CNET reports: With the next version of Chrome, Google is moving ahead with a plan to improve privacy and security by reining in some abilities of extensions used to customize the browser. The move had angered some developers who expected earlier it would cripple ad blockers. Manifest v3, the programming interface behind Google's security plans, will arrive with Chrome 88 in mid-January, Google said Wednesday at the Chrome Dev Summit. Extensions using the earlier Manifest v2 will still work for at least a year... Among other things, Manifest v3 limits the number of "rules" that extensions may apply to a web page as it loads. Rules are used, for example, to check if a website element comes from an advertiser's server and should therefore be blocked. Google announced the changes two years ago. Reducing the number of rules allowed angered creators of extensions like the uBlock Origin ad blocker and the Ghostery tracking blocker. They said the rules limits will stop their extensions from running their full lists of actions to screen ads or block tracking. That could let websites bypass extensions — and the preferences of people who installed them... The shift brought on by Manifest V3 will spread to all browsers, to the detriment of ad blocking software, predicted Andrey Meshkov, co-founder and chief technology officer of AdGuard, an ad-blocking extension... Ghostery is working to update its extension for Manifest V3 but would rather spend its time on "real privacy innovations," President Jeremy Tillman said in a statement Wednesday. "We still have real misgivings that these changes have more to do with Google protecting its bottom line than it does with improving security for Chrome users...." The importance of the Chrome team's choices are magnified by the fact that other browsers, including Microsoft Edge, Vivaldi , Opera and Brave, are built on its Chromium open-source foundation. Microsoft said it will embrace Manifest v3, too. "Another Manifest v3 change is that extensions no longer may update their abilities by downloading code from third-party sites. "The entire extension now must be distributed through the Chrome Web Store, a measure Google says improves security screens and speeds reviews."

Read more of this story at Slashdot.

Programming columnist Mike Melanson writes: As part of its involvement in the recently announced Open Source Security Foundation (OpenSSF), Google has penned a blog post outlining one of the first steps it will take as part of this group, with an attempt at finding critical open source projects. "Open source software (OSS) has long suffered from a 'tragedy of the commons' problem," they write. "Most organizations, large and small, make use of open source software every day to build modern products, but many OSS projects are struggling for the time, resources and attention they need." So as a way to address this problem, and help fund those projects that need funding, Google is releasing the Criticality Score project. The project gives projects a criticality score (a number between 0 and 1) that is "is derived from various project usage metrics" such as "a project's age, number of individual contributors and organizations involved, user involvement (in terms of new issue requests and updates), and a rough estimate of its dependencies using commit mentions." From there, you can also add your own metrics, if you see fit... Abhishek Arya, one of the project's creators, points out that the project is still in its initial phases and welcoming feedback on "any ideas on metrics we can use." Arya also notes that the project is currently limited to ranking open source projects hosted on GitHub, but "will be expanding to our source control system in the near future." "Though we have made some progress on this problem, we have not solved it and are eager for the community's help in refining these metrics to identify critical open source projects," the blog post announcing the project concludes.

Read more of this story at Slashdot.

Google is making it even easier to work with Microsoft Office files, with the company now allowing users to directly edit attached Office files in Gmail, much like it already allows with Google Docs or Sheets files. The Verge reports: Now, you can directly open and edit an Office file using the Google Docs editor just by clicking on it -- just like you would a native Google Doc. But the new editing function doesn't convert Office files into Google Docs, instead preserving the original file format. Gmail will allow users to respond to the original email and include the now-updated file (still in an Office file format) without first requiring that they download and then re-attach the updated file. Google is also working to help ensure that Office files work more smoothly in Google Docs, with the company launching a new Macro Converter add-on for Google Workspace that's designed to help users and organizations import their macros from Excel to Sheets more easily. Similarly, Google is working on adding better document orientation and image support to Google Docs, allowing for documents with both horizontally and vertically oriented pages, along with images placed behind text and watermarks (although the new image features won't be available until next year.)

Read more of this story at Slashdot.

Google, Dell, Intel and a handful of other major tech companies in the IT and cloud computing industries have banded together to tackle joint problems around security, remote work, and other enterprise issues that have only become more important during the coronavirus pandemic. From a report: The consortium these companies have formed is called the Modern Computing Alliance, and its founding members also include Box, Cirtrix, Imprivata, Okta, RingCentral, Slack, VMWare, and Zoom. The Modern Computing Alliance will initially be focused on four areas: performance; security and identity; remote work, productivity, and collaboration; and health care. The goal is to pool knowledge and resources toward solving shared problems around how companies perform work in the cloud and the tools they use to do so. The alliance will focus on developing new standards and interoperable technologies that can be used by any company that relies on one of the partners' platforms or products. In particular, Google is engaged in the effort with its Chrome browser and Chrome OS teams, as well as the division responsible for Google Workplace. "Today, we're excited to announce Google's membership in the Modern Computing Alliance -- to address the biggest IT challenges facing companies today with integration from silicon to cloud," says John Solomon, Google's vice president of Chrome OS. "Working with a group of forward-thinking industry leaders, we're aligning standards and technologies to provide companies with the choice of high-performance, cloud-first computing solutions from the vendor of their choice who provide modern solutions for the modern era of business."

Read more of this story at Slashdot.

France's data protection agency, the CNIL, has slapped Google and Amazon with fines for dropping tracking cookies without consent. From a report: Google has been hit with a total of $120M for dropping cookies on Google.fr and Amazon ~$42M for doing so on the Amazon .fr domain under the penalty notices issued today. The regulator carried out investigations of the websites over the past year and found tracking cookies were automatically dropped when a user visited the domains in breach of the country's Data Protection Act. In Google's case the CNIL has found three consent violations related to dropping non-essential cookies.

Read more of this story at Slashdot.

An anonymous reader quotes a report from Ars Technica, written by Ron Amadeo: Google and Samsung want to work together on smart home compatibility. The two companies put out dueling press releases today, saying that Google Nest devices would work better with Samsung SmartThings, ending a war between the SmartThings community and Nest/Google/Alphabet that has been going on for years. Samsung says that "Google Nest devices, including thermostats, cameras and doorbells, will be "Works With SmartThings" (WWST) certified, allowing users to seamlessly control their smart homes through SmartThings." Nest has long been the most insular smart home company, and now it sounds like Nest devices are finally going to start playing nice with your other smart home devices. As a user of the Google and SmartThings ecosystem, there are a few things missing from the announcement that I would like to see. SmartThings is supporting Nest and Google, but I don't see anything about Google reciprocating and supporting SmartThings better. Like I complained about in the Android 11 review (which included a Google Assistant-powered smart home control panel), Google's smart home support is exclusionary toward devices that compete with Nest products. Google supports controlling SmartThings-compatible lights (and, really, every light imaginable), because Nest doesn't make a light bulb or switch, but it doesn't work with door locks, because Nest makes a door lock (Google and Samsung both seem to have forgotten about the Yale x Nest Lock in today's announcement). Google's "Nest Hub" smart display can show camera feeds, but only Nest camera feeds. The Nest exclusivity here isn't doing Google any favors, and more open hardware support would really improve the appeal of the Nest Hub smart display.

Read more of this story at Slashdot.

New submitter RealNeoMorpheus shares a Google blogpost about Fuchsia -- a new open source operating system that has been in the works for several years: Fuchsia is a long-term project to create a general-purpose, open source operating system, and today we are expanding Fuchsia's open source model to welcome contributions from the public. Fuchsia is designed to prioritize security, updatability, and performance, and is currently under active development by the Fuchsia team. We have been developing Fuchsia in the open, in our git repository for the last four years. You can browse the repository history at fuchsia.googlesource.com to see how Fuchsia has evolved over time. We are laying this foundation from the kernel up to make it easier to create long-lasting, secure products and experiences. Starting today, we are expanding Fuchsia's open source model to make it easier for the public to engage with the project. We have created new public mailing lists for project discussions, added a governance model to clarify how strategic decisions are made, and opened up the issue tracker for public contributors to see what's being worked on. As an open source effort, we welcome high-quality, well-tested contributions from all. There is now a process to become a member to submit patches, or a committer with full write access. In addition, we are also publishing a technical roadmap for Fuchsia to provide better insights for project direction and priorities. Some of the highlights of the roadmap are working on a driver framework for updating the kernel independently of the drivers, improving file systems for performance, and expanding the input pipeline for accessibility.

Read more of this story at Slashdot.

Google Fiber has made its 2Gbps service "widely available" in Nashville, Tennessee, and Huntsville, Alabama, the company said Thursday. CNET reports: New and existing Google Fiber customers in Nashville and Huntsville can choose either 1-gigabit-per-second service for $70 a month, or 2Gbps service for $100 a month. The latter is designed for "power users, the latest devices, and advanced smart homes that use lots of internet," Google said in a blog post. The 2Gbps service comes with the Google Fiber Multi-Gig Router, which uses Wi-Fi 6. Google Fiber launched in 2010 with 1Gbps speeds, and now provides internet service in more than a dozen US cities. Customers who aren't in Nashville or Huntsville can sign up to test 2Gbps service through the company's Trusted Tester program.

Read more of this story at Slashdot.

A change made in the Google Chrome browser in October has impacted the performance of the Google Fonts service for millions of websites. From a report: The change is an update to Chrome's internal cache system. A browser's cache system works by serving as a temporary storage system for images, CSS, and JavaScript files used by websites. Files stored in the cache are typically reused across multiple sites instead of having the browser re-download each file for every page/tab load. But with the release of Chrome 86 in early October 2020, Google has overhauled how Chrome's entire caching system works. Instead of using one big cache for all websites, Google has "partitioned" the Chrome cache, which will now be storing resources on a per-website and per-resource basis. While this is a big win for user security, preventing some forms of web attacks, this change has affected web services designed around the old cache system.

Read more of this story at Slashdot.

Google News Showcase visitors will soon be able to read select paywalled articles at no extra charge. TechCrunch reports: Google says it will be paying participating publishers to provide "limited access to paywalled content for News Showcase users." Those users will, however, still need to register directly with the publishers, which Google says will give them a way to build a relationship. The main News Showcase format is essentially story panel, and Google says it's introducing a new panel allowing publishers to curate a daily selection of their most important stories. Those panels will be shown to users who follow those publishers. Google is also bringing the News Showcase to new devices and channels. It started out on Google News on Android and is now available on iOS as well, with plans to expand to the news.google.com website and Discover soon. And it says it has doubled the number of partners since the launch in October -- the list of nearly 400 publishers participating in the program includes new names like Le Monde, Courrier International, L'Obs, Le Figaro, Liberation and L'Express in France, plus Pagina12, La Gaceta and El Dia in Argentina.

Read more of this story at Slashdot.

An anonymous reader quotes a report from The Verge: Google violated US labor laws by spying on workers who were organizing employee protests, then firing two of them, according to a complaint to be filed by the National Labor Relations Board (NLRB) today. The complaint names two employees, Laurence Berland and Kathryn Spiers, both of whom were fired by the company in late 2019 in connection with employee activism. Berland was organizing against Google's decision to work with IRI Consultants, a firm widely known for its anti-union efforts, when he was let go for reviewing other employees' calendars. Now, the NLRB has found Google's policy against employees looking at certain coworkers' calendars is unlawful. "Google's hiring of IRI is an unambiguous declaration that management will no longer tolerate worker organizing," Berland said in a statement. "Management and their union busting cronies wanted to send that message, and the NLRB is now sending their own message: worker organizing is protected by law." Spiers was fired after she created a pop-up for Google employees visiting the IRI Consultants website. "Googlers have the right to participate in protected concerted activities," the notification read, according to The Guardian. The company said Spiers had violated security policies, a statement that hurt her reputation in the tech community. Now, the NLRB has found the firing was unlawful. "This week the NLRB issued a complaint on my behalf. They found that I was illegally terminated for trying to help my colleagues," Spiers said. "Colleagues and strangers believe I abused my role because of lies told by Google management while they were retaliating against me. The NLRB can order Google to reinstate me, but it cannot reverse the harm done to my credibility."

Read more of this story at Slashdot.

Google is laying the groundwork for a fiber-optic network that for the first time will connect through historical enemies Saudi Arabia and Israel while opening a new corridor for global internet traffic, according to people familiar with the plans. From a report: The project linking India to Europe is Google's latest globe-crossing internet construction effort. The Alphabet subsidiary is vying with Facebook to build more network capacity to support its surging user demand for videos, search results and other products. Expanded connectivity between Europe and India would also help Google roll out data centers globally and catch up to rivals Microsoft and Amazon.com in the business of on-demand cloud-computing. Google, which names most of its internet cables after scientists, has dubbed the new route Blue Raman after Indian physicist Chandrasekhara Venkata Raman. A submarine cable project the length of Blue Raman -- at more than 5,000 miles -- would cost typically up to $400 million, according to Dubai-based telecommunications firm Salience Consulting. Google is expected to turn to telecom-company partners to help fund the project, including Oman Telecommunications and Telecom Italia, which are helping finance the route, according to those with knowledge of the project. Those partners and others will help fund the cable's construction while sharing its fiber-optic infrastructure. Those familiar with Google's Blue Raman project cautioned that it still might not materialize. Because it crosses multiple borders, the project will require agreements with several regulators, and one setback could force Google to redesign the route. For example, Google's consortium still lacks the go-ahead it needs from Saudi government authorities to connect the Blue Raman project, some of these people said.

Read more of this story at Slashdot.

