9 ms·

End of the road for Google Drive in Transmit

336 points by donatj 2y ago

mzagaja 2y ago
Google really is wrecking hell on third party integrations.
- Jyaif 2y ago
  "The fastest path to wealth is the construction of these digital platforms, where other people depend on you." - Eric Schmidt. Many products leads at Google seem to disagree!
  - indymike 2y ago
    Depends. Build it, get dependent developers, start charging dependent developers, ????, profit.
    - Lerc 2y ago
      ...Try and launch a new platform, Nobody trusts you, Platform Dies, Loss?
teruakohatu 2y ago
I am not sure smaller devs were given the option of self-scanning code. I always wondered what the point of that was, given that there is no way for Google to ensure that the scanned code was the version distributed, and even then, as soon as a minor update was released it would have been out of date.
- dewey 2y ago
  Because they don't care about security, it's compliance-checkbox-driven policies.
  - xp84 2y ago
    Bingo! The whole thing is for butt-covering purposes. It's just so that when something happens, Google can then say "We followed $STANDARDS_BODY Policy #420.69, so we can't be held responsible!" Theoretically even Panic would gain a little butt-covering from it too. "Look, this vulnerability was so hard to spot that even these very professional security auditors missed it 8 years in a row!" It's all still pretty worthless though imho.
teqsun 2y ago
Title on the blog is now (changed?): "End of the Road for Google Drive in Transmit" The being unfamiliar with Transmit the "and" gave me a startle
davedx 2y ago
> But then… a couple of months later, Google completely removed the option for us to scan our own code. Instead, to keep access to Google Drive, we would now have to pay one of Google’s business partners to conduct the review. What a racket. Smells downright anti-competitive The EU will have fun with this when it catches up.
- rammer 2y ago
  It wasn't even that expensive. Ada security audit from tekta in Spain was under 4k. There's nothing like a racket here. The list of certification agencies goes from KPMG at top end to smaller companies.
  - anakaine 2y ago
    4k is not expensive in enterprise terms, but in small bootstrapped startup terms it is absolutely expensive.
    - imhoguy 2y ago
      And the issue is the other corporations may likely follow, so you have to stack hefty audit sum every year for multiple monopolistic cloud vendors because you made some cheap documents scanner app with convenient storage options for your user.
  - davedx 2y ago
    They're partners, not just agencies you independently get to choose, right? That's what I'm getting at with the racket part. You don't get to interop with one of the biggest cloud providers in the world unless you complete commercial audits with one of their partners. Given the kind of collusion Google's shown itself capable of [1] do you really think this is all fair? [1] https://en.wikipedia.org/wiki/High-Tech_Employee_Antitrust_Litigation https://en.wikipedia.org/wiki/High-Tech_Employee_Antitrust_L...
- aaronharnly 2y ago
  Just as a data point, we paid $750 for one of these engagements (scan + some discussion about use cases etc) to one of Google's preferred providers. There were multiple options for providers.
fidotron 2y ago
There is a clear subtext to this and the Play Store changes: everyone interacting with the Google ecosystem is going to be pinned down and deanonymized with rights assigned based on legal identities. This will be done in the name of security. There is no freedom in who you trust here. The big question here is if all this was preemptive or the response to something.
- akira2501 2y ago
  All monopolies do this. Once they're past the point where the government can effectively regulate them they essentially take over and regulate the market for their own interests. Google is very good at this. They're probably better at this than actually writing code these days. Which is why anyone and everyone should flat out avoid them as a company.
teruakohatu 2y ago
The original title now reads “…for Google drive in Transmit”. @donatj can you correct the HN title please.
- donatj 2y ago
  Fixed
quantadev 2y ago
Never hitch your wagon to somebody else's horse. Entire companies have been destroyed because they rely on Amazon, Google, or some other service, and then have the rug pulled. Sometimes companies have even been destroyed, notably by Amazon, for having the wrong political viewpoints. My rule of thumb is: Only use open source components, and only run my stuff on Linux. So that way I maintain full control over my stack, and stay mostly immune from the political rug pulls, and other kinds of rug pulls.
- stavros 2y ago
  Some of these wagons only managed to move because they were hitched to someone else's horse.
  - gopher_space 2y ago
    My concern is that people aren't building their own horses the minute it becomes feasible. The farrier now seems mystical and occult to a generation even though they're more than capable of picking up the tools themselves.
    - stavros 2y ago
      You don't build things when it becomes feasible, you build things when it becomes less risky to build them than to not. For things like a convenience integration, that moment may never come. For other things, it's easy to estimate wrong, given how fuzzy the risks are.
- dewey 2y ago
  That sounds great, but also for an app that interacts with > 10 services and companies it's not really a good advice. > Only use open source components, and only run my stuff on Linux Most people don't have the luxury of never having to interact with Google Drive, MS Teams, Slack etc.
  - quantadev 2y ago
    Sure integration points to all that are great. The mistake is when your entire company can no longer function at all without Amazon AWS for example. I've worked at a place like that. EDIT: Of course if you're sure your politics are completely left-leaning you'll have no censorship worries, because these platforms are mostly Silicon Valley run. Also since conservatives basically don't play dirty in this way, the conservatives won't censor stuff just because it's left-leaning. We're for protecting freedom of all legal speech and actions.
dewey 2y ago
