Google App Script permissions does not block event driven code!

Like so many others, I woke up one day to find that Google would no longer allow my App Scripts to run. I'd get a Kafkaesque "App Blocked" popup with no info about why it happened or how I could fix it. Agh.

Turns out this is a known problem and google sometimes just blocks some accounts from running their own App Scripts on their own documents to protect them from unspecified risky behavior.

Well just to show how silly this is - turns out that they only block the code from running when you request it to run - but automatic triggers still work just fine! If security was actually the goal, when then I'd argue that there is more risk to automatically and silently running code every time a spreadsheet is loaded or any time a cell is change than there is for running code that the user request when they request it!

This video is a demo showing (1) code that access no protected data or APIs at all getting blocked and, (2) code that access the users data getting run whenever a cell is changed.

I've said it before, I'll say it again - if you were thinking about using Google Cloud Services for anything then think again. This is crap built on top of crap that no one at google understands and it occasionally breaks suddenly and catastrophically, and there is no one who can even tell you what is going on much less how or when or if it is going to get fixed.

Stack Exchange Link Question: