The Android app economy has helped create nearly two million American jobs; developers around the world have earned more than $120 billion using the Google Play Store. We’re proud that Google Play helps developers build great apps and rewards them for doing so. And we know that a successful ecosystem must benefit both developers and consumers, which is why we have rules of the road to keep the store secure, protect privacy and prevent fraud. While we strive to make Google Play the best platform for everyone, Android also provides consumers and developers the opportunity to use other app store options.
Today, we’re pleased to share a proposed agreement that will help ensure that both developers and consumers can continue to benefit from Google Play. Google and a group of U.S. developers have reached a proposed settlement that allows both parties to move forward and avoids years of uncertain and distracting litigation.
As part of the settlement, we’re establishing a $90 million fund to support U.S. developers who earned two million dollars or less in annual revenue through Google Play during each year from 2016-2021. A vast majority of U.S. developers who earned revenue through Google Play will be eligible to receive money from this fund, if they choose. If the Court approves the settlement, developers that qualify will be notified and allowed to receive a distribution from the fund.
In addition to the fund, we’re committing to maintain a number of existing practices and implement new benefits that help developers innovate and communicate with their users:
To continue to provide developers with a tiered pricing model, we’ll maintain Google’s 15% commission rate for the first $1 million in annual revenue earned from the Google Play Store for U.S. developers, which we implemented in 2021.
We’re revising our Developer Distribution Agreement to make it clear that developers can continue to use contact information obtained in-app to communicate with users out-of-app, including about subscription offers or lower-cost offerings on a rival app store or the developer’s website.
In new versions of Android, Google will maintain certain changes implemented in Android 12 that make it even easier for people to use other app stores on their devices, while being careful not to compromise the safety measures Android has in place.
To showcase independent and small startup developers building unique high-quality apps, we’re creating an “Indie Apps Corner” that will appear on the apps tab on the U.S. Google Play homepage and shine a spotlight on these developers.
These commitments, including the $90 million fund, build on a number of ways we already support developers, such as providing tools that help developers build great apps, lower their costs, and grow their businesses. In fact, compared to other prominent digital content stores, we provide developers more ways to interact with their customers.
Finally, we’ve heard developers want to understand more about how Google Play operates, which is why we’ve agreed to publish annual transparency reports. The reports will share information about the Google Play Store, including statistics such as apps removed from Google Play, account terminations, and other data regarding how users interact with Google Play.
We’re pleased that we worked with the developers to propose this agreement for the Court’s approval. As the agreement notes, we remain confident in our arguments and case, but this settlement will avoid protracted and unnecessary litigation with developers, whom we see as vital partners in the Android ecosystem. We remain steadfast in our commitment to building thriving, open platforms that empower consumers and help developers succeed.
Over the last few years, King’s Cross has truly transformed, becoming a thriving hub of innovation and creativity. The transformation is a sign of the UK’s strengths, with its incredible local talent and strong history of leading technological and scientific progress. These strengths inspired us to invest here in Kings Cross, in one of our most ambitious developments to date.
Today, together with local MP, Keir Starmer, Mayor of London Sadiq Khan, leader of Camden Council Georgia Gould, and our building partners, we celebrated a major milestone in the construction of our new King’s Cross office – and in our long-standing commitment to the UK – as we placed the final beam on our new development.
Keir Starmer, Leader of the Labour Party and MP for Holborn and St Pancras said:
“It’s fantastic to attend not only as the leader of the Labour Party and local MP but as a proud local resident of more than 25 years. Congratulations to Google on your magnificent new building, and for all it represents – a seizing of opportunity, harnessing of talent, the creation of good, sustainable jobs and an immense contribution to our community. You’re showing what can be achieved when forward looking local government partners with the ingenuity of the private sector.”
We have long believed that creativity is spurred by environments that promote connection and wellbeing. This is more important than ever as we adapt to a future of flexible, hybrid working. Our new King’s Cross building will be equipped with new workplace technologies to help global and remote teams collaborate more effectively, build relationships, learn from colleagues and dream up new ways to solve complex challenges.
It will also bea place for community and connection thanks to the ground floor retail and community spaces, which are being curated with — and for — the local community. In the coming weeks, in partnership with more than 30 youth organisations in Camden, we’re excited to open our doors to 500 local young people for a week of taster sessions to inspire school students and job seekers with careers in technology, as well as more than 100 local work experience students.
Innovation extends to the design of the building itself, which is playing an important role in helping us to achieve our goal of going carbon free by 2030. We’re pioneering new technologies that will make our King’s Cross office our most ambitious smart building to date, including a system of 13,500 interconnected devices that will work together to improve energy efficiency in real time.
While the doors of our new King’s Cross development won’t open until 2024, incredible work is already underway nearby. The neighbourhood is home to thousands of our engineers working on products like Android, Wear OS, Search and Google Business Profiles, which are used the world over. In fact, many of the team behind some of our newest products – to be released later this year – are based right here in King’s Cross. We look forward to growing these teams and being a part of the local community’s future growth and development.
Mayor of London, Sadiq Khan
Mayor of London, Sadiq Khan commented:
“London has built a reputation as a world leader in technology and innovation, so I’m delighted to see Google reaffirming its commitment to London with the first wholly owned and designed Google building outside of the United States. I was lucky enough to be present for the original ground-breaking at this site back in 2017. So, it’s incredible to see the progress that’s been made since then on this hugely ambitious project.
"My ambition, as Mayor, is to build a better London for everyone – one that is fairer, greener and more prosperous for all. And this magnificent building is a shining example of confidence in our city.”
We are excited to announce that an update to the PowerShell Extension for Visual Studio Code is now available on the extension marketplace.
