Hacker News new | ask | show | jobs
by gman83 108 days ago
This wasn't due to some random Gemini request. Users were using sketchy antigravity auth plugins to use their antigravity tokens on things like OpenClaw, clearly against ToS. It's great that Google is giving these users a second chance.
9 comments

Yes, our masters once again embarrass us unworthy peons with their endless grace, generosity and forebearance. How lucky we are to entrust our data and our lives to them!
Anyone can buy the tokens via the API and do whatever they want with them.

Its not evil of Google to say "Here is an allotment of steeply discounted tokens, but you can only use them with our services."

It is evil to block your email and hold your photos hostage over it though :)
They only blocked access to Antigravity and GeminiCLI for the offense.
Didn’t they only block Antigravity though, leaving other services available?
I’m amazed at how many people think this happened, despite it not being true.
That didn't happen though.
I would question the judgment of anyone who thought they would maintain "don't be evil" beyond IPO.
Your argument is basically : human being will always choose money over ethics.

Could be true, but a somewhat depressing worldview.

https://youtu.be/ntICHMV-WMA?t=40

"Google Shuts Down Gmail For Two Hours To Show Its Immense Power"

It's easy to sneer at huge corps getting mildly scammed by people stretching or breaking the rules. Certainly I don't shed any tears for these corporations.

On the other hand, I have learned that people who are willing to find exploits with trust-based systems operated by huge corps are very often willing to apply that same cheating and exploitation mentality without regard for who the other party is. These are very often the same people who try to coerce teenage cashiers at locally owned shops to accept expired coupons or combine them in invalid ways, or take produce from a roadside farm stand instead of paying into the honor jar. The mentality of cheating the system seems great when it's against huge inhumane corporations, but from what I've personally seen it rarely stops there, and on the whole it contributes to a low trust society.

What upsets me is less the fraudsters, though they are bad as you outline, but just the setup.

Google is in unilateral control of a whole pile of things. Some of them are more critical than others - in particular, if you use a GMail address or Google account to identify yourself to third parties, Google has you by the balls. It has billions of people by the balls. At any time, they could completely ruin your digital life. They don't even need a reason. If they lock you out, you have no way to get their actual attention, or to reverse their decision.

That's coercive power. The need of Google "customers" to keep in Google's good books because it can ruin their day at the flick of a switch is a massive boon for Google.

The power of scammers to defraud local shops pales into insignificance by comparison. And yet, we spend disproportionate amounts of time going after petty crooks, rather than directly addressing large corporations who wield enormous power to enrich themselves with little-to-no blowback. They can pay for the best lawyers on the planet to stretch out and thwart lawsuits and regulatory meetings. They are more powerful than us, and we need to reverse that - unless basically we give up and let them rule us with unchecked power?

A society where everyone feels helpless against a tyrannical ruler is bad, so os one where they can't trust their neighbours. I don't know if they're comparable but I'd prefer neither. I'd like thieves and scammers prosecuted, I'd also like large corporations regulated to within an inch of their lives.

> our masters once again embarrass us unworthy peons with their endless grace

Masters who serve you in exchange for money?

be as sarcastic as you want but you demand a thing they did not agree to provide, for the same money = they have a right not to serve you. If you disagree with that and think they owe you something then you are the one playing master here.

If a 3rd party product advertises compatibility with a Google service and you use it to login via a first party Google login page, doesn’t the responsibility fall somewhere between the offending product and Google itself? In practice it’s structured pretty much like a phishing attempt.

Notably some model providers explicitly allow that very flow, while others will ban you without notice.

If the "3rd party product" is you selfhosting FOSS, then that's you (OpenClaw users)
Why do you call it self-hosting? It appears to be installable app with a fancy homepage. At what point does the software being covered by an open license changes the responsibility model?
That's exactly what self hosting is, you install some app on your own computer host(s).

> At what point does the software being covered by an open license changes the responsibility model

When you agree to an open license that says you're liable for anything and not the author of the software.

> THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

The concern is not losing access to some new IDE for operating outside the terms of service. The concern is when you lose access to the IDE, you also lose access to your 20 year old Gmail account.

A general problem for Google products is that everything is mixed together.

But that's not what happened.
Okay but they were paying customers paying $$$ for the service. Banning your customers without prior warning is not right, however sketchy their behaviour might appear. Even if it's obvious to Google that there's a difference between a Gemini API key and an Antigravity API key, it's not necessarily obvious to others.

The correct and sane thing to do is to send them an email, with at most a 24 hour suspension. If they keep doing it despite being warned then by all means fire them.

It’s be great if Google just revoked antigravity access if terms were violated. No need to disable the entire account.
> just revoked antigravity access

That's exactly what they did, plus Gemini CLI and Code Assist, which are the same product in different formats.

I’ll go further: there should be laws addressing account consolidation. Getting banned from an Apple or Google account is an incredibly wide blast radius. It would be like being banned from buying Unilever or Nestle food from your grocery store.
Email providers should be utilities and also legally require a warrant before disclosing any information whatsoever to the government.

Unfortunately the government is full of corrupt geriatrics who do not understand technology and are paid to continue not understanding technology as they sign bills prepared for them by ALEC.

No Google account has been banned for this. People just keep spreading this lie because no one agrees that they have the right to steal the OAuth token.
It's their OAuth token, it's not being stolen. It's just being copied from one place on their computer to another. This is no different than a competing browser importing your localStorage and cookies from Chrome on first launch.
No, the OAuth token is supposed to be used solely with the context of a first-party app only. Clearly, if you need to extract the key by reverse engineering or set up a proxy to spoof requests to a service, you're doing something shady.
> No, the OAuth token is supposed to be used solely with the context of a first-party app only.

The web doesn't work like that. The operators of google.com saying you must only use Chrome to load it is a ridiculous concept. It's not spoofing to use your own access credentials on your own computer to access your own account on an HTTP API.

By this logic video game companies shouldn't be allowed to ban cheaters.
>The web doesn't work like that. The operators of google.com saying you must only use Chrome to load it is a ridiculous concept.

I have no idea what you are talking about. Chrome? Are you sure you are replying to the right thread?

That's not what stealing is.
"steal" is semantically incorrect here.
Only Antigravity and Gemini access was banned, not email or other google account stuff.
How do so many people think this happened? All of the articles I’ve read have been clear that it did not happen. Yet it’s all over the comments here. Why?
It's very easy to believe, and that's how Google bans usually go. Probably nothing more to it than that.
>It's great that Google is giving these users a second chance.

I hope this is sarcasm. A permaban as the first action is never a good idea.

Telling your users they can't use certain software to access your HTTP API is exactly the same as telling people they can't use certain browsers to load https://google.com.
When's the last time you read the ToS of a service you signed up for?
This would be a great job for an AI agent. Even better if a few million such agents collectively refused to agree to unconscionable terms.
They were banning people and those people couldn’t even cancel their subscription. That’s a rookie mistake and you expect the same company to have a flawless ban system?