Bay area. Utopian.

One of the “Cloud Drive” providers should create a series of standards for storing user data and start convincing sites to adopt it. They could create a Photos standard, for example:

$ ls Dropbox/sites/picturesharingly.io/Photos

1.json
familyvacation1.jpg

$ cat Dropbox/sites/picturesharingly.io/Photos/familyvacation1.jpg.json
{
  'doctype' : 'Photos/v1.0',
  'created' : '2011-02-14 21:58:13',
  'title' : 'Us and the kids swimming',
  'album' : 'Family Vacation 2011',
  'filename' : 'familyvacation1.jpg',
  ...
}

$ ls Dropbox/sites/news.ycombinator.com/Comments
1.json

$ cat 1.json

{
  'doctype' : 'SocialComments/v1.0',
  'created' : '2012-04-01 12:34:53',
  'parent' : '2131295',
  'body' : 'Chocolate milk is rather delicious...',
  ...
}

Obviously these are just quick examples that I came up with in 2 minutes. You would have to put a decent amount of thought into the standards. Maybe it would be better to store data and metadata separately, for example.

The basic ideas are.

1. Anyone could be your “Cloud Drive” provider. Dropbox, Google Drive, etc. You would OAuth your preference when you sign up for a new service.

2. Sites would store data in pre-defined standard formats (“Photos”, “Comments”, “Votes”, “FriendsList”, etc).

3. Sites could normally only access data they wrote to your drive, but you could optionally give them read-write or read-only access to other site’s data.

4. Sites would still store their own additional data themselves and keep their own copies of your data — or at the very least cache your data for performance/simplicity.

There are some obvious objections anyone would have to this idea, the value is so great to users though that it should be possible to overcome them.

Someone smart will need to figure out all the details. Personally I think Brad Fitzpatrick is ideal person to do it, he seems to have a knack for this kind of thing. It looks like he’s working for Google these days.  Hopefully Google or Dropbox will get on this.

Saw this on Reddit (I think) a week or two ago. Just blew my mind. To anyone who thinks Google hasn’t been innovating in web search:

I thought Microsoft bought Powerset, not Google?

Hacker News Comments 

Last April I discovered that it was possible to reveal the email address of anyone who uploaded a video to Google Video, and it was exceedingly simple for anyone with even basic web skills.

The problem was in the design of their “UniqueKey” value for videos. Someone thought it made sense to include an email address as part of the value, which isn’t necessarily a problem itself, the real problem came when it came time to expose video metadata for use on the frontend.

A URL exists that returns metadata in JSON format for any video, and it includes UniqueKey (which has the user’s email address as part of it):

GET http://video.google.com/docinfo?{"docid":"8794179967207131884"}
{
  "success":true,
  "video_data":{
  "UniqueKey":"GV_UP:someuser@example.com:wsb25__32543_ZNCDLZ1NFSg.avi"
  "Title":"Eurovision Song Contest 1956",
  "Description":"The audio recording of the very first Eurovision Song Contest in 1956.",
  "Duration":4800132,
  ...additional data removed...
}

Google fixed this problem by hiding the UniqueValue, now it always returns an empty string.

The potential for abuse here was pretty obvious. With just a little effort it would have been possible for a bad guy to extract millions of fresh valid email addresses, which would worth a pretty penny to spammers.

The even bigger danger for problems like this is the idea that a dissident might upload content to a web site thinking they’re anonymous and then have their identity revealed. I don’t have any evidence anything like that happened in this case, but that’s the big risk.

The potential impact for problems like this on Twitter, Facebook, or YouTube shouldn’t be underestimated. Those companies are now part of revolutions that topple governments. They’ve had a huge responsibility thrust upon them.

Over the years I’ve sent in similar types of problems to various web sites. Google definitely does a better job than most.

What is Google’s problem that they don’t know how to charge correctly for their APIs and web services? They’re squandering a potentially huge new global business.

Some ridiculous pricing examples:

As pbz said on Hacker News “Google has only two dials: free or expensive”

• Google Analytics Premium starts at $150,000/year.
• Google Commerce Search starts at $25,000/year.
• Google Maps costs $4 – $8 CPM (above the free tier).
• Google App Engine pricing went from $360/year to $4,000/year for some users.

These are ridiculous prices, and it’s a result of Google not having a comprehensive and well thought out strategy around their APIs and web services.

Just Copy AWS, Damn it.

It’s not really that hard either. Bezos already paved the way. Stop giving away the farm, then panicking, and trying to charge massive amounts to make the math work.

Instead, create very low free tiers and charge almost everyone. Any real business that uses Google Analytics would happily pay a bit of money for it. Even keeping it free for low-traffic sites it would be a huge new source of revenue.

Same thing with Google Maps. Instead of giving away 25k/req per day, give away 1k/req per day. That lets anyone get started for free, but means anyone doing anything serious needs to pay. Don’t charge them $4 CPM though, make it closer to $0.04 CPM.

Take the Layer Above AWS

Even though they missed the boat on infrastructure services (servers/load balancing), they still are in the best position dominate on the layer of services above that (analytics/maps/search/translation, etc). That’s where their skills outmatch anyone anyway.

Stop Treating it Like a Toy

Google could eventually make as much profit from their APIs and web services as they do from search. This could be what Microsoft’s business would have looked like had they been a web company. They’ve got the programmers to create every useful web service imaginable.

Instead of sticking all this stuff in “beta” or “labs” and ignoring it, start treating it like it’s as important as search is (speaking of which: offer a damn web search API again, and charge for it, you fools!)

I really hope Google’s business strategy will catch up with their technical skills. They have such a great opportunity in front of them and it would benefit the web immensely.

Posted on Hacker News