Even the "audit" they require for increasing something simple as your YouTube API quota is already annoying and a massive waste of time, and this is not even close to the one they are requiring from Panic. The quota increase process is roughly: 1) Fill out the same form every year from scratch 2) Send it into the black hole that's Google "support" 3) A few weeks later receive a reply from someone asking a irrelevant question to our use case 4) Two weeks later another person replies asking for screenshots of the "implementation", so you send a screenshot of "func storeTrailerMetadata()" 5) Another two weeks later, another automated person replies that you got approved.
- kyleee 2y ago
  The process is the punishment
  - jll29 2y ago
    That's a diamond of a quote; are you a student of Kafka's?
    - r2_pilot 2y ago
      It's from the eponymous 1979 book by Malcolm Feeley and may predate it
- t0mas88 2y ago
  The Google "support" black hole even exists for their high budget ad customers. I've seen a case where things went into the Google support black hole for a company spending a few million per month via DV360 / Google Ads. Nothing anyone could do about it, campaign blocked, work with "support" to fix it.
- 8338550bff96 2y ago
  Have the same experience with Microsoft support. The difference is the timeline is much shorter and when our issues don't get any traction our rep intervenes and escalates to engineers. I understand that level-1 support for these orgs are basically documentation librarians. Cool. We pay an incredible amount for premium support, but whatever. It's fine. What matters is that we have a rep that is engaged and cares about us being unblocked and isn't going to let us flounder for issues their support team is not going to solve. Have never seen this level of commitment from Google.
jonnybarnes 2y ago
Sounds similar to what iA Writer are going through: https://ia.net/topics/our-android-app-is-frozen-in-carbonite https://ia.net/topics/our-android-app-is-frozen-in-carbonite
- hoistbypetard 2y ago
  Sure does. The article even says, on the first screenful of text: > You may have seen iA Writer’s announcement that they are stopping development of their Android version for similar reasons. Our experience was different, but our circumstances are similar. While Google Drive may not be the most popular connection option in Transmit, we know many users rely on it, and we often use it here at Panic to send and receive files from the game developers we work with.
deleted 2y ago
[deleted]
addisonj 2y ago
Man... this stuff sucks. If I were panic, I would do the same... but I also wouldn't want to be the one at google to navigate this. With Google Drive now being at the center of so many companies for storing business data, I am certain it is a juicy target, and third party access with full access to read and write to that big hard drive full of proprietary data is one that I would understand want to lock down... but not like this? I don't think the market is anywhere near to shifting where business are going to dump google drive en masse, but as the ecosystem shrinks because so few companies can afford the cost to play in google's backyard, it does make me wonder how many companies are going to absolutely resent google, comparable to the way they resented oracle.
- dewey 2y ago
  > With Google Drive now being at the center of so many companies for storing business data, I am certain it is a juicy target, and third party access with full access to read and write to that big hard drive full of proprietary data is one that I would understand want to lock down... but not like this? Could be a Google Workspace policy where you can just set that employees can't access the corporate Drive account through third party apps, while it continues to work for personal accounts.
  - sadeshmukh 2y ago
    That's already how it works for workspace, in my experience.
resters 2y ago
I think if there is one "value" that stands out from Google's culture (as it is reflected onto its customers) it is tremendous lack of empathy. - Google maps appears to be designed by non-drivers. Much of hte time it is impossible to find out the name of cross streets near one's location by zooming in. Pins get added accidentally and are hard to categorize and find, there is no notion of neighborhoods, and the voice directions say the same redundant thing over and over (and it is often misleading). No intelligent person could design the product that way if they actually used it. - Google's parental control features in android lack granularity, and the bias is toward kids watching garbage content as there is no way to share curated lists or for creators to become curators of high quality youtube content, etc. For anyone with young kids this is a must have feature and Google has ignored this kind of thing for years. Also if your kid's phone dies there is no way to remove it from the FamilyLink app! Someone really tested it thoroughly! - Google Home / Nest. Exceptionally buggy devices. Basic functionality like shared speakers (all Nest over Nest wifi) are buggy and slow. "Hey Google" takes an extra few seconds to respond compared to Alexa and none of it is compatible with Google Advanced Security (Google's own feature!). Nobody building this tech is using it at home or else they would be furious about these big oversights. - Gemini in Gmail is a total dud. It can't tell me what upcoming events are listed in my email inbox. It biases toward searching the inbox, and GMail inbox search has been highly broken for years. I participated in a user study at Google a while back and the PM admitted it was broken and would not be fixed. Google is now a cash cow advertising business and thanks to Eric Schmidt (a brilliant but morally lacking individual) it has become a major defense contractor. Thanks to OpenAI and others, Google search is already dead. The market hasn't caught up with this yet. I sincerely regret making gmail my main email, as the company seems to have completely lost its way. In spite of a lot of brilliance the lack of empathy with users and the need to deliver products that solve problems continues to persist.
- artooro 2y ago
  It's almost like the incentives at Google are misaligned, who knew.
- FredPret 2y ago
  Probably a big part of the problem is this: - good engineers and managers earn well, especially in the US - they want to own premium products - where Google and Apple compete, Apple has gone for the premium end and Google has gone for the mass-market end - speculation: thus Google employees aren't living in their own ecosystem