Google's Stadia game-streaming service, which has been limited to Android phones, computers and TVs, will launch for the iPhone in the coming weeks. The Verge reports: Google on Thursday announced iOS support for its Stadia cloud gaming service, following in the footsteps of Microsoft in turning to the mobile web to circumvent Apple's App Store restrictions. Google says it has been building a progressive web app version of Stadia that will run in the mobile version of Apple's Safari browser, similar to how Microsoft intends to deliver its competing xCloud service on iOS sometime next year. But Google intends to beat Microsoft to the punch with public testing of its version in the coming weeks. Nvidia also announced today that it a beta web app version of its GeForce Now cloud gaming service on iOS is available today. Apple in late August clarified its rules around cloud gaming, telling providers like Google and Microsoft that their apps were not allowed on the App Store due to restrictions Apple imposes on software that streams games to the iPhone and iPad. Apple eventually loosened its restrictions after public criticism from Microsoft and others, but the App Store still requires companies to submit individual games for App Store review. Microsoft called the compromise a "bad experience for consumers" before deciding it would develop a web app version of xCloud for iOS instead. Now, Google is doing the same.

Read more of this story at Slashdot.

Four years after offering special placement in a "top stories carousel" in search results to entice publishers to use a format it created for mobile pages, called AMP, Google announced last week that it will end that preferential treatment in the spring. "We will prioritize pages with great page experience, whether implemented using AMP or any other web technology, as we rank the results," Google said in a blog post. From a report: The company had indicated in 2018 that it would drop the preference eventually. Last week's announcement of a concrete timeline comes less than a month after the Department of Justice called Google a "monopoly gatekeeper to the internet" in a lawsuit alleging antitrust violations and as pressure mounts on officials in the European Union, which has already fined Google more than $9 billion for antitrust violations. "I did always think AMP posed antitrust concerns," said Sally Hubbard, author of the book "Monopolies Suck" and an antitrust expert with the Open Markets Institute. "It's, 'If you want to show up on the top of the search results, you have to play by our rules, you have to use AMP.'" Google spokesperson Meghann Farnsworth did not address the timing of the change but said AMP is not dead, saying the company is "fully committed to AMP as a technology." She said AMP continues to be required for certain features that "are not technically possible" without it, such as "swipe to visit" in Google Images, and that it's "preferred" in the "for you" feed in Google's news reading app, Google Discover.

Read more of this story at Slashdot.

Google said today it plans to add a new section on the Chrome Web Store where extension developers will disclose what user data they're collecting from users and what they plan to do with the information. From a report: The new section is set to go into effect on January 18, 2021, and will appear as a "Privacy practices" button on each extension's Web Store listing. To aid the process, Google has added a new section today in the Web Store dashboard where extension developers will be able to disclose what data they collect from their users and for what purposes.

Read more of this story at Slashdot.

Google is launching a major redesign of its Google Pay app on both Android and iOS today. From a report: Like similar phone-based contactless payment services, Google Pay -- or Android Pay as it was known then -- started out as a basic replacement for your credit card. Over time, the company added a few more features on top of that but the overall focus never really changed. After about five years in the market, Google Pay now has about 150 million users in 30 countries. With today's update and redesign, Google is keeping all the core features intact but also taking the service in a new direction with a strong emphasis on helping you manage your personal finances (and maybe get a deal here and there as well). Google is also partnering with 11 banks to launch a new kind of bank account in 2021. Called Plex, these mobile-first bank accounts will have no monthly fees, overdraft charges or minimum balances. The banks will own the accounts but the Google Pay app will be the main conduit for managing these accounts. The launch partners for this are Citi and Stanford Federal Credit Union. "What we're doing in this new Google Pay app, think of it is combining three things into one," Google director of product management Josh Woodward said as he walked me through a demo of the new app. "The three things are three tabs in the app. One is the ability to pay friends and businesses really fast. The second is to explore offers and rewards, so you can save money at shops. And the third is getting insights about your spending so you can stay on top of your money." Paying friends and businesses was obviously always at the core of Google Pay -- but the emphasis here has shifted a bit. "You'll notice that everything in the product is built around your relationships," Caesar Sengupta, Google's lead for Payments and Next Billion Users, told me. "It's not about long lists of transactions or weird numbers. All your engagements pivot around people, groups, and businesses."

Read more of this story at Slashdot.

"[I]n the coming weeks," Google will show a new blanket setting to "turn off smart features" which will disable features like Smart Compose, Smart Reply, in apps like Gmail; the second half of the same prompt will disable whether additional Google products -- like Maps or Assistant, for example -- are allowed to be personalized based on data from Gmail, Meet, and Chat. Gizmodo reports: Google writes in its blog post about the new-ish settings that humans are not looking at your emails to enable smart features, and Google ads are "not based on your personal data in Gmail," something CEO Sundar Pichai has likewise said time and again. Google claims to have stopped that practice in 2017, although the following year the Wall Street Journal reported that third-party app developers had freely perused inboxes with little oversight. (When asked whether this is still a problem, the spokesperson pointed us to Google's 2018 effort to tighten security.) A Google spokesperson emphasized that the company only uses email contents for security purposes like filtering spam and phishing attempts. These personalization changes aren't so much about tightening security as they are another informed consent defense which Google can use to repel the current regulatory siege being waged against it by lawmakers. [...] Inquiries in the U.S. and EU have found that Google's privacy settings have historically presented the appearance of privacy, rather than privacy itself. [...] So this is nice, and also Google's announcement reads as a letter to regulators. "This new setting is designed to reduce the work of understanding and managing [a choice over how data is processed], in view of what we've learned from user experience research and regulators' emphasis on comprehensible, actionable user choices over data."

Read more of this story at Slashdot.

Matthew Green, a cryptographer and professor at Johns Hopkins University, writes: The Internet is a dangerous place in the best of times. Sometimes Internet engineers find ways to mitigate the worst of these threats, and sometimes they fail. Every now and then, however, a major Internet company finds a solution that actually makes the situation worse for just about everyone. Today I want to talk about one of those cases, and how a big company like Google might be able to lead the way in fixing it. This post is about the situation with Domain Keys Identified Mail (DKIM), a harmless little spam protocol that has somehow become a monster. My request is simple and can be summarized as follows: Dear Google: would you mind rotating and publishing your DKIM secret keys on a periodic basis? This would make the entire Internet quite a bit more secure, by removing a strong incentive for criminals to steal and leak emails. The fix would cost you basically nothing, and would remove a powerful tool from hands of thieves.

Read more of this story at Slashdot.

Slashdot reader Iwastheone shared this report from the Register: Google on Thursday was sued for allegedly stealing Android users' cellular data allowances though unapproved, undisclosed transmissions to the web giant's servers... The complaint contends that Google is using Android users' limited cellular data allowances without permission to transmit information about those individuals that's unrelated to their use of Google services... What concerns the plaintiffs is data sent to Google's servers that isn't the result of deliberate interaction with a mobile device — we're talking passive or background data transfers via cell network, here. "Google designed and implemented its Android operating system and apps to extract and transmit large volumes of information between Plaintiffs' cellular devices and Google using Plaintiffs' cellular data allowances," the complaint claims... Android users have to accept four agreements to participate in the Google ecosystem: Terms of Service; the Privacy Policy; the Managed Google Play Agreement; and the Google Play Terms of Service. None of these, the court filing contends, disclose that Google spends users' cellular data allowances for these background transfers. To support the allegations, the plaintiff's counsel tested a new Samsung Galaxy S7 phone running Android, with a signed-in Google Account and default setting, and found that when left idle, without a Wi-Fi connection, the phone "sent and received 8.88 MB/day of data, with 94 per cent of those communications occurring between Google and the device." The device, stationary, with all apps closed, transferred data to Google about 16 times an hour, or about 389 times in 24 hours. Assuming even half of that data is outgoing, Google would receive about 4.4MB per day or 130MB per month in this manner per device subject to the same test conditions... An iPhone with Apple's Safari browser open in the background transmits only about a tenth of that amount to Apple, according to the complaint... Vanderbilt University Professor Douglas C. Schmidt performed a similar study in 2018 — except that the Chrome browser was open — and found that Android devices made 900 passive transfers in 24 hours... The complaint charges that Google conducts these undisclosed data transfers for further its advertising business, sending "tokens" that identify users for targeted advertising and preload ads that generate revenue even if they're never displayed.

Read more of this story at Slashdot.

In a Wall Street Journal article comparing Apple's HomePod Mini against the competition, a Google spokesperson hinted that the company is working on integrating its Chromecast streaming devices and Nest Audio speakers. The Verge reports: Being able to combine a streaming platform with a smart phone speaker makes a lot of sense for these companies. After all, customers already have all the hardware in their living room -- why not repurpose those speakers to improve the sound of your Netflix movies? Plus, there's the added bonus of inciting customers to stay within a company's ecosystem. You're more likely to buy a HomePod mini if it works with the Apple TV you already have. The ability to link smart speakers to streaming boxes is also something that both Apple and Amazon already offer. Google's plans are extremely vague for now -- The Wall Street Journal makes no mention of which devices the company is looking to link together, when the feature will arrive, or what sort of use cases it's looking to achieve. But with Google increasingly looking to push users toward its smart home devices, making them all work better together just makes good sense.

Read more of this story at Slashdot.