Serious Privacy Problems with Bots on Google Wave

Posted by knorby on February 25, 2010 under Python, app engine, facebook, fortune, google, internet, privacy, wave | Be the First to Comment

I started writing this post while Google Wave was still pretty new, but it has been out for a while and half forgotten. It is still in closed preview, but it shouldn’t be hard to find an invite if you want to check it out. As I mentioned in my last post on wave, I wrote a quick fortune bot for wave. The bot got a decent bit of use at first, as many people played around, but now  use has dropped to almost nothing. Based on my own use, I figured early on that most of the use was from 1 or 2 real people interacting with a bunch of bots. I tested and confirmed that with the data google records by default.

Google App Engine, on which all bots must be hosted, by defaults logs any request and any error. A bot can register a number of different events, which will trigger a request to the bot. In the request, the state of the wave is contained in a json format. The log files can easily be downloaded, and the json easily parsed. From that, you see everything. You see the addresses of everyone, you see what has been entered,  even if it doesn’t relate to the events of the bot. As far as I am aware, no TOS or privacy agreement exists that covers the use of this data, and even if it were, the most nefarious uses still would be silent.

By putting data on any web app, you put yourself up to the same risks and invasions. The google ads in gmail are targeted at you for a reason after all. If you are using gmail though, it is a safe belief that google will be the only one other than you to see your data. A bot could be maintained by anyone. Facebook apps are a decent comparison. I have looked at the API a couple times, but my understanding is even with the permissions a user can grant or deny, apps get to see a lot. A fair bit of criticism has been made of this platform, but it is very safe to say the privacy structure in place on bots is much worse. Aside from the lack of permission controls, would you use something like facebook apps on your e-mail or google docs (to the extent that makes sense…)? I hope not.

A wave user has a somewhat unique problem here. If a bot provides a useful service to a particular use, and the wave for this use is private, should you use it? That isn’t a question anyone should have to ask. The question of “put this data in this web app or not” is one thing, but you shouldn’t have to worry about using a pivot tables tool on an online spreadsheet, which is essentially what is going on with bots here. There isn’t really way to distinguish what is a good bot vs. a bad one either. If I wanted to snoop on people on wave, I would write a useful bot, and no one, google included, would be the wiser to what I was doing with the collected data.

I don’t think there is an easy way to fix bots as they are. Anonymous search results aren’t really that anonymous, and I would guess wave data would be much worse. The problem isn’t that App Engine logs requests; the problem is what wave sends. If you consider the data in a wave in anyway private, I would recommend against using  bots.

My Project Ideas for Google Wave

Posted by knorby on November 10, 2009 under Python, coding, doit, google, internet, wave | 3 Comments to Read

Silly:

  • fortune/doit – Implemented. See Wave Fortune. You can use it be adding wavefortune@appspot.com to your contacts. I mostly made this bot to satisfy my fortune lust, and to get more familiar with app engine and the wave bot api.
  • wompus/adventure – Not sure I am actually going to do this one. If I do, it will be the wompus. Basically, the problem to solve is effectively storing state for such games. Wompus is tiny, and the games are short, so it wouldn’t take much thinking. Adeventure/zork would require a lot more work, and I honestly don’t care that much.

Tools:

  • logging interface – It occurs to me that wave might work great in a situation where I think e-mail falls short now: data/msg dumps. I see this sort of thing at my jobs a lot. I get a log messages I generally don’t care about, and I filter them out, and as a result I sometimes miss something. A similar case is something like a bug tracker, where so many replies can be generated that the thread is easy to ignore. Centralization would help a lot I think, but again, I am not sure I care.
  • RPN calculator - Nothing really to explain here. Could do save the calculator’s state in past blips, and make them editable. The end result would be a collaborative calculator of sorts. Could be interesting.
  • something with jMol – Not too much thought here. When I was a student in the Computational Material Science group at ORNL, I ended up playing with jMol a bit from javascript. Some sort of gadget/bot combo could do some interesting stuff, but again, I don’t care.