This release fixes a number of issues related to IntelliSense and enables updates to PowerShell Editor Services (the engine of the VS Code extension) for other clients,
What is high availability architecture? A high available architecture is when there are a number of different components, modules, or services that work together to maintain optimal performance, irrespective of peak-time loads. In its purest sense, this system allows businesses to work continuously without failure over a given period of time. Many businesses can’t afford […]
The Web and design team at Canonical run two-week iterations building and maintaining all of the Canonical websites and product web interfaces. Here are some of the highlights of our completed work from this iteration. Web The Web team develops and maintains most of Canonical’s sites like ubuntu.com, canonical.com and more. Major update to the […]
Take a look at NoOps, the concept of automating IT and development: how it works, pros and cons and whether it’s an evolution — or the end — of DevOps.
Explore DevOps release management best practices that help your team automate and maintain rapid deployment schedules for releasing reliable software faster.
We are happy to announce that the newest community feature of the Snap Store is here: Star Developers! Background In the Snap Store, we have a fantastic community where members can discuss topics in the forum, develop snaps and help others. Currently, the Snap Store has verified accounts; verified companies have a green tick by […]
Is this comment out-of-date? I don’t think it describes what I’m seeing.
This pull request is massive, where do I start?
Where did this bug come from?
These questions all reflect the limitations of collaboratively-developed source code as a communication medium. While there are ways to mitigate these issues (code comments, style guides, documentation requirements), we still inevitably find ourselves spending hours on just trying to understand code. Luckily, the tools needed to solve these problems have been here all along!
Commits in Git repositories are more than just save points or logs of incremental progress in a larger project. In the words of GitHub’s “Git Guides“:
[Commits] are snapshots of your entire repository at specific times…based around logical units of change. Over time, commits should tell a story of the history of your repository and how it came to be the way that it currently is.
Commits are a firsthand historical record of exactly how and why each line of code came to be. They even come with human-readable messages! As a result, a repository’s commit history is the best tool a developer can use to explain and understand code.
It’s been my experience that commits are most effective when they’re tweaked and polished to deliberately convey a message to their audiences: reviewers, other contributors, and even your future self. This post will:
Introduce some guidelines for organizing and revising commits.
Outline pragmatic approaches for applying those guidelines.
Describe some of the practical applications of a well-crafted commit history.
Writing better commits
Software development involves a lot of creativity, so your commits will reflect the context of your changes, your goals, and your personal style. The guidelines below are presented to help you utilize that creative voice to make your commits effective tools of communication.
As you read these guidelines, don’t worry about how you’ll be able to utilize all of this advice in the midst of writing code. Although you may naturally incorporate them into your development process with practice, each can be applied iteratively after you’ve written all of your code.
Structure the narrative
Like your favorite novel, a series of commits has a narrative structure that contextualizes the “plot” of your change with the code. Before any polishing, the narrative of a branch typically reflects an improvised stream of consciousness. It might contain:
A commit working on component A, followed by one on component B, followed by one finishing component A
A multi-commit detour into trying again and again to get the right CI syntax
A commit fixing a typo from an earlier commit
A commit with a mixed bag of all of the review feedback
A merge commit resolving conflicts with the main branch
Although an accurate retelling of your journey, a branch like this tells a “story” that is neither coherent nor memorable.
The problem
Disorganized commits that eschew a clear narrative will affect two people: the reviewer, and the developer themself.
Reviewing commit-by-commit is the easiest way to avoid being overwhelmed by the changes in a sufficiently large pull request. If those commits do not tell a singular, easy-to-follow story, the reviewer will need to context-switch as the author’s commits jump from topic to topic. To ensure earlier commits properly set up later ones (for example, verifying a newly-created function is used properly), the reviewer ultimately needs to piece together the narrative on their own; for each commit, figure out which earlier changes establish the relevant background context and tediously click back and forth between them. Alternatively, they’ll remember some vague details and simply assume earlier commits properly set up later ones, failing to identify potential issues.
But how does a scatterbrained narrative hurt the developer? A developer’s first instinct when working on a new project is often to hack on it until they get something functional. Fluctuating between “fun” and “frustrating,” this approach eventually yields good results, but it’s far from efficient. Jumping in without a plan – the mindset of following a narrative – makes that process slower than it needs to be.
The solution
Outline your narrative, and reorganize your commits to match it.
The narrative told by your commits is the vehicle by which you convey the meaning of your changes. Also, like a story, it can take on many structures or forms.
Your branch is your story to tell. While the narrative is up to you, here are some editorial tips on how to keep it organized:
DO
DON’T
Write an outline and include it in the pull request description.
Wait until the end to form the outline – try using it to guide your work!
Stick to one high-level concept per branch.
Go down a tangentially-related “rabbit hole”.
Add your “implement feature” commit immediately after the refactoring that sets it up.
Jump back and forth between topics throughout your branch.
Treat commits as “building blocks” of different types: bugfix, refactor, stylistic change, feature, etc.
Mix multiple building block types in a single commit.
Resize and stabilize the commits
Although the structure of a commit series can tell the high-level story of an author’s feature, it’s the code within each commit that creates software. Code itself can be complex, dense, and cryptic but in order to collaborate, others need to understand it.
The problem
The cognitive burden of parsing code is exacerbated by having either too much or not enough information presented at once. Too much, and your reader will need to read and understand multiple conceptually-different topics that could get jumbled, misinterpreted, or simply missed; too little, and your reader will develop an incomplete mental model of a change.