hn_throwaway_99 2y ago
I wrote this response to another front page HN article on a similar topic: https://news.ycombinator.com/item?id=41664753 https://news.ycombinator.com/item?id=41664753 I know everyone loves to dunk on Google, and I definitely agree their communication and customer service to app developers is shite, but this change to permissions scope is a good thing. If you have full, unfettered access to large number of people's Google Drive data, you're a huge target for malevolent actors. If you can't afford the new audit requirements (which I've done and are quite easy - if anything I'm sympathetic to the argument that they're more "box ticking" than valuable security audits), then I'd really question your ability to appropriately safeguard so much critically private data. For reference, these audits are about 1/20th as complicated as a full SOC 2 audit, for example. FWIW I'm not previously familiar with this Transmit app, but based on their use cases (e.g. backup) it sounds like the limited "drive.file" scope wouldn't work for them. Still, if you want complete, unfettered access to my entire Drive account, I don't think it's a bad thing that Google is enforcing some minimal security standards.
- dewey 2y ago
  > which I've done and are quite easy - if anything Did you read the part where it took multiple months to continue because of slow replies and non-working tooling from Google's side? It's also pretty expensive for a relatively niche app, it might be fine if you are Dropbox or a big VC funded Mail app but for smaller companies it's not "easy". > I don't think it's a bad thing that Google is enforcing some minimal security standards. How would Google find out if the version that they are "scanning" is the same one that gets uploaded to the app store on every small app update? Zero, so there's no security benefit.
  - rammer 2y ago
    We've done it too, first time it was hard but it's required and recommended. It raises the bar for low effort hackers and improves security. I disagree with the op. Sorry mate go through the casa audit and get the access .
    - dewey 2y ago
zoogeny 2y ago
This is both a curse and an opportunity. Compliance is one of those things that is costly and time-consuming but can lead to entrenchment in certain industries. I worked for a client eons ago that went through the enormous hassle of HIPPA compliance and now it is a bit of a moat for them. Having SOC 2 compliance almost feels like table stakes for b2b SaaS these days. It does disgust me that Google is going this route. I wonder how much influence is coming from governmental agencies. It is possible they are being forced in some way based on some kind of KYC-like requirements. Or perhaps the volume of bad actors is even higher than I imagine and Google is being forced to do this just to keep the lights on for the API at all. But the fact of the matter is that they are offloading the cost of whatever compliance they need onto their platform users, the people who are spending time and effort to improve the Google ecosystem. It feels petty and short-sighted but I suppose that Google has shifted into an extraction phase on behalf of their investors. We'll probably see a lot more of this kind of nickel and diming from them.
deleted 2y ago
[deleted]
imhoguy 2y ago
As per mentioned Ghisler page: "The security assessment would have to be performed by a specialized company, and costs up to $75'000 per year and program (so $150'000 for 32bit+64-bit). This is not sustainable even with a subscription." [0] This is death kiss to indie developement. But paradoxically it is great. Killing interoperability is nail to coffin. This brings more and more focus to alternative solutions out of Google market, especially in independent software area. Like yt-dlp, FreeTube, F-Droid - actually all my family uses them and I recommend it to everyone. I can't wait to get some alternative GDrive client lib which simulates browser to throw data over that garden wall, and I don't care if it nags with captcha. The more hassle the more people are going to hate that ivory tower. [0] https://www.ghisler.com/googledrivehelp.htm https://www.ghisler.com/googledrivehelp.htm
- closeparen 2y ago
  This is what everyone said they wanted after Cambridge Analytica! For platforms to exercise due diligence before allowing users to delegate their access to third parties.
  - sam_lowry_ 2y ago
    Before Cambridge Analytica I could get language stats for Belgium down to municipalities. These are illegal otherwise, but very useful for journalists reporting on political matters.
  - csinode 2y ago
    Wasn't a significant part of the Cambridge Analytica scandal that Facebook gave them access to user data _without_ the user's consent?
    - closeparen 2y ago
      In the same sense that if someone uses a third-party Google Drive client, the input of other collaborators on shared documents is exposed without their consent. (It was data about friends of users who authorized the application in Facebook's case).
joemi 2y ago
Raising the barrier for access like Google has done feels very anti-small company. Sure, it's more secure, but I have to wonder if they could improve security without excluding smaller companies like this. Seeing as it's Google, they probably could and specifically choose not to.
LegitShady 2y ago
I think its totally reasonable. If google wants to make drive functionality expensive and annoying for devs to include, then devs are going to drop support. I appreciate that this seems to be some additional security for drive access which is ostensibly a good thing but it doesn't seem like the review is very useful or catches any bad actors or errors.
tracerbulletx 2y ago
This policy is to create a moat for AI offerings.
tiltowait 2y ago
That’s a real shame. I use the feature a lot, but I can’t blame Panic for it.
fweimer 2y ago
Any idea what this means for Google Drive support in rclone and similar tools?
- hyperknot 2y ago
  Yes, wanted to ask the same, what will happen to rclone? Is it unaffected?
  - zer0zzz 2y ago
    Yeah was wondering the same.
- thebiss 2y ago
