Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Google Cloud lets anyone add you to a project without your permission

news.ycombinator.com

Post reply on HN
Print view View original

71–80 of 130 posts

Re: Tell HN: Google Cloud lets anyone add you to a project without your permission

#71

Post by rippercushions »

bboygravity wrote: post #53
autoexec wrote: post #46

Earlier quoted context omitted.

> Is not having support really worth the damage this causes to a brand? Once you reach a certain size the reputation of your brand is almost meaningless. Some of the largest and most successful companies around are almost universally hated and have terrible reputations. Those companies don't care and they continue to make unpopular decisions and actively screw over their customers and their employees all while pullin…

Maybe your confounding "large company" with monopoly or duopoly? Can you give examples of large companies with more than 1 competitor who get away with treating customers badly in the long run?

Oracle, Comcast, Nestle, Equifax, Philip Morris.

Re: Tell HN: Google Cloud lets anyone add you to a project without your permission

#72

Post by cachvico »

EarthLaunch wrote: post #39

A company without customer support is incentivizing everyone to blare every single problem to the largest possible audience. The overall impression is that the company's products are unpleasant and dysfunctional. It's the opposite of advertising. Is not having support really worth the damage this causes to a brand? That said, many people treat support so badly that offering it may be worth avoiding on principle.

GCP has paid support, it starts at around $30/month and gets you an assigned human within 4 hours or something.

Re: Tell HN: Google Cloud lets anyone add you to a project without your permission

#73

Post by lovelearning »

bradleybuda wrote: post #47
bushbaba wrote: post #35

If a GCP project hosted child porn. And the project admin added you as a co-owner to said project. Would you be legally be at fault or implicated?

No, because thank goodness the law is not executed by automatons, it is a system of humans with human brains.

Brains that may be vulnerable to political deceptions, biases, and prejudices. I can think of some countries where government, police, and judiciary seem to conspire regularly to implicate critics.

Re: Tell HN: Google Cloud lets anyone add you to a project without your permission

#74

Post by kaelinl »

ViViDboarder wrote: post #70

Years ago someone reported this about GitHub projects as well. If I recall correctly, working as intended was the response.

In response to those complaints GitHub now requires you to accept the invitation before you're added. And it always sent an email notification and allowed you to leave voluntarily.

Re: Tell HN: Google Cloud lets anyone add you to a project without your permission

#75

Post by BoorishBears »

bradleybuda wrote: post #47
bushbaba wrote: post #35

If a GCP project hosted child porn. And the project admin added you as a co-owner to said project. Would you be legally be at fault or implicated?

No, because thank goodness the law is not executed by automatons, it is a system of humans with human brains.

Ironically for that reason I'd expect that maybe after a lengthy investigation you'd be free, but you 100% would have your life majorly complicated along the way.

I unfortunately can't imagine a world in which someone non-technical doesn't just get a list of emails associated with a project and all of them get rounded up by their local PDs.

Re: Tell HN: Google Cloud lets anyone add you to a project without your permission

#76

Post by mike_d »

owenmarshall wrote: post #62
kyrra wrote: post #48

Earlier quoted context omitted.

This tends to be a terrible idea, unless you really just want to nuke your Google account. (Googler, opinions are my own. I work on payments.)

Not a googler, but: this is absolutely right. Chargebacks are the mutually assured destruction of banking. There’s nothing wrong with firing a nuclear weapon if you truly feel it’s in your best interests; if you do, expect that your adversary will respond in kind and terminate all business with you now and in the future. Sometimes that’s the right move, sometimes it’s not, just go into it with eyes open.

If you have a billing agreement in place with a company, doing a chargeback is just nullifying a payment. The balance can still be sent to collections.

Re: Tell HN: Google Cloud lets anyone add you to a project without your permission

#79

Post by owenmarshall »

frx wrote: post #29
supriyo-biswas wrote: post #8

I am not even sure what all the fuss is about. AWS IAM has the exact same “issue” where an IAM principal can be allowed to access a resource without asking the party in question. This model is used because otherwise providing permissions becomes extremely difficult, and users are more likely to throw away the entire concept and settle for one common set of credentials for all users across the project (in the form of…

> AWS IAM has the exact same “issue” where an IAM principal can be allowed to access a resource without asking the party in question. This is not correct. This would only work if the resource is in the same AWS account. For cross account access, both the principal and the resource need to allow each other. See: https://aws.amazon.com/premiumsupport/knowledge-center/cross...

I think the concern is less technical and more policy.

I might be able to sts:AssumeRole to any number of roles created by bad cloud engineers that allowed my account instead of another. But - ignoring that it requires exceptional luck to find the right account/role pair - it takes explicit action on my part to move into their account. At the end of the day, I exchange my credentials for those in another account, and that action is logged in my account, theirs, and with AWS.

The concern here is this sharing happens without me doing anything. What happens if I get added to an account whose admin cries foul to Google? Or if their account is flagged for violating GCP terms? Given Google’s history, I’d be worried too.

Re: Tell HN: Google Cloud lets anyone add you to a project without your permission

#80

Post by jasonjayr »

foreverCarlos wrote: post #55
kyrra wrote: post #48

Earlier quoted context omitted.

This tends to be a terrible idea, unless you really just want to nuke your Google account. (Googler, opinions are my own. I work on payments.)

Over the past serval months I realized with certainty that I should never use my personal Gmail account for any other Google services. Gmail is Gmail only, for everything else create separate Google accounts you are not afraid to lose.

That's not good enough, they relate multiple accounts too, sometimes incorrectly.

IIRC a company got their project booted from the play store, because one of the developers accounts got a black mark.

Post reply on HN