We don’t indulge too often in looking back, but [Chloe Albanesisu] at PC Magazine did and wrote the tech obituary for all the tech gadgets and services that died over this past year. Some of the entries are a bit predictable: Twitter died to be replaced by X, which is exactly like it, only different. Others we hardly noticed, like Netflix stopping its DVD shipments.
Google Glass died again, but this time it was the enterprise edition. Amazon gave up on both donating money through shopping and print subscriptions via Kindle.
Glass wasn’t the only Google casualty. Gmail lost its basic HTML version and shut down its smart whiteboard product, Jamboard. They also sold off their Internet domain business in an effort to focus on core businesses. Other notable Google shutdowns include their popular podcast app and Usenet support for Groups. Oh, and don’t forget their experiment in offering Pixels phones as a subscription. That’s done, too.
As you might expect, PC Magazine’s list is a bit consumer-oriented. What hacker-centric products and services vanished this year that you’ll miss? The Sculpteo Marketplace? XYZ Printing? Start up companies collapsed in 2023 at an alarming rate, but you didn’t hear about most of them. Were there any you were especially disappointed about? Let us know in the comments.
The reports of the death of automotive AM radio may have been greatly exaggerated. Regular readers will recall us harping on the issue of automakers planning to exclude AM from the infotainment systems in their latest offerings, which doesn’t seem to make a lot of sense given the reach of AM radio and its importance in public emergencies. US lawmakers apparently agree with that position, having now introduced a bipartisan bill to require AM radios in cars. The “AM for Every Vehicle Act” will direct the National Highway Transportation Safety Administration to draw up regulations requiring every vehicle operating on US highways to be able to receive AM broadcasts without additional fees or subscriptions. That last bit is clever, since it prevents automakers from charging monthly fees as they do for heated seats and other niceties. It’s just a bill now, of course, and stands about as much chance of becoming law as anything else that makes sense does, so we’re not holding our breath on this one. But at least someone recognizes that AM radio still has a valid use case.
Despite the popularity of social media, for communication that actually matters, e-mail reigns supreme. Crucial to the smooth operation of businesses worldwide, it’s prized for its reliability. Google is one of the world’s largest e-mail providers, both with its consumer-targeted Gmail product as well as G Suite for business customers [Jeffrey Paul] is a user of the latter, and was surprised to find that URLs in incoming emails were being modified by the service when fetched via the Internet Message Access Protocol (IMAP) used by external email readers.
This change appears to make it impossible for IMAP users to see the original email without logging into the web interface, it breaks verification of the cryptographic signatures, and it came as a surprise.
Security Matters
A test email sent to verify the edits made by Google’s servers. Top, the original email, bottom, what was received.
For a subset of users, it appears Google is modifying URLs in the body of emails to instead go through their own link-checking and redirect service. This involves actually editing the body of the email before it reaches the user. This means that even those using external clients to fetch email over IMAP are affected, with no way to access the original raw email they were sent.
The security implications are serious enough that many doubted the initial story, suspecting that the editing was only happening within the Gmail app or through the web client. However, a source claiming to work for Google confirmed that the new feature is being rolled out to G Suite customers, and can be switched off if so desired. Reaching out to Google for comment, we were directed to their help page on the topic.
The stated aim is to prevent phishing, with Google’s redirect service including a link checker to warn users who are traveling to potentially dangerous sites. For many though, this explanation doesn’t pass muster. Forcing users to head to a Google server to view the original URL they were sent is to many an egregious breach of privacy, and a security concern to boot. It allows the search giant to further extend its tendrils of click tracking into even private email conversations. For some, the implications are worse. Cryptographically signed messages, such as those using PGP or GPG, are broken by the tool; as the content of the email body is modified in the process, the message no longer checks out with respect to the original signature. Of course, this is the value of signing your messages — it becomes much easier to detect such alterations between what was sent and what was received.
Inadequate Disclosure
Understandably, many were up in arms that the company would implement such a measure with no consultation or warning ahead of time. The content of an email is sacrosanct, in many respects, and tampering with it in any form will always be condemned by the security conscious. If the feature is a choice for the user, and can be turned off at will, then it’s a useful tool for those that want it. But this discovery was a surprise to many, making it hard to believe it was adequately disclosed before roll-out. The question unfolded in the FAQ screenshot above hints at this being part of Google’s A/B test and not applied to all accounts. Features being tested on your email account should be disclosed yet they are not.
Protecting innocent users against phishing attacks is a laudable aim, and we can imagine many business owners enabling such a feature to avoid phishing attacks. It’s another case where privacy is willingly traded for the idea of security. While the uproar is limited due to the specific nature of the implementation thus far, we would expect further desertion of Google’s email services by the tech savvy if such practices were to spread to the mainstream Gmail product. Regardless of what happens next, it’s important to remember that the email you read may not be the one you were sent, and act accordingly.
Update 30/10/2020: It has since come to light that for G Suite users with Advanced Protection enabled, it may not be possible to disable this feature at all.
For many people, Gmail is synonymous with e-mail. Some people like having cloud access to everything and some people hate having any personal data in the cloud. However you feel about it, one thing that was nice about having desktop software is that you could hack it relatively easily. If you didn’t like how your desktop mail client worked, you had a lot of options: use a different program, write your own, hack the executable of your current program, or in the case of open source just fork it and make any changes you are smart enough to make.
Google provides a lot of features with all of its products, but however you slice it, all the code runs on their servers out of your reach. Sort of. If you know JavaScript, you can use Google Apps Script to add features to many Google products including Gmail. If you’ve used Office scripting, the idea is the same, although obviously the implementation is very different.
With scripting you can make sophisticated filters that would be very hard to do otherwise. For example, monitor for suspicious messages like those with more than 4 attachments, or that appear to come from a contact between the hours of 2AM and 5AM.
For our example today, I’m going to show you something that is easy but also highly useful.
Google is pulling the plug on their social network, Google+. Users still have the better part of a year to say their goodbyes, but if the fledgling social network was a ghost town before, news of its imminent shutdown isn’t likely to liven the place up. A quick check of the site as of this writing reveals many users are already posting their farewell messages, and while there’s some rallying behind petitions to keep the lights on, the majority realize that once Google has fallen out of love with a project there’s little chance of a reprieve.
To say that this is a surprise would be disingenuous. We’d wager a lot of you already thought it was gone, honestly. It’s no secret that Google’s attempt at a “Facebook Killer” was anything but, and while there was a group of dedicated users to be sure, it never attained anywhere near the success of its competition.
According to a blog post from Google, the network’s anemic user base isn’t the only reason they’ve decided to wind down the service. A previously undisclosed security vulnerability also hastened its demise, a revelation which will particularly sting those who joined for the privacy-first design Google touted. While this fairly transparent postmortem allows us to answer what ended Google’s grand experiment in social networking, there’s still one questions left unanswered. Where are the soon to be orphaned Google+ users supposed to go?
One of the tasks I dread is configuring a web server to send email correctly via Gmail. The simplest way of sending emails is SMTP, and there are a number of scripts out there that provide a simple method to send mail that way with a minimum of configuration. There’s even PHP mail(), although it’s less than reliable.
Out of the box, Gmail requires OAUTH2 for authentication and to share user data, which has the major advantage of not requiring that you store your username and password in the application that requires access to your account. While they have an ‘allow less secure apps’ option that allows SMTP access for legacy products like Microsoft Outlook, it just doesn’t seem like the right way forward. Google documents how to interact with their API with OAUTH2, so why not just use that instead of putting my username and password in plaintext in a bunch of prototypes and test scripts?
Those are the thoughts that run through my head every time this comes up for a project, and each time I’ve somehow forgotten the steps to do it, also forgotten to write it down, and end up wasting quite a bit of time due to my own foolishness. As penance, I’ve decided to document the process and share it with all of you, and then also make it work on an ESP8266 board running the Arduino development environment.
While it is often said that “necessity is the mother of invention”, we can’t say that’s always been our experience here at Hackaday. You won’t need to search too long before you find a project or hack on this site that definitely falls out of the realm of strict necessity. But that’s part of the fun, there’s a reason this site isn’t called AppropriateUseOfTime.com
The heart of the machine is everyone’s favorite Linux board, the Raspberry Pi. You might be thinking the Pi is overkill for a simple timer, and you’d be right. Rather than just dump the food out on a set schedule, [Sam] decided to get a little fancy and come up with some Python scripts that will monitor a GMail inbox and activate the feeder hardware when it receives an email with the title “feed cats”. He then uses IFTTT to send the appropriately named email to the GMail account of his cat feeder on a specific schedule. Hey, nobody said necessity was the mother of straightforward invention.
In the final post of the series, [Sam] goes over the hardware side of the device. Copper pipe makes up the frame, which holds a commercial off-the-shelf dry food dispenser. The feeder was designed for manual operation, but by attaching a continuous rotation servo [Sam] can spin it up and dump a pre-measured amount of food via the Pi’s GPIO pins. The addition of some PVC pipe and fittings takes the food and (at least in theory) divides it equally between the two cat bowls below.