  rclone strongly recommends users create their own individual API key: > It is strongly recommended to use your own client ID as the default rclone ID is heavily used. If you have multiple services running, it is recommended to use an API key for each service. The default Google quota is 10 transactions per second so it is recommended to stay under that number as if you use more than that, it will cause rclone to rate limit and make things slower. https://rclone.org/drive/#making-your-own-client-id https://rclone.org/drive/#making-your-own-client-id
  - fweimer 2y ago
    I'm worried that such API keys won't be usable anymore because even API keys for personal use with a single account require that application security review. Furthermore, the Google Cloud console is not included in the typical Workspace subscription (for obvious reasons).
whalesalad 2y ago
I don't use Google Drive and probably never will but FWIW Transmit is still one of the best all-around data transfer apps that exist. I always miss it when I am on my Linux workstation. Being able to quickly connect to an S3 bucket and dump files and edit their permissions is a huge plus. Not to mention basic SFTP access like Cyberduck or Filezilla would do. I have never regretted my purchase of Transmit, it's great!
- xp84 2y ago
  Same. I used to pirate it back when Serial Box was a thing and I was a broke college kid, and I've been licensed since growing up. An essential tool. I would say it should be built into the OS, but that's a joke since modern-day Microsoft and Apple could never provide such a useful tool without sanding everything down to a smooth minimalist surface with no discoverability.
  - jrnichols 2y ago
    I agree. Also believe that Unison was the perfect NNTP client and I miss it still.
- seec 2y ago
  Yeah Transmit is one of the OG Mac apps (OS X) that were great at a reasonable price. Sadly, they don't make them like this anymore.
xyst 2y ago
> we would now have to pay one of Google’s business partners to conduct the review This is straight out of the IBM playbook. Did Google pick up some IBM flunkies recently? What a terrible business practice. This was a company that once proudly displayed the motto, “don’t be evil” and even proved itself in various situations. Those days are long gone as the company is filled with more brain dead, unimaginative MBA flunkies.
kulor 2y ago
Having recently had an infuriating experience with an Android app submission, it seems there's a horde of people in a similar jam, running the senseless bureaucratic review process gauntlet: https://www.reddit.com/r/androiddev/comments/1ck1wyp/did_google_play_recently_started_to_suspend_after/ https://www.reddit.com/r/androiddev/comments/1ck1wyp/did_goo...
- cageface 2y ago
  I just dropped support for Android on my app. From now on it will be iOS only. That’s where all the users willing to pay for apps seem to be anyway any dealing with Google bureaucracy just isn’t worth it.
advisedwang 2y ago
I'm not familiar with Panic, but the blog post really should explain why the require "full access to users’ files on Drive" and moving to a reduced scope isn't viable.
- tkone 2y ago
  Transmit is a file transfer client (like FTP). It needs access to your entire drive because you might want to copy something to/from anywhere in your drive.
- LeoPanthera 2y ago
  Transmit is a file transfer app. It includes a file browser for your local and remote filesystems. Full access is literally the entire point of it. https://www.panic.com/transmit/ https://www.panic.com/transmit/
Cthulhu_ 2y ago
Before anyone else does this... make sure people actually use it enough to invest the time and money into it. I mean for Apple / Android / Windows? app store reviews you often don't get much choice (not until EU laws are fully complied with anyway), as I've found out the hard way over the years developing apps.
mikewarot 2y ago
This is the end result of having compute as a utility, without having equivalent protection mechanisms in place all the way down to the endpoints. Imagine what would happen if we didn't have fuses and circuit breakers everywhere we use electricity. Any defective toaster could bring down the entire grid it was plugged into. There would have to be entirely new teams of inspectors and certifications and laws about even plugging in a lamp. Madness Yet here we are, 40+ years after collectively deciding that MULTICS was too complicated, and Unix was the way to go. I thought we'd be able to see the folly of our ways by 2025 at the latest, but it's not going to happen. 8(
SanjayMehta 2y ago
FTA this jumped out at me: “Eventually, by reaching out through friends of friends of friends to find someone inside Google who could help, we got in contact with a Google employee who was very helpful in getting the process started.” Sounds exactly like dealing with an incompetent government agency.
alanfranz 2y ago
I’m not sure about how this is happening. Transmit is a desktop app - or does it have a cloud hosted component? If it’s a desktop app, it should be possible to generate an api key and pass it to the desktop app, that’s it. Google doesn’t know or care about who’s using it at that point. The security flow being discussed should impact cloud-hosted applications. What am I missing?
- StewardMcOy 2y ago
  You're not missing anything, it's just that > Google doesn’t know or care about who’s using it at that point is incorrect. Google Drive uses OAuth. Users don't register API keys, apps do, and then users just log in with their Google account. Google now requires apps to go through manual approval to actually use their OAuth keys, if those apps request certain endpoints. Doesn't matter if the app is local or cloud-hosted, if it makes certain REST requests, it needs special access, and Google controls which API keys get that special access. See https://developers.google.com/drive/api/guides/api-specific-auth https://developers.google.com/drive/api/guides/api-specific-...
wslh 2y ago
ELI5: I’m not familiar with the Google Drive API, but does this mean that even if I try to build my own tool as an individual, I have to go through all these steps? I'm asking because, with many API services, you have to declare an app during setup, even if it’s just for personal use.
- psd1 2y ago
  Compile to apk and sideload; Google won't even know. The audit gate in TFA is a gate to get into the play store.
hs86 2y ago
Will this also kill 3rd party Google Drive clients for Linux like Insync?