For a reviewer, one of the big benefits of a commit-by-commit review is – like individual lectures in a semester-long course – pacing the development of their mental model with small, easy-to-digest changes. When a large commit doesn’t provide that sustainable learning pace, the reviewer may fail fail to identify questionable architectural decisions because they conflate unrelated topics, or even miss a bug because it’s in a section seemingly irrelevant to the impacted feature.
You might think reviewers’ problems would be solved with commits as small as possible, but an incomplete change leaves them unable to evaluate it fully as they read it. When a later commit “completes” the change, a reviewer may not easily draw connections to the earlier context. This is made worse when a later commit undoes something from the earlier, partial commit. The “churn” in these situations leads to the same weakened mental model – and same consequences – as when dealing with too-large commits.
Poorly-sized commits present more tangible issues as well. Most apparent is the inability to roll back your repository to a commit (for example, when debugging a strange feature interaction). Incomplete changes often fail to build, so a developer will be stuck searching nearby commits for a fix. Similarly, a bug narrowed down to a massive commit requires teasing apart its intermixed changes, a potentially more difficult task than it was during the initial review due to loss of institutional project knowledge over time.
The solution
Make each commit both “small” and “atomic.”
To best convey your story, commits should minimize the effort needed to build a mental model of the changes they introduce. With effort tied to having a “just right” amount of information, the key to a good commit is fitting into quantified upper and lower bounds on that information.
A small commit is one with minimal scope; it does one “thing.” This often correlates to minimizing the modified lines of cone, but that isn’t a firm requirement. For example, changing the name of a commonly-used function may modify hundreds of lines of code, but its constrained scope makes it simple to both explain and review.
A commit is atomic when it is a stable, independent unit of change. In concrete terms, a repository should still build, pass tests, and generally function if rolled back to that exact commit without needing other changes. In an atomic commit, your reader will have everything they need to evaluate the change in the commit itself.
Explain the context
Commits are more than just the code they contain. Despite there being no shortage of jokes about them, commit messages are an extremely valuable – but often overlooked – component of a commit. Most importantly, they’re an opportunity to speak directly to your audience and explain a change in your own terms.
The problem
Even with a clear narrative and appropriately-sized commits, a niche change can still leave readers confused. This is especially true in large or open-source projects, where a reviewer or other future reader (even yourself!) likely won’t be clued into the implementation details or nuances of the code you’ve changed.
Code is rarely as self-evident as the author may believe, and even simple changes can be prone to misinterpretation. For example, what may appear to be a bug may instead be a feature implemented to solve an unrelated problem. Without understanding the intent of the original change, a developer may inadvertently modify an expected user-facing behavior. Conversely, something that appears intentional may have been a bug in the first place. A misinterpretation could cause a developer to enshrine a small mistake as a “feature” that hurts user experience for years.
Even in a best-case scenario, poorly explained changes will slow down reviewers and contributors as they attempt to interpret code, unnecessarily wasting everyone’s time and energy.
The solution
Describe what you’re doing and why you’re doing it in the commit message.
Because you’re writing for an audience, the content of a commit message should clearly communicate what readers need to understand. As the developer, you should already know the background and implementation well enough to explain them. Rather than write excessively long (and prone to obsoletion) code comments or put everything into a monolithic pull request description, you can use commit messages to provide piecewise clarification to each change.
“What” and “why” break down further into high- and low-level details, all of which can be framed as four questions to answer in each commit message:
What you’re doing
Why you’re doing it
High-level (strategic)
Intent (what does this accomplish?)
Context (why does the code do what it does now?)
Low-level (tactical)
Implementation (what did you do to accomplish your goal?)
Justification (why is this change being made?)
Building better projects
Using the guidelines established above, you can mitigate the challenges of common software development tasks including code review, finding bugs, and root cause analysis.
Code review
Reviewing even the largest pull requests can be a manageable, straightforward process if you are able to evaluate changes on a commit-by-commit basis. Each of the guidelines detailed earlier focuses on making the commits readable; to extract information from commits, you can use the guidelines as a template.
Determine the narrative by reading the pull request description and list of commits. If the commits seem to jump between topics or address, leave a comment asking for clarification or changes.
Lightly scan the message and contents of each commit, starting from the beginning of the branch. Verify smallness and atomicity by checking that the commit does one thing and that doesn’t include any incomplete implementations. Recommend splitting or combining commits that are incorrectly scoped.
Thoroughly read each commit. Ensure the commit message sufficiently explains the code by first checking that implementation matches the intent, then that the code matches the stated implementation. Use the context and justification to guide your understanding of the code. If any of the requisite information is missing, ask for clarification from the author.
Finally, with a complete mental model of the commit’s changes and the overarching narrative, confirm the code is efficient and bug-free.
Finding bugs with git bisect
If you’ve ever found yourself with a broken deployment and no idea when the breakage was introduced, git bisect is the tool for you. Specifically, git bisect is a tool built into Git that, when given a known-good commit (for example, your last stable deployment) and a known-bad commit (the broken one), will perform a binary search of the commits in the middle to find which one introduced the error.
As useful as git bisect is, it absolutely requires that each commit it traverses is both atomic and small. If not atomic, you will be unable to test for repository stability at each commit; if not small, the source commit of your bug may be so large that you end up inefficiently reading code line-by-line to find the bug anyway.
Root cause analysis
Suppose you’ve used something like git bisect to isolate the source commit of a bug. If you’re lucky, the underlying problem is obvious and you can fix it immediately. More often than not, things aren’t so simple; the bug-causing code might be necessary for another feature, or does not make sense as the source of the error you’re seeing. You need to understand why the code was written, and to do that, you can again use the commit history to investigate.
