"I went through about a dozen AI tools I've personally authorized in the last year after reading this. Nine of them have Google Workspace OAuth permissions that include reading all emails and accessing all Drive files. Nine. I authorized every one of them without reading the permissions because the onboarding flow asked and I was in a hurry."
Do other (tech-literate) people do this?! Giving anything access to my emails and Google Drive would keep me up at night and I try and be very granular with permissions and revoke them when I don't use an app any more. I would assume that anything confidential/NDA in my emails had been compromised and leaked well before this point!
At my job I was asked to help integrate our Google Workspace account with an AI notetaking tool another team purchased. The vendor instructed us to set up Domain-wide Delegation for reading/writing emails and Google Drive files. Essentially this would automatically opt in every user in my organization and there would be no way to opt out.
I had to contact the vendor to set up a "less recommended" way of requiring users to actually log into the tool and accept the OAuth permissions prompt. The entire time, everybody (the vendor and my organization) acted like it was a waste of my time.
I can't control what everyone else does, if they want to grant some tool these broad permissions, feel free. But I find it unethical to just enable it for all users with no ability to opt out if this isn't actually a critical tool. Not to mention the security concerns with this.
What is most concerning to me is how people are turning their brains off for anything tangentially related to AI. The people making this request to me are smart people who 5 years ago would have never asked to do this. Now suddenly they don't care - everyone else is doing it, why not?
>What is most concerning to me is how people are turning their brains off for anything tangentially related to AI.
Everyone is betting the farm on that .01% chance that they become wild trillionaires. We're going to burn down the whole planet and use all of the resources so a few people can have a minuscule chance at being obscenely rich.
Personally, no. This comment from the other day has been stuck in my head: "Anyone trying to stay safe will be on the gradient to a Stallmanesque monastic computing existence."[0]
It's both hilarious and true. As much I want to reap the gains of having an openclaw agent going ham on my personal data, I abstain. I shed a tear at all the cool stuff I'm missing out on, but permissions are never about now. Once they have it, they'll always have it.
I'm sure it's very common, yes. Permissions & popup fatigue is very real. Today, every application and website throws 6 dozen popups at you that you have to get through to get to the stuff you came there for. Most of it is marketing; some of it is from braindead lawyers; some of it is important; none of it gets read by users. At some point you give up and just click "yes, goddamnit, I have work to do" and all the security stuff is out the window.
Always remember: there is no such thing as computer security. If your data is on a networked computer, consider it to be semi-public. The first and only rule of computer security is don't store or do anything on a networked computer that would devastate you if it were leaked or compromised
And, make sure not to think about how much of our modern infrastructure is built on top of computers connected to the Internet.
> *Nine of them have Google Workspace OAuth permissions that include reading all emails and accessing all Drive files. Nine. I authorized every one of them without reading the permissions because the onboarding flow asked and I was in a hurry."
No, you didn't authorize every one of them without reading the permissions because the onboarding flow asked and you were in a hurry.
You authorized it because the onboarding flow asked, and you weren't given an opportunity to say no. What are you to do: say no, and then not use the app?
This whole concept is just wrong. Instead of saying "no" and the app seeing that you didn't grant permission: you should be able to say "no", and the app shouldn't see any denial at all. It should just see empty data when requesting it. Problem fucking solved. You get to use whatever apps you want, apps get to ask for whatever permissions they want, and you get to deny that permission without the app fucking you over.
I think it's a bit easier to add a "Some" option so that then the App is unaware to the effective "No" answer.
But also a lot of the permissions are just bad. Like I think it's reasonable for somebody to make a web-app that uses my Google Drive as a backend for storing data. I don't think its reasonable that it should be able to open files it didn't create though.
This just moves the problem to support. The app doesn't work for users, they don't remember clicking no, and then some CSR has to hand-hold them through clicking "yes".
Boo-hoo. Support should exist. Support should be trained. Support should help educate the customer. If your business isn't doing that then your business is trashy anyway.
Many companies don't have support. That's a major problem. We have a lot of trashy businesses.
While you're right, I'll be happy with just empty data for now. Generating statistically-likely false data is only recently available generally and turns out to be rather expensive.
For the most sensitive fields (names, addresses, phone numbers) it's quite simple. For names, you get a list of the (say) 1,000 most common names, and pick randomly from the list. For phone numbers, you generate random numbers with valid formatting (not all area codes are valid, etc.). For addresses, you pick randomly from a database of real addresses. Etc. No LLM-style generation needed.
What? This makes no sense to me. What's the threat model where you'd rather the OAuth flow result in the client app getting fake data?
If you reject the permissions the client already doesn't hear about it because the callback redirect isn't invoked (or at least, there's no reason for it to be, but that's up to you).
> What are you to do: say no, and then not use the app?
Um, yes? That's literally the point of what's happening. The app is asking for permissions because it needs it to do whatever it's doing. If you don't want to give it access to the data then there's no reason to use the app.
I usually pay pretty close attention if something wants more than my email address, name and profile image, etc... I've used a couple things that request drive access, only because they actually deal with documents. I'm not sure that I've given any AI agents particularly open access... though if Claude Code wanted to, it could probably pwn me... I've been considering shifting to a VM for that.
It's hard to avoid, but there are steps we can make towards fixing it. I spent years in academia building open-source data processing pipelines for neuroscience data and helping other researchers do the same. Most quantitative research goes through "lossy" steps between raw data and final results involving Excel spreadsheets, one-off MATLAB commands, copy pasting the results, etc.
In a lot of cases (where data is being collected by humans with a tape measure, say) there is room for error. But one of the things that's getting traction in some fields is open-source publication of both raw datasets and the evaluation/processing methods (in a Jupyter Notebook, say) in a way that lets other people run their analysis on your data, your analysis on their data, or at least re-run your start-to-finish pipeline and look for errors!
As is often the case, the holdups are mostly political: methods papers are less prestigious than the "real science" ones, and it takes journals / funders to mandate these things and provide funding/hosting for datasets for 10+ years, etc - researchers are a time-poor bunch and often won't do things unless there's an incentive to!
I'm always curious what RoI analysis goes into this kind of decision - whether to leave on-prem and join the cloud, or vice versa. The numbers always seem huge, and in opposite directions. "Moving from onsite datacenters to AWS saved us $2m/year!"
Has something changed with AWS' pricing recently, have their business needs changed over the years, or were the calculations (to use AWS) just wrong to begin with?
The cloud has never been about absolute cheapness, but value for money and time-value in starting up.
The classic Enterprise model is to fire up a business operation using cloud providers to extend geographically, and quickly validate the business. Then you either pull the plug or start going on or near-perm for operational cost control. The finance math works out well and you free up capital for other investments.
Tech startups are in a bit of a bubble where a huge AWS integration might be a product differentiator, but also have an orthodoxy built around massive growth capabilities that investors want even if pricey (startups mean dreams of scale and cashing in).
The cloud is pricey, but has value in its services that’s hard to replicate. On prem is better but now you’re in the data centre business want to or not.
And, then, if you’re evil you’d probably look at hybrid solutions, where each part is being milked for money and redundancy, and vendors are being played off one another since you’re perpetually moving away and towards already in-prod solutions from competitors. “Are you saying we have to move that on-prem? Those dudes’ll love the bonuses I guess.” “Huh, well the OtherCloud instance price we’re getting is way better, we were gonna harmonize anyways...” “You know what, forget it, BigCloud solves that for pennies, unless…”
The cloud is neither cheap nor expensive, it’s how you play with it that costs.
The “you’re doing it wrong” argument doesn’t float for me here. I see this as kind of scammy and it’s got that vibe of producing complexity to obscure in an area that is really meant to be the simpler solution to rolling your own hardware.
This is called a "series hybrid" rather than the more common "parallel hybrid" (eg Toyota Prius) and has been around for a while, including the BMW i3 with range extender (and London buses, and various other vehicles!). It's more expensive largely because the battery pack needs to be sized much larger to be able to provide enough current for all propulsion / regen. On the other hand, the combustion engine can be undersized and run at its most efficient RPM continuously - the BMW range extender is a 600cc little scooter engine that can provide enough power for continuous highway driving.
It's ironic that Backblaze themselves wrote a blog post a couple of years ago explaining why Dropbox isn't enough as a backup service and you need Backblaze as an additional layer of protection: https://www.backblaze.com/blog/whats-wrong-with-google-drive...
I'm not very good at chess, but I dont get why most things are considered a stalemate? I strategically remove all pieces of the enemy, leaving only the king against my rook/tower whatever its called, the king has nowhere to run. In my eyes it's a checkmate. The game just calls it a stalemate. Would be a stalemate if I couldn't do anything, but I can kill the enemy king.
That rule caught me up too. In regular chess if it is your opponents turn and their only pieces are a king in the 1,8 square and a pawn that is pressed up against one of your pawns and you have rooks in the 2,1 and 8,7 squares that counts as a victory does it not?
No. That is a draw assuming it is the player with only a king’s turn to move.
Translating your notation to normal chess notation:
White king on h1, black rooks on a2 and g8, black king in some random other place, white to move.
That is a draw, because white is NOT in check, but has no legal moves. That scenario is called stalemate. If white were in check, it would be checkmate and a win for black. Set it up on any chess analysis board website and it will say the game is a draw.
... and if it weren't the rule, it'd make a lot of mid- and late-game play much safer for the player with the advantage. As it is, it's something they have to watch out for, which constrains them somewhat. You have to win, but not the wrong way, and your opponent can attempt to force you to "win" the "wrong way" (resulting in a stalemate).
In other "incorrect calendars" bugs, there's the Rockchip RK808 RTC, where the engineers thought that November had 31 days, needing a Linux kernel patch to this day that translates between Gregorian and Rockchip calendars (which are gradually diverging over time).
To be fair, that's nowhere near as daft as september, october, november, december. Latin for seven, eight, nine, and ten is: septem, octem, novem, decem. Those are the nineth, 10th, 11th and 12th months.
Which wouldn't be that weird, except that the earliest Roman calendar started in March and ended in December, having only 10 months!
The Romans were of course well aware that this left a gap of about two months between the end of one year in December, and the beginning of the next year in March. But they just didn't bother counting this period as part of the calendar year. Presumably because there was no agricultural reason to need accurate dates during winter.
AIUI, there is some confusion over whether this is actually the case. The pre-Julian calendar had 12 months, plus an optional intercalated month (they were aware that their ‘year’ had the wrong number of days, and periodically shoved in some extra time to patch it up). The 10 month calendar, if it existed, would have been very early and there’s not much hard evidence that it was actually used. Numa Pompilius, who was allegedly responsible, is a mythical figure and probably not an actual historical king.
I'm French and occasionally like to (re)read about the revolution period and every time I come to the calendar stuff I can't help but think "Really? This was stuff we wanted to spend time on?"
Good $3 MEMS gyros are about 100x better than that now - look at anything new made by Invensense in the past couple years. And their drift is pretty Gaussian-distributed, so the error scales as sqrt(n). If you combine 8+ of them on one board you can get about 5deg/hour stability...
Do other (tech-literate) people do this?! Giving anything access to my emails and Google Drive would keep me up at night and I try and be very granular with permissions and revoke them when I don't use an app any more. I would assume that anything confidential/NDA in my emails had been compromised and leaked well before this point!
reply