336 points by donatj 2y ago

mzagaja 2y ago

Google really is wrecking hell on third party integrations.

Jyaif 2y ago
"The fastest path to wealth is the construction of these digital platforms, where other people depend on you." - Eric Schmidt. Many products leads at Google seem to disagree!
- indymike 2y ago
  Depends. Build it, get dependent developers, start charging dependent developers, ????, profit.
  - Lerc 2y ago
    ...Try and launch a new platform, Nobody trusts you, Platform Dies, Loss?

teruakohatu 2y ago

I am not sure smaller devs were given the option of self-scanning code. I always wondered what the point of that was, given that there is no way for Google to ensure that the scanned code was the version distributed, and even then, as soon as a minor update was released it would have been out of date.

dewey 2y ago
Because they don't care about security, it's compliance-checkbox-driven policies.
- xp84 2y ago
  Bingo! The whole thing is for butt-covering purposes. It's just so that when something happens, Google can then say "We followed $STANDARDS_BODY Policy #420.69, so we can't be held responsible!" Theoretically even Panic would gain a little butt-covering from it too. "Look, this vulnerability was so hard to spot that even these very professional security auditors missed it 8 years in a row!" It's all still pretty worthless though imho.

teqsun 2y ago

Title on the blog is now (changed?): "End of the Road for Google Drive in Transmit" The being unfamiliar with Transmit the "and" gave me a startle

davedx 2y ago

> But then… a couple of months later, Google completely removed the option for us to scan our own code. Instead, to keep access to Google Drive, we would now have to pay one of Google’s business partners to conduct the review. What a racket. Smells downright anti-competitive The EU will have fun with this when it catches up.

rammer 2y ago
It wasn't even that expensive. Ada security audit from tekta in Spain was under 4k. There's nothing like a racket here. The list of certification agencies goes from KPMG at top end to smaller companies.
- anakaine 2y ago
  4k is not expensive in enterprise terms, but in small bootstrapped startup terms it is absolutely expensive.
  - imhoguy 2y ago
    And the issue is the other corporations may likely follow, so you have to stack hefty audit sum every year for multiple monopolistic cloud vendors because you made some cheap documents scanner app with convenient storage options for your user.
- davedx 2y ago
  They're partners, not just agencies you independently get to choose, right? That's what I'm getting at with the racket part. You don't get to interop with one of the biggest cloud providers in the world unless you complete commercial audits with one of their partners. Given the kind of collusion Google's shown itself capable of [1] do you really think this is all fair? [1] https://en.wikipedia.org/wiki/High-Tech_Employee_Antitrust_Litigation https://en.wikipedia.org/wiki/High-Tech_Employee_Antitrust_L...
aaronharnly 2y ago
Just as a data point, we paid $750 for one of these engagements (scan + some discussion about use cases etc) to one of Google's preferred providers. There were multiple options for providers.

fidotron 2y ago

There is a clear subtext to this and the Play Store changes: everyone interacting with the Google ecosystem is going to be pinned down and deanonymized with rights assigned based on legal identities. This will be done in the name of security. There is no freedom in who you trust here. The big question here is if all this was preemptive or the response to something.

akira2501 2y ago
All monopolies do this. Once they're past the point where the government can effectively regulate them they essentially take over and regulate the market for their own interests. Google is very good at this. They're probably better at this than actually writing code these days. Which is why anyone and everyone should flat out avoid them as a company.

teruakohatu 2y ago

The original title now reads “…for Google drive in Transmit”. @donatj can you correct the HN title please.

donatj 2y ago
Fixed

quantadev 2y ago

Never hitch your wagon to somebody else's horse. Entire companies have been destroyed because they rely on Amazon, Google, or some other service, and then have the rug pulled. Sometimes companies have even been destroyed, notably by Amazon, for having the wrong political viewpoints. My rule of thumb is: Only use open source components, and only run my stuff on Linux. So that way I maintain full control over my stack, and stay mostly immune from the political rug pulls, and other kinds of rug pulls.

stavros 2y ago
Some of these wagons only managed to move because they were hitched to someone else's horse.
- gopher_space 2y ago
  My concern is that people aren't building their own horses the minute it becomes feasible. The farrier now seems mystical and occult to a generation even though they're more than capable of picking up the tools themselves.
  - stavros 2y ago
    You don't build things when it becomes feasible, you build things when it becomes less risky to build them than to not. For things like a convenience integration, that moment may never come. For other things, it's easy to estimate wrong, given how fuzzy the risks are.
dewey 2y ago
That sounds great, but also for an app that interacts with > 10 services and companies it's not really a good advice. > Only use open source components, and only run my stuff on Linux Most people don't have the luxury of never having to interact with Google Drive, MS Teams, Slack etc.
- quantadev 2y ago
  Sure integration points to all that are great. The mistake is when your entire company can no longer function at all without Amazon AWS for example. I've worked at a place like that. EDIT: Of course if you're sure your politics are completely left-leaning you'll have no censorship worries, because these platforms are mostly Silicon Valley run. Also since conservatives basically don't play dirty in this way, the conservatives won't censor stuff just because it's left-leaning. We're for protecting freedom of all legal speech and actions.

dewey 2y ago

Even the "audit" they require for increasing something simple as your YouTube API quota is already annoying and a massive waste of time, and this is not even close to the one they are requiring from Panic. The quota increase process is roughly: 1) Fill out the same form every year from scratch 2) Send it into the black hole that's Google "support" 3) A few weeks later receive a reply from someone asking a irrelevant question to our use case 4) Two weeks later another person replies asking for screenshots of the "implementation", so you send a screenshot of "func storeTrailerMetadata()" 5) Another two weeks later, another automated person replies that you got approved.

kyleee 2y ago
The process is the punishment
- jll29 2y ago
  That's a diamond of a quote; are you a student of Kafka's?
  - r2_pilot 2y ago
    It's from the eponymous 1979 book by Malcolm Feeley and may predate it
t0mas88 2y ago
The Google "support" black hole even exists for their high budget ad customers. I've seen a case where things went into the Google support black hole for a company spending a few million per month via DV360 / Google Ads. Nothing anyone could do about it, campaign blocked, work with "support" to fix it.
8338550bff96 2y ago
Have the same experience with Microsoft support. The difference is the timeline is much shorter and when our issues don't get any traction our rep intervenes and escalates to engineers. I understand that level-1 support for these orgs are basically documentation librarians. Cool. We pay an incredible amount for premium support, but whatever. It's fine. What matters is that we have a rep that is engaged and cares about us being unblocked and isn't going to let us flounder for issues their support team is not going to solve. Have never seen this level of commitment from Google.

jonnybarnes 2y ago

Sounds similar to what iA Writer are going through: https://ia.net/topics/our-android-app-is-frozen-in-carbonite https://ia.net/topics/our-android-app-is-frozen-in-carbonite

hoistbypetard 2y ago
Sure does. The article even says, on the first screenful of text: > You may have seen iA Writer’s announcement that they are stopping development of their Android version for similar reasons. Our experience was different, but our circumstances are similar. While Google Drive may not be the most popular connection option in Transmit, we know many users rely on it, and we often use it here at Panic to send and receive files from the game developers we work with.

deleted 2y ago

[deleted]

addisonj 2y ago

Man... this stuff sucks. If I were panic, I would do the same... but I also wouldn't want to be the one at google to navigate this. With Google Drive now being at the center of so many companies for storing business data, I am certain it is a juicy target, and third party access with full access to read and write to that big hard drive full of proprietary data is one that I would understand want to lock down... but not like this? I don't think the market is anywhere near to shifting where business are going to dump google drive en masse, but as the ecosystem shrinks because so few companies can afford the cost to play in google's backyard, it does make me wonder how many companies are going to absolutely resent google, comparable to the way they resented oracle.

dewey 2y ago
> With Google Drive now being at the center of so many companies for storing business data, I am certain it is a juicy target, and third party access with full access to read and write to that big hard drive full of proprietary data is one that I would understand want to lock down... but not like this? Could be a Google Workspace policy where you can just set that employees can't access the corporate Drive account through third party apps, while it continues to work for personal accounts.
- sadeshmukh 2y ago
  That's already how it works for workspace, in my experience.

resters 2y ago

I think if there is one "value" that stands out from Google's culture (as it is reflected onto its customers) it is tremendous lack of empathy. - Google maps appears to be designed by non-drivers. Much of hte time it is impossible to find out the name of cross streets near one's location by zooming in. Pins get added accidentally and are hard to categorize and find, there is no notion of neighborhoods, and the voice directions say the same redundant thing over and over (and it is often misleading). No intelligent person could design the product that way if they actually used it. - Google's parental control features in android lack granularity, and the bias is toward kids watching garbage content as there is no way to share curated lists or for creators to become curators of high quality youtube content, etc. For anyone with young kids this is a must have feature and Google has ignored this kind of thing for years. Also if your kid's phone dies there is no way to remove it from the FamilyLink app! Someone really tested it thoroughly! - Google Home / Nest. Exceptionally buggy devices. Basic functionality like shared speakers (all Nest over Nest wifi) are buggy and slow. "Hey Google" takes an extra few seconds to respond compared to Alexa and none of it is compatible with Google Advanced Security (Google's own feature!). Nobody building this tech is using it at home or else they would be furious about these big oversights. - Gemini in Gmail is a total dud. It can't tell me what upcoming events are listed in my email inbox. It biases toward searching the inbox, and GMail inbox search has been highly broken for years. I participated in a user study at Google a while back and the PM admitted it was broken and would not be fixed. Google is now a cash cow advertising business and thanks to Eric Schmidt (a brilliant but morally lacking individual) it has become a major defense contractor. Thanks to OpenAI and others, Google search is already dead. The market hasn't caught up with this yet. I sincerely regret making gmail my main email, as the company seems to have completely lost its way. In spite of a lot of brilliance the lack of empathy with users and the need to deliver products that solve problems continues to persist.

artooro 2y ago
It's almost like the incentives at Google are misaligned, who knew.
FredPret 2y ago
Probably a big part of the problem is this: - good engineers and managers earn well, especially in the US - they want to own premium products - where Google and Apple compete, Apple has gone for the premium end and Google has gone for the mass-market end - speculation: thus Google employees aren't living in their own ecosystem

hn_throwaway_99 2y ago

I wrote this response to another front page HN article on a similar topic: https://news.ycombinator.com/item?id=41664753 https://news.ycombinator.com/item?id=41664753 I know everyone loves to dunk on Google, and I definitely agree their communication and customer service to app developers is shite, but this change to permissions scope is a good thing. If you have full, unfettered access to large number of people's Google Drive data, you're a huge target for malevolent actors. If you can't afford the new audit requirements (which I've done and are quite easy - if anything I'm sympathetic to the argument that they're more "box ticking" than valuable security audits), then I'd really question your ability to appropriately safeguard so much critically private data. For reference, these audits are about 1/20th as complicated as a full SOC 2 audit, for example. FWIW I'm not previously familiar with this Transmit app, but based on their use cases (e.g. backup) it sounds like the limited "drive.file" scope wouldn't work for them. Still, if you want complete, unfettered access to my entire Drive account, I don't think it's a bad thing that Google is enforcing some minimal security standards.

dewey 2y ago
> which I've done and are quite easy - if anything Did you read the part where it took multiple months to continue because of slow replies and non-working tooling from Google's side? It's also pretty expensive for a relatively niche app, it might be fine if you are Dropbox or a big VC funded Mail app but for smaller companies it's not "easy". > I don't think it's a bad thing that Google is enforcing some minimal security standards. How would Google find out if the version that they are "scanning" is the same one that gets uploaded to the app store on every small app update? Zero, so there's no security benefit.
- rammer 2y ago
  We've done it too, first time it was hard but it's required and recommended. It raises the bar for low effort hackers and improves security. I disagree with the op. Sorry mate go through the casa audit and get the access .
  - dewey 2y ago

zoogeny 2y ago

This is both a curse and an opportunity. Compliance is one of those things that is costly and time-consuming but can lead to entrenchment in certain industries. I worked for a client eons ago that went through the enormous hassle of HIPPA compliance and now it is a bit of a moat for them. Having SOC 2 compliance almost feels like table stakes for b2b SaaS these days. It does disgust me that Google is going this route. I wonder how much influence is coming from governmental agencies. It is possible they are being forced in some way based on some kind of KYC-like requirements. Or perhaps the volume of bad actors is even higher than I imagine and Google is being forced to do this just to keep the lights on for the API at all. But the fact of the matter is that they are offloading the cost of whatever compliance they need onto their platform users, the people who are spending time and effort to improve the Google ecosystem. It feels petty and short-sighted but I suppose that Google has shifted into an extraction phase on behalf of their investors. We'll probably see a lot more of this kind of nickel and diming from them.

deleted 2y ago

[deleted]

imhoguy 2y ago

As per mentioned Ghisler page: "The security assessment would have to be performed by a specialized company, and costs up to $75'000 per year and program (so $150'000 for 32bit+64-bit). This is not sustainable even with a subscription." [0] This is death kiss to indie developement. But paradoxically it is great. Killing interoperability is nail to coffin. This brings more and more focus to alternative solutions out of Google market, especially in independent software area. Like yt-dlp, FreeTube, F-Droid - actually all my family uses them and I recommend it to everyone. I can't wait to get some alternative GDrive client lib which simulates browser to throw data over that garden wall, and I don't care if it nags with captcha. The more hassle the more people are going to hate that ivory tower. [0] https://www.ghisler.com/googledrivehelp.htm https://www.ghisler.com/googledrivehelp.htm

closeparen 2y ago
This is what everyone said they wanted after Cambridge Analytica! For platforms to exercise due diligence before allowing users to delegate their access to third parties.
- sam_lowry_ 2y ago
  Before Cambridge Analytica I could get language stats for Belgium down to municipalities. These are illegal otherwise, but very useful for journalists reporting on political matters.
- csinode 2y ago
  Wasn't a significant part of the Cambridge Analytica scandal that Facebook gave them access to user data _without_ the user's consent?
  - closeparen 2y ago
    In the same sense that if someone uses a third-party Google Drive client, the input of other collaborators on shared documents is exposed without their consent. (It was data about friends of users who authorized the application in Facebook's case).

joemi 2y ago

Raising the barrier for access like Google has done feels very anti-small company. Sure, it's more secure, but I have to wonder if they could improve security without excluding smaller companies like this. Seeing as it's Google, they probably could and specifically choose not to.

LegitShady 2y ago

I think its totally reasonable. If google wants to make drive functionality expensive and annoying for devs to include, then devs are going to drop support. I appreciate that this seems to be some additional security for drive access which is ostensibly a good thing but it doesn't seem like the review is very useful or catches any bad actors or errors.

tracerbulletx 2y ago

This policy is to create a moat for AI offerings.

tiltowait 2y ago

That’s a real shame. I use the feature a lot, but I can’t blame Panic for it.

fweimer 2y ago

Any idea what this means for Google Drive support in rclone and similar tools?