There are two main tools to help you search through commits: git blame and git log.
git blame annotates the file with the commit that last changed it:
This can be particularly helpful in finding which commits modify the same area of code, which you can then read to determine if they interact poorly.
For a more generalized commit search, you can use git log. In its simplest form, git log will display a list of commits in reverse chronological order, starting at HEAD:
$ git log --oneline
09823ba09de1 README.md: update project title
abd52642da46 my-file.py: add README stat printout
7392d7dbb9ae my-file.py: rename from oldname.py
5ad823d1bc48 test.py: commonize test setup
603ab927a0dd oldname.py: create printout script
...
The displayed list of commits can also be filtered by file(s), by function name, by line range in a file, by commit message text, and more. As with git blame, these filtered lists of commits can help you build a complete mental model of the changes that comprise a particular file or function, ultimately guiding you to the root cause of your bug.
Final thoughts
Although subjective and sometimes difficult to quantify, commit quality can make a massive difference in developer quality-of-life on any project: old or new, large or small, open- or closed-source. To make commit refinement part of your own development process, some guidelines to follow are:
Organize your commits into a narrative.
Make each commit both small and atomic.
Explain the “what” and “why” of your change in the commit message.
These guidelines, as well as their practical applications, demonstrate how powerful commits can be when used to contextualize code. Regardless of what you do with them, commits will tell your project’s story; these strategies will help you make it a good one.
Linux Active Directory (AD) integration is historically one of the most requested functionalities by our corporate users, and with Ubuntu Desktop 22.04, we introduced ADsys, our new Active Directory client. This blog post is the last of a series where we will explore the new functionalities in more detail. (Part 1 – Introduction, Part 2 […]
Over the past few years, we’ve seen more people forging their own path and turning their personal passions into businesses. These individual business owners, sometimes called “solopreneurs,” wear many hats as they run and grow their businesses: salesperson, marketer, accountant, the list goes on.
That’s why one year ago, we launched Google Workspace Individual as a new offering to help these solo business owners grow their businesses with the familiar apps they’re likely already using in their personal life. We’ve heard from customers that Google Workspace Individual helps them focus their time on doing what they love — like meeting with customers and designing personalized services — and less time on recurring tasks like scheduling appointments and sending emails. Since launch, we’ve delivered a number of improvements to provide even more value to customers, and today we’re announcing what’s coming next – electronic signatures right within Google Docs.
Coming soon: Easily sign important documents right in Google Docs
Whether you’re an event planner or digital creator, it can be a challenge to stay on top of contracts and customer agreements that need to be signed as you’re constantly context switching and jumping between different apps to get work done. That’s why we’re natively integrating eSignature in Google Docs, so you can quickly execute agreements from the familiar interface of Docs without having to switch tabs or apps.
Coming soon: Easily request electronic signatures directly in Google Docs
eSignature in Google Docs will take advantage of the same secure-by-design infrastructure and built-in protections Google uses to help secure your information and safeguard your privacy. Let’s take a look at how eSignature can help you create agreements:
Collaborate in documents: Collaborate on changes directly in Google Docs with comments and suggestions — no need to export the file to send a draft contract over email.
Add fields to documents: Within the familiar Google Docs interface, you can easily drag and drop signature and date fields in branded documents you create.
Request a signature: Once you resolve all comments and suggestions, requesting a signature is as easy as sharing a file in Drive.
Add signatures: When ready to sign, the signee can easily add their signature, no downloads needed. Once the signature is added, a completed PDF contract is emailed to both parties.
Monitor and track progress: Quickly see the status of pending signatures and easily find completed, signed contracts.
Create copies of contracts: For signature workflows that need to be repeated regularly, you can streamline the process by creating copies of existing contracts and then modifying as needed.
eSignature in Google Docs is coming soon in Beta to Google Workspace Individual users and is the latest in a series of improvements we’ve announced for the subscription in the past year. If you’re already using a dedicated eSignature solution, Google Workspace integrates with a number of leading providers. Learn more about how these eSignature and other integrations can help you optimize your workspace on our blog post.
ICYMI: Google Workspace Individual updates from this past year
Email marketing updates for engaging campaigns
For any business, it’s vital to connect with customers and prospects, both on a one-to-one basis and at a large scale. Google Workspace Individual makes it easy to do both, so you can easily send communications like monthly newsletters and also offer items like scheduled consultations.
Create and send customized marketing emails from Gmail
To help you reach many customers at once, last year we added a way to run simple email campaigns directly in Gmail. We started first by providing professionally designed templates that you can customize with your own branding and images in just a few clicks. Then earlier this year, we added multi-send, which allows you to deliver individual emails to a large number of recipients with a unique unsubscribe link for each recipient. With the combination of these improvements, it’s easy to make communications as targeted as you like, because you can create multiple email mailing lists within Google Contacts for different audiences and easily tailor the message to each audience. Gmail layouts and multi-send are generally available in Google Workspace Individual today.
Appointment scheduling updates for easier bookings
For scheduling in-person appointments or virtual meetings, Google Calendar helps streamline the appointment scheduling process and avoid back-and-forth communication to find a time that works. Since launching, we’ve made a number of enhancements that improve the experience for both the business owner and scheduler, including the ability to:
Help prevent no-shows by customizing the timing of reminder emails and having users verify their email before booking for added security.
Reflect your operational needs by setting flexible appointment durations, adding buffer time between appointments and limiting the number of bookings per day.
Easily update your availability with one-off exceptions like regional holidays and customizable start and end dates.
Get your own professional booking page that stays up to date
Customized appointment scheduling with the above features are generally available in Google Workspace Individual today, on the web and your mobile device.