I will post more about my thoughts on wave later on, as I have many mixed thoughts on it. Google has a lot to do, both on wave itself and extensions that they should provide. I am hesitant to work on large projects, as I don’t want to have google copy my work, or experience some odd situation with app engine. I don’t think anyone, google included, has any remote idea of what to expect from wave yet.

IQs and the Internet

Posted by knorby on November 26, 2008 under Python, google, internet | Be the First to Comment

After reading the comments on a story on reddit on IQs, I became curious about how IQs are reported on the internet. A few people were saying that when they see someone mention their IQ on the internet, it is usually above 130. The explanations given were along the lines of people lying, biased online tests, and segmentation in where people browse. I was curious what sort of frequencies the different IQs are mentioned, so I wrote up a little python to get the google search results for IQs 50-199 (I would have included lower values after seeing the result, but I choose to go the scraping route rather than gdata, which ends up getting you blocked by google, something I didn’t know). I ran the number with the word “iq”; I think there may be better queries, but simple seemed good enough. Here are the results, plotted with matplotlib:

I found these kind of surprising. Most of the result counts were around 6 million, but there were a few sharp drops. I was especially surprised by 100 and 130, since, if memory serves, 100 is the 50th-percentile for IQs and 130 is the 99th; I would expect a greater count on these two, since more sites would include those numbers while explaining the scale; instead, there are large drops. Weird. I don’t think there is any connection between these results and anything proposed on reddit either.

What Happened to Google Street View?

Posted by knorby on July 20, 2008 under Chicago, google, internet, uchicago | 5 Comments to Read

Google Street View Map of Hyde Park. The streets without highlighting cannot be viewed.

Google Street View Map of Hyde Park. The streets without highlighting cannot be viewed.

I noticed recently that many of the streets in Hyde Park lost Google Street View, notably where my current apartment is. I also noticed that many of the streets had darkened. Is it really necessarily to remove the images? There used to be pictures taken inside the quads as well, which are now gone; I thought those might have been removed by request of the university, but I don’t really get why they removed the other ones. If they wanted to update them, fine, but there is no reason to remove images. I suppose it is a free service, so I have no right to complain, but I just think it is screwy when I can see my home in Oak Ridge, but not in Chicago. I did some quick googling, but nothing came up. Any ideas?

I’m on the Google Open Source Blog!

Posted by knorby on June 6, 2008 under ACM, Chicago, GSoC, OpenBSD, blogs, coding, globus, google, personal, uchicago | Read the First Comment

It’s true! Borja wrote up a summary of the GSoC lightening talk event, including pictures. If you don’t know what I look like, I am in both the GSoC student one and the ACM officer one. I really wish I got a haircut before this thing….

Borja linked to our website, which hopefully won’t get too much traffic. It is currently at 359 days of uptime, and I have shooting for a year of uptime before upgrading to the latest and greatest version of OpenBSD.

GSoC Lightening Talk at Google Chicago!

Posted by knorby on May 24, 2008 under ACM, Chicago, GSoC, Python, globus, google, personal, uchicago | 2 Comments to Read