hyperknot 2y ago
Yes, wanted to ask the same, what will happen to rclone? Is it unaffected?
- zer0zzz 2y ago
  Yeah was wondering the same.
thebiss 2y ago
rclone strongly recommends users create their own individual API key: > It is strongly recommended to use your own client ID as the default rclone ID is heavily used. If you have multiple services running, it is recommended to use an API key for each service. The default Google quota is 10 transactions per second so it is recommended to stay under that number as if you use more than that, it will cause rclone to rate limit and make things slower. https://rclone.org/drive/#making-your-own-client-id https://rclone.org/drive/#making-your-own-client-id
- fweimer 2y ago
  I'm worried that such API keys won't be usable anymore because even API keys for personal use with a single account require that application security review. Furthermore, the Google Cloud console is not included in the typical Workspace subscription (for obvious reasons).

whalesalad 2y ago

I don't use Google Drive and probably never will but FWIW Transmit is still one of the best all-around data transfer apps that exist. I always miss it when I am on my Linux workstation. Being able to quickly connect to an S3 bucket and dump files and edit their permissions is a huge plus. Not to mention basic SFTP access like Cyberduck or Filezilla would do. I have never regretted my purchase of Transmit, it's great!

xp84 2y ago
Same. I used to pirate it back when Serial Box was a thing and I was a broke college kid, and I've been licensed since growing up. An essential tool. I would say it should be built into the OS, but that's a joke since modern-day Microsoft and Apple could never provide such a useful tool without sanding everything down to a smooth minimalist surface with no discoverability.
- jrnichols 2y ago
  I agree. Also believe that Unison was the perfect NNTP client and I miss it still.
seec 2y ago
Yeah Transmit is one of the OG Mac apps (OS X) that were great at a reasonable price. Sadly, they don't make them like this anymore.

xyst 2y ago

> we would now have to pay one of Google’s business partners to conduct the review This is straight out of the IBM playbook. Did Google pick up some IBM flunkies recently? What a terrible business practice. This was a company that once proudly displayed the motto, “don’t be evil” and even proved itself in various situations. Those days are long gone as the company is filled with more brain dead, unimaginative MBA flunkies.

kulor 2y ago

Having recently had an infuriating experience with an Android app submission, it seems there's a horde of people in a similar jam, running the senseless bureaucratic review process gauntlet: https://www.reddit.com/r/androiddev/comments/1ck1wyp/did_google_play_recently_started_to_suspend_after/ https://www.reddit.com/r/androiddev/comments/1ck1wyp/did_goo...

cageface 2y ago
I just dropped support for Android on my app. From now on it will be iOS only. That’s where all the users willing to pay for apps seem to be anyway any dealing with Google bureaucracy just isn’t worth it.

advisedwang 2y ago

I'm not familiar with Panic, but the blog post really should explain why the require "full access to users’ files on Drive" and moving to a reduced scope isn't viable.

tkone 2y ago
Transmit is a file transfer client (like FTP). It needs access to your entire drive because you might want to copy something to/from anywhere in your drive.
LeoPanthera 2y ago
Transmit is a file transfer app. It includes a file browser for your local and remote filesystems. Full access is literally the entire point of it. https://www.panic.com/transmit/ https://www.panic.com/transmit/

Cthulhu_ 2y ago

Before anyone else does this... make sure people actually use it enough to invest the time and money into it. I mean for Apple / Android / Windows? app store reviews you often don't get much choice (not until EU laws are fully complied with anyway), as I've found out the hard way over the years developing apps.

mikewarot 2y ago

This is the end result of having compute as a utility, without having equivalent protection mechanisms in place all the way down to the endpoints. Imagine what would happen if we didn't have fuses and circuit breakers everywhere we use electricity. Any defective toaster could bring down the entire grid it was plugged into. There would have to be entirely new teams of inspectors and certifications and laws about even plugging in a lamp. Madness Yet here we are, 40+ years after collectively deciding that MULTICS was too complicated, and Unix was the way to go. I thought we'd be able to see the folly of our ways by 2025 at the latest, but it's not going to happen. 8(

SanjayMehta 2y ago

FTA this jumped out at me: “Eventually, by reaching out through friends of friends of friends to find someone inside Google who could help, we got in contact with a Google employee who was very helpful in getting the process started.” Sounds exactly like dealing with an incompetent government agency.

alanfranz 2y ago

I’m not sure about how this is happening. Transmit is a desktop app - or does it have a cloud hosted component? If it’s a desktop app, it should be possible to generate an api key and pass it to the desktop app, that’s it. Google doesn’t know or care about who’s using it at that point. The security flow being discussed should impact cloud-hosted applications. What am I missing?

StewardMcOy 2y ago
You're not missing anything, it's just that > Google doesn’t know or care about who’s using it at that point is incorrect. Google Drive uses OAuth. Users don't register API keys, apps do, and then users just log in with their Google account. Google now requires apps to go through manual approval to actually use their OAuth keys, if those apps request certain endpoints. Doesn't matter if the app is local or cloud-hosted, if it makes certain REST requests, it needs special access, and Google controls which API keys get that special access. See https://developers.google.com/drive/api/guides/api-specific-auth https://developers.google.com/drive/api/guides/api-specific-...

wslh 2y ago

ELI5: I’m not familiar with the Google Drive API, but does this mean that even if I try to build my own tool as an individual, I have to go through all these steps? I'm asking because, with many API services, you have to declare an app during setup, even if it’s just for personal use.

psd1 2y ago
Compile to apk and sideload; Google won't even know. The audit gate in TFA is a gate to get into the play store.

hs86 2y ago

Will this also kill 3rd party Google Drive clients for Linux like Insync?