Google Meet updates for your customer and partner calls
Once an appointment is on the books and it’s time to connect, Google Meet provides an easy way for you to deepen customer and partner relationships through secure video meetings. Helpful features in Meet ensure you can be clearly seen and heard. Noise cancellation removes background distractions like barking dogs, while low-light mode automatically adjusts your video in poorly lit settings. Here are a few notable Meet announcements from this past year:
Mimic taking your call from a real-life cafe or condo with immersive backgrounds.
Filter out the echoes in spaces with hard surfaces so that you can have conference-room audio quality whether you’re in a basement, a kitchen, or a big empty room.
Clearly see participants on a call while you’re presenting or multi-tasking with picture-in-picture on Chrome browsers.
Review your forecast or business proposal with meetings directly in Docs, Sheets and Slides.
Quickly join a Google Meet call from Google Docs, Sheets and Slides
Sign up today to take advantage of promotional pricing
Save 20% until October 2022[3bdee8]when you sign up for Google Workspace Individual today or learn more about Google Workspace Individual on our website.
During the pandemic, different technological tools allowed us to stay connected, collaborate and find the best responses to overcome the challenges in front of us.
As we move forward, we want to become Mexico's trusted technology ally and contribute to the country with programs, products and initiatives that promote economic, social and cultural development. Today, at our second Google for Mexico event, we aim to accelerate the country's economic recovery, helping people find more and better jobs, making it easier for businesses to grow, reduce the gender gap and promote financial inclusion.
Improving Mexicans’ lives through technology
In collaboration with the Ministry of Public Education, we helped students across the country to continue their school year by providing more than 20 million free Google for Education accounts. We have trained more than 1.9 million people in Mexico through Grow with Google and Google.org grants. And we have worked together with the Ministry of Tourism to create a joint strategy to digitize the travel sector, and partnered with the Ministry of Economy on gender gap reduction projects and a technological innovation program for manufacturing companies in the southeast region of the country.
According to a study we conducted with AlphaBeta, in 2021 we estimated that companies in the country obtained annual economic benefits worth more than $7.7 billion dollars from Google products (Google Search & Ads, AdSense, Google Play and YouTube), approximately three times the impact in 2018 ($2.3 billion dollars).
Today, more people in the world are using their smartphones to save credit and debit cards and to buy new things. Over the last few years, we have seen rapid digitization of essentials that we carry with us every day, such as car keys, digital IDs and vaccine records.
That’s why we are announcing that Mexico is part of the global launch of Google Wallet on Android and Wear OS. Google Wallet will initially launch with support for payment cards and loyalty passes and eventually expand to new experiences like transit and event tickets, boarding passes, car keys and digital IDs.
$10 million from Google.org
Mexico's Southeast region is home to more than 50% of the country's indigenous population; it is also a place affected by poverty and with big social vulnerability. Google.org, the philanthropic arm of Google, is allocating $10 million — the largest amount of funding provided by the organization in the country — to this region’s transformation. This initiative will mostly benefit women during the upcoming three years, supporting programs focused on promoting economic opportunities that accelerate financial inclusion, reducing the gender gap.
Women from Mexico's Southeast region will benefit from Google.org 10 million dollars fund through local and regional NGOs.
Technology as a booster for jobs
In 2019, during the first edition of Google for Mexico, we announced the launch of Google Career Certificates alongside a grant of $1.1 million for International Youth Foundation Mexico (IYF). Through this grant, IYF has trained 1,200 young people. Seventy percent of the graduates managed to get a new job, while the participants who were already employed raised their income by more than 30%. To expand this initiative, and as part of the $10M fund to support Mexico’s Southeast region, we are announcing a $2 million grant to support IYF to take their project into the region and train 2300 women from the community.
Supporting the news industry
In late 2020, we launched Google News Showcase, an initiative that offers a better experience for readers and news editors. Google News Showcase is a licensing program to pay publishers for high-quality content. This program will help participating publishers monetize their content through an enhanced storytelling experience that lets people go deeper into more complex stories and stay informed about different issues and interests.
Today we are announcing the beginning of negotiations with local media to soon launch a News Showcase in México. We are excited to continue contributing to the country’s media ecosystem, and offer our users relevant, truthful and quality information on local, national and international news.
Google News Showcase will bring a better experience for readers and news publishers in Mexico.
Preserving and promoting native languages
Every 14 days, a language becomes extinct. This means that out of the 7,000 existing tongues in the world, more than 3,000 are in danger of vanishing. To support the efforts of groups dedicated to language preservation, Google Arts & Culture is collaborating with partners around the world to launch Woolaroo, an experiment that uses machine learning to identify objects and show them in native languages.
Through their mobile cameras, users can take a photo or check their surroundings to receive a translation, and its correct pronunciation. In the beginning, Woolaroo could do this in 10 languages, and today seven more have been added, including Maya and Tepehua.
Woolaroo, a language preservation experiment powered by machine learning, will include ancestral languages Maya and Tepehua.
At Google, we believe technology is the fuel to be helpful for Mexicans across the country, providing intelligent solutions for millions of people.
A 2021 Forrester report found that 60% of customers appreciate “the convenience of marketplaces,” and predicted that 17% of the $13 trillion in business-to-business (B2B) spend would flow to marketplaces by 2023 — if not sooner. This isn’t surprising, as marketplaces provide an ecosystem of complementary products that can be aggregated and made available to […]
As part of TAG's mission to counter serious threats to Google and our users, we've published analysis on a range of persistent threats including government-backed attackers, commercial surveillance vendors, and serious criminal operators. Today, we're sharing intelligence on a segment of attackers we call hack-for-hire, whose niche focuses on compromising accounts and exfiltrating data as a service.
In contrast to commercial surveillance vendors, who we generally observe selling a capability for the end user to operate, hack-for-hire firms conduct attacks themselves. They target a wide range of users and opportunistically take advantage of known security flaws when undertaking their campaigns. Both, however, enable attacks by those who would otherwise lack the capabilities to do so.
We have seen hack-for-hire groups target human rights and political activists, journalists, and other high-risk users around the world, putting their privacy, safety and security at risk. They also conduct corporate espionage, handily obscuring their clients’ role.
To help users and defenders, we will provide examples of the hack-for-hire ecosystem from India, Russia, and the United Arab Emirates and context around their capabilities and persistence mechanisms.
How Hack-For-Hire Operations Work
The hack-for-hire landscape is fluid, both in how the attackers organize themselves and in the wide range of targets they pursue in a single campaign at the behest of disparate clients. Some hack-for-hire attackers openly advertise their products and services to anyone willing to pay, while others operate more discreetly selling to a limited audience.
For example, TAG has observed Indian hack-for-hire firms work with third party private investigative services — intermediaries that reach out for services when a client requires them — and provide data exfiltrated from a successful operation. This is detailed in depth in today’s Reuters investigation into the Indian hack-for-hire ecosystem. We have also observed Indian hack-for-hire firms work with freelance actors not directly employed by the firms themselves.
The breadth of targets in hack-for-hire campaigns stands in contrast to many government-backed operations, which often have a clearer delineation of mission and targets. A recent campaign from an Indian hack-for-hire operator was observed targeting an IT company in Cyprus, an education institution in Nigeria, a fintech company in the Balkans and a shopping company in Israel.
Recent Hack-for-Hire Campaigns
India
Since 2012, TAG has been tracking an interwoven set of Indian hack-for-hire actors, with many having previously worked for Indian offensive security providers Appin and Belltrox.
One cluster of this activity frequently targets government, healthcare, and telecom sectors in Saudi Arabia, the United Arab Emirates, and Bahrain with credential phishing campaigns. These credential phishing campaigns have ranged from targeting specific government organizations to AWS accounts to Gmail accounts.
Sample AWS phishing email
Sample AWS phishing page
TAG has linked former employees of both Appin and Belltrox to Rebsec, a new firm that openly advertises corporate espionage as an offering on its company website.
Rebsec’s offerings as per the company’s website
Russia
While investigating a 2017 credential phishing campaign that targeted a prominent Russian anti-corruption journalist, we discovered the Russian attacker targeting other journalists, politicians across Europe, and various NGOs and non-profit organizations. But what stuck out during this investigation was the breadth of targeting, which also included individuals that had no affiliation with the selected organizations, and appeared to be regular, everyday citizens in Russia and surrounding countries. This hack-for-hire actor has been publicly referred to as 'Void Balaur'.
These campaigns were similar regardless of target, consisting of a credential phishing email with a link to an attacker-controlled phishing page. The lures ranged from fake Gmail and other webmail provider notifications to messages spoofing Russian government organizations. After the target account was compromised, the attacker generally maintained persistence by granting an OAuth token to a legitimate email application like Thunderbird or generating an App Password to access the account via IMAP. Both OAuth tokens and App Passwords are revoked when a user changes their password.
Russian hack-for-hire phishing email
Russian hack-for-hire phishing site
During our early investigation, TAG discovered the attacker’s public website (no longer available) advertising account hacking capabilities for email and social media services. The site claimed to have received positive reviews on Russian underground forums such as Dublikat and Probiv.cc. Over the past five years, TAG has observed the group targeting accounts at major webmail providers like Gmail, Hotmail, and Yahoo! and regional webmail providers like abv.bg, mail.ru, inbox.lv, and UKR.net.
Pricing list from hacknet-service.com in 2018
United Arab Emirates
TAG is also tracking a hack-for-hire group now based in the United Arab Emirates that is mostly active in the Middle East and North Africa. They have primarily targeted government, education, and political organizations including Middle East focused NGOs in Europe and the Palestinian political party Fatah. Amnesty International has also reported on their campaigns.
The group commonly uses Google or OWA password reset lures to steal credentials from targets, often using the MailJet or SendGrid API to send phishing emails. Unlike many hack-for-hire actors that use open source phishing frameworks like Evilginx or GoPhish, this group uses a custom phishing kit that utilizes Selenium, a self described 'suite of tools for automating web browsers.' Previously described by Amnesty, this phishing kit has remained under active development over the past five years.
Google Security Alert phishing page
After compromising an account, the actor maintains persistence by granting themselves an OAuth token to a legitimate email app like Thunderbird, or by linking the victim Gmail account to an attacker-owned account on a third-party mail provider. The attacker would then use a custom tool to download the mailbox contents via IMAP.
This group also has links to the original developers of H-Worm, also known as njRAT. In 2014, Microsoft filed a civil suit against the developer, Mohammed Benabdellah, for the development and dissemination of H-Worm. Benabdellah, who also goes by the moniker Houdini, has been actively involved in the day-to-day development and operational deployment of the credential phishing capabilities used by this group since its inception.
Protecting Our Users
As part of our efforts to combat serious threat actors, we use results of our research to improve the safety and security of our products. Upon discovery, all identified websites and domains were added to Safe Browsing to protect users from further harm. We encourage any high risk user to enable Advanced Protection and Google Account Level Enhanced Safe Browsing and ensure that all devices are updated. Additionally, our CyberCrime Investigation Group is sharing relevant details and indicators with law enforcement.
TAG is committed to sharing our findings as a way of raising awareness with the security community, and with companies and individuals that might have been targeted. We hope that improved understanding of the tactics and techniques will enhance threat hunting capability and lead to stronger user protections across the industry.
Five years ago, information designer Mahima Pushkarna joined Google to make data easier to understand. As a senior interaction designer on the People + AI Research (PAIR) team, she designed Data Cards to help everyone better understand the contexts of the data they are using. The Data Cards Playbook puts Google’s AI Principles into practice by providing opportunities for feedback, relevant explanations and appeal.
Recently, Mahima’s paper on Data Cards (co-written with Googlers Andrew Zaldivar and Oddur Kjartansson) was accepted to the ACM Conference on Fairness, Accountability and Transparency (ACM FAccT). Let’s catch up with her and find out more about what brought her to Google.
How did your background lead you to the work you’re doing now?
I've always been fascinated by conjuring up solutions to things. The kind of questions that I’ve found meaningful are those that are never truly solved, or never have one correct answer. (The kind of questions that exasperate us!) Those have been the problems I am always drawn towards.
Early in my career, I realized the power in visualizing data, but spreadsheets were intimidating. I wondered how design could make communicating complexity easier. So I found myself in grad school in Boston studying information design and data visualization. I focused on how people experience data and how our relationships to each other and our contexts are mediated.
I joined Google Brain as the first visual designer in a full-time capacity, though I had no background in artificial intelligence or machine learning — this was the deep end of the pool. This opened up the space to explore human-AI interaction, and make AI more accessible to a broader class of developers. At PAIR, my work focuses on making information experiences more meaningful for developers, researchers and others who build AI technologies.
What’s it like to have a unique background as a designer on a technical AI research team?
When you're an engineer and immersed in building technology, it's easy to assume everyone has a similar experience to your own — especially when you’re surrounded by peers who share your expertise. The actual user experience is very personal and varies drastically across users and contexts. That particular clarity is what designers bring to the table.
I’ve been able to engage my engineering and research colleagues with simple, people-centered questions right in the very beginning. How are people using an AI tool? What are they learning from it? Who else might be involved in the conversation? Do they have the proficiency we assume they have?
Pull quote: “Identifying what we don’t know about data is just as important as articulating what we do know.”
How did you begin designing Data Cards?
This project started when I was working on another visualization toolkit, Facets, to communicate the skews and imbalances within datasets to help machine learning practitioners make informed decisions. At the time, transparency was a moving target. Andrew, Tulsee Doshi and I started to proactively think about fairness in data, and saw a huge gap in the documentation of human decisions that dot a dataset's lifecycle.
This “invisible” information shapes how we use data and the outcomes of models trained on them. For example, a model trained on a dataset that captures age in just two or three buckets will have very different outcomes compared to a dataset with ten buckets. The goal of Data Cards is to make both visible and invisible information about datasets available and simple to understand, so people from a variety of backgrounds can knowledgeably make decisions.
As we cover in our FAccT paper, Andrew and Oddur and I arrived at two insights. The first is that identifying what we don’t know about data is just as important as articulating what we do know. In capturing these nuances, it is possible to narrow those knowledge gaps before even collecting data. The second thing that surprised us was the sheer number of people involved in a dataset’s life cycle, and how fragile knowledge is. Context is easily lost in translation both between and within teams, across documents, emails, people and time.
Data Cards stand on the shoulders of giants, like Data Sheets (Gebru, et al.) and Model Cards (Mitchell et al.). We've been immensely lucky to have had the support of many original authors on these seminal papers that have paved our path to FAccT.
How do you hope the paper is used across the tech industry?
Imagine a world in which finding verifiable information about the motivations of a dataset’s creators or performance of a model is as easy as learning about the ethical beliefs of a celebrity or the rating of a movie. Our vision for Data Cards is that they become a cultural mainstay — invisible, but their absence would be missed by ML practitioners.
In this paper, we introduce frameworks that other teams can use in their work. Alongside that, we’ve open-sourced the Data Cards Playbook, so we're trying to lower the barrier to access in every way possible.
Strong, unique passwords are key to helping keep your personal information secure online. That's why Google Password Manager can help you create, remember and autofill passwords on your computer or phone: on the web in Chrome, and in your favorite Android and iOS apps.
Today we've started rolling out a number of updates that help make the experience easier to use, with even stronger protections built in.
A consistent look and feel, across web and apps
We're always grateful for feedback, and many of you have shared that managing passwords between Chrome and Android has been confusing at times: "It's the same info in both places, so why does it look so different?" With this release, we're rolling out a simplified and unified management experience that's the same in Chrome and Android settings. If you have multiple passwords for the same sites or apps, we’ll automatically group them. And for your convenience, you can create a shortcut on your Android home screen to access your passwords with a single tap.
You can now add a shortcut to Google Password Manager to your Android homescreen.
More powerful password protections
Google Password Manager can create unique, strong passwords for you across platforms, and helps ensure your passwords aren’t compromised as you browse the web. We’re constantly working to expand these capabilities, which is why we’re giving you the ability to generate passwords for your iOS apps when you set Chrome as your autofill provider.
You can now create strong passwords on your computer or mobile, on any operating system.
Chrome can automatically check your passwords when you enter them into a site, but you can have an added layer of confidence by checking them in bulk with Password Checkup. We’ll now flag not only compromised credentials, but also weak and re-used passwords on Android. If Google warns you about a password, you can now fix them without hassle with our automated password change feature on Android.
For your peace of mind, Password Checkup on Android can flag compromised, weak and reused passwords.
To help protect even more people, we’re expanding our compromised password warnings to all Chrome users on Android, Chrome OS, iOS, Windows, MacOS and Linux.