The ACM (just Borja really) organized a trip to Google Chicago, where all of the Google Summer of Code students who were accepted from UChicago (and in the US) gave lightening talks on our projects, which included me. The other GSoC students were Marcus Westin, Jordon Lewis, and Nick Edds. I put up my talk, as well as a more general page for my project on my CS site. Marcus and I both have projects with the Globus Alliance, so I was quite happy that he went before me, as I didn’t have to explain what Globus is. My project is fairly straight foreword to explain and I still don’t know the Globus Toolkit (GT) that well, so I couldn’t answer too many questions, and I ended up going under in time. Everyone seemed most interested in Nick’s project, since it is on the 2to3 tool in python, and a decent amount of the audience used Python, some with a great deal of dedication (it was at Google after all). I am pretty excited to see how Nick’s project turns out; we both went to the talk that his mentor, Collin Winter, gave at PyCon on the tool and the issues that Nick is working to fix.
The Chicago office’s engineering crew is dominated by subversion developers (in the small selection of software I like), but most of the presentations were about most unrelated projects. Ben Collins-Sussman discussed a VM for interactive fiction games like zork (I’ll still play my zork on the SDF TWENEX Machine; the version of zork installed is from 1981!). Karl Fogel, not a current Google developer, but subversion developer and good friend of the other googlers, gave a talk on script he wrote to help track patches from non-core developers based on logs. He put up some stats on the differences between subversion and GNU Emacs as projects; it further straightened my reasoning for using XEmacs. I went to a Russian choir concert the night before, as I had to go to a concert from a genre I don’t have any familiarity with, which he apparently was in; what a small world I live in. Brian Fitzpatrick gave a shortened version of the keynote he have at PyCon on balancing functional complexity with usability in software. Like all the other talks I have heard him give, it was an excellent talk; he has one of the best uses of slide shows I have seen, and I always end up thinking about the talks much later. There was also a talk from a developer for Blogger (he said he was now on feedburner); I would give his name, but I can’t remember it at the moment. I talked to him for a bit; I think my social awkwardness was in full swing at the time. I asked him about something I read on Valleywag about Google adding some preference search rankings with Blogger (I can’t find the post at the moment; I will link to it if I do); as I am sure is the case, he said that Google does no such evil. He also mentioned that Google crawls its own site with the same bot, which makes sense, but I hadn’t thought about it before. I wish I knew Blogger better, as I used it once for something else and had a couple thoughts about its workings.
It was a fairly awesome evening. I was very sleep deprived after one of my harder weeks here, so I was defintely in a strange state for the entirity of the thing. My thanks and appretiation go out to Borja and Google for this event. Apparently, my glorious face might end up on the GSoC blog or the Google open source blog.

Google Adds Some Translate Bots

Posted by knorby on December 19, 2007 under IM, google, internet, language, translation | Read the First Comment

On the Google GTalk blog yesterday, a set of Google bots that translate was announced. I played around with a couple for a bit. It doesn’t seem to be anything special; it is just a bot interface to the Google translation services. I noticed that if you group chat with several of them, the one with the best answer would respond. So for example, when I was chatting with nl2en and en2nl, if said “hello”, en2nl would respond with “Hallo”, and if I said “Hallo”, nl2en would respond with “Hallo”. Anyways, the GTalk blog post does not include the full list of addresses, so I did. Here it is:


ar2en@bot.talk.google.com, de2en@bot.talk.google.com, de2fr@bot.talk.google.com, el2en@bot.talk.google.com, en2ar@bot.talk.google.com, en2de@bot.talk.google.com, en2el@bot.talk.google.com, en2es@bot.talk.google.com, en2fr@bot.talk.google.com, en2it@bot.talk.google.com, en2ja@bot.talk.google.com, en2ko@bot.talk.google.com, en2nl@bot.talk.google.com, en2ru@bot.talk.google.com, en2zh@bot.talk.google.com, es2en@bot.talk.google.com, fr2de@bot.talk.google.com, fr2en@bot.talk.google.com, it2en@bot.talk.google.com, ja2en@bot.talk.google.com, ko2en@bot.talk.google.com, nl2en@bot.talk.google.com, ru2en@bot.talk.google.com, zh2en@bot.talk.google.com

I also made a contact list suitable for import in gmail, which includes full language names in the contact name.

CSV File: Gmail Contact List (csv) with GTalk Translate Bots

I Need a New Hobby…..

Posted by knorby on December 3, 2007 under google, humor, personal | Be the First to Comment

Gmail - 666 unread For the last few days, I have kept my Gmail inbox at 666 unread messages. When it first hit, I got a quick laugh; I am not at all religious, so its not like “666″ has any particular meaning to me, other than the fact that I think it’s a dumb thing to care about.

Since then, however, it has become a force far darker. I feel this compulsion to either read mail as soon as it comes in or to leave messages unread just so I can keep my inbox at 666 unread messages. I just can’t stop!

So I am guessing I am going to get tired of it in about four days tops, at which point I will go back to my normal routine of letting mail pile up and then mass archiving it.