing where a perfect job is essentially impossible, and the scale means that even doing a decent job is going to be extremely difficult.
remus 6y ago
> I for one never appointed them the guardian of the walled internet. On the other hand, lots of chrome users most likely do trust google to protect them from phishing sites. For those ~3 billion users a false positive on some SaaS they've never heard of is a small price to pay. It's a tricky moral question as to what level of harm to businesses is an acceptable trade off for the security of those users.

treis 6y ago

IMHO, it sounds like it worked. The things you changed sound like it's made your site more secure. In the future, Googles hammer can be a bit more precise since you've segregated data. And you don't know what triggered it. It's possible that one of your clients was compromised or one of their customers was trying to use the system to distribute malware.

gomox 6y ago
It's only more secure from Google's blacklist hammer. No significant security is introduced by splitting our company's properties into a myriad of separate domains. This type of incident can be a deadly blow to a B2B SaaS company since you are essentially taking out an uptime sensitive service that a lot of times has downtime penalties written down in a contract. Whether this is downtime will depend on how exactly the availability definition is written.
- hirsin 6y ago
  To add to this - by splitting and moving domains you've hurt your search rank, eliminated the chance to share cookies (auth, eg) between these domains, and are now subject to new cross-domain security dings in other tooling. Lose-lose.
  - treis 6y ago
    We're talking about user uploads into a ticket system. They should not be publicly available at all. It won't hurt search rank.
- treis 6y ago
  If you split up your user uploaded material into per client subdomains you will know which one is uploading the malicious files. And your clients can block other subdomains limiting their exposure as well. Is it a huge improvement? No, but at least it's something
  - gomox 6y ago

ehsankia 6y ago

Is this list only maintained by Google? Do Firefox and Bing use the same list, is their process better/different? Is there any sharing happening?

freeone3000 6y ago
SmartScreen is a different list. (And has a "This website isn't malicious!" button.)

pnw_hazor 6y ago

That is malice. Accidentally unleashing a process that harms people is negligence. Not caring that you are being negligent is malice.

mr_toad 6y ago

Have you considered not using a 3rd party for hosting your JavaScript? There is always going to be some risk if the code isn’t under your control.