Simplified access and password management
Google built its password manager to stay out of your way — letting you save passwords when you log in, filling them when you need them and ensuring they aren’t compromised. However, you might want to add your passwords to the app directly, too. That's why, due to popular demand, we're adding this functionality to Google Password Manager on all platforms.
Adding your passwords directly is now possible on all platforms.
In 2020, we announced Touch-to-Fill to help you fill your passwords in a convenient and recognizable way. We’re now bringing Touch-to-Login to Chrome on Android to make logging in even quicker by allowing you to securely log in to sites directly from the overlay at the bottom of your screen.
Touch-to-Login signs you in directly from a recognizable overlay.
Many of these features were developed at the Google Safety Engineering Center (GSEC), a hub of privacy and security experts based in Munich, so Guten Tag from the team! Of course, our efforts to create a safer web are a truly global effort – from our early work on 2-step verification, to our future investments in technologies like passkeys – and these updates that we are rolling out over the next months are an important part of that work.
Welcome to the latest edition of “My Path to Google,” where we talk to Googlers, interns, apprentices and alumni about how they got to Google, what their roles are like and even some tips on how to prepare for interviews.
Today’s post is all about Micka Alencar, an intern from Brazil who’s spending her summer on the Google Cloud team.
Can you tell us a bit about yourself?
I study production engineering at the Federal University of São Carlos in Sorocaba, Brazil. This summer, I’m interning for the Google Cloud team! Helping people really energizes me, so I also volunteer with local community projects in my free time, like teaching English classes to children. Outside of that, I like to watch anime and spend time with my family.
What do you do at Google?
I’m a Google Cloud Strategy and Sales Operations intern. In this role, I research cloud market trends and look for opportunities to grow our Google Cloud business in Latin America. Right now, I'm working on two main projects: developing a more structured onboarding process for our sales team, and building a framework for measuring our team’s progress.
Why did you apply to Google?
I decided to apply for an internship at Google because of how closely the company's values align with mine. I’ve always dreamed of working at a place where I wouldn’t just be a number, but an important part of something bigger. At Google, my work is relevant, I’m heard and I can be myself without any judgment or fear.
How did your interview process go?
Google’s interview process was different from what I was used to. Here, you’re evaluated across a broad set of skills, not just your technical abilities. Both of my interviewers were very kind, and they made me feel comfortable from the start. They helped turn that evaluative moment into a pressure-free conversation where I could share my points of view, ideas and, ultimately, who I truly am.
Micka and her family, who she credits with playing a big role in her professional development.
How did you prepare for your interviews?
To prepare for my interviews, I reflected on critical moments in my life and career and crafted a narrative around them. I also visited Google’s Careers site for interview tips and did several rounds of mock interviews with my friends.
How has it been working remotely?
Amazing! My onboarding process was so well organized, and my team has given me the support I need to succeed in this internship. And even though I’m working remotely, I recently met my team in person at the São Paulo office. This was an important moment for us to get to know each other even better.
Any advice you’d give to aspiring Google interns?
First, be authentic and don't try to fit into patterns or create false appearances. At Google, individuality is highly appreciated and is an important part of the candidate selection process. Second, don't diminish yourself in any way — you can be whoever you want to be. And if you think you can work at Google, then you can! And finally, dedicate yourself to your dream and believe strongly in your capabilities.
Editor's Note: In honor of Pride Month and beyond, and in collaboration with over 60 cultural institutions, Google Arts & Culture presents the "A Queer Eye on Art History" hub. It’s a place where you can explore archives and collections to celebrate LGBTQIA+ lives and art and dive into more than 20 newly curated stories, new collections from partners, and much more. Today, one of our partners, Andrew Shaffer, Interim Co-Executive Director, from the GLBT Historical Society, shares his perspective.
Queer art has a long history. From a leather version of Michelangelo’s David to giant rainbow flags to outrageous drag outfits, queer people have been making art — and queering existing artworks — since time immemorial. The GLBT Historical Society in San Francisco preserves thousands of pieces that document a vast range of queer arts, from sculpture and painting to poetry, and dance.
Many of these belong to our Art & Artifacts collection, which is something of a cabinet of curiosities, or, as we call them, “queeriosities.” With over 1,000 items, it is one of the world’s largest collections of two and three-dimensional objects that illustrate historical LGBTQIA+ material culture. Our archives hold these artworks along with documents and artifacts that tell the stories of countless LGBTQIA+ lives and communities.
Our archives hold diaries by gay and trans historian Lou Sullivan; outfits from icons like José Sarria,Sylvester, andGilbert Baker; a rich trove of writing and correspondence from Phyllis Lyon and Del Martin; the suit Harvey Milk was wearing the night of his murder; the only known remnant of the original rainbow flags; and so much more. We keep these objects safe and accessible so current and future generations can learn their history, and find their own place in it.
Visit Google Arts & Culture’s new hub ‘A Queer Eye on Art History’ to learn more about our stories and more from more than 60 other cultural institutions, such as:
Uncovering hidden histories
Did you know that famous art could be... queer? Discover new perspectives of iconic classical artworks with creators Rainbow History Class as they deep dive into figures and homoerotic motifs found in Renaissance Art.
Hear more about the history and symbols behind Pride, or queering the art canon with Youtuber and Author Rowan Ellis. Could retrospectively inserting queerness into the canon give LGBTQIA+ artists their place in the spotlight?
Visit g.co/prideculture or download Google Arts & Culture’s Android or iOS app. To learn more about the GLBT Historical Society, and support our work, visit glbthistory.org. Happy Pride to everyone!
Structure the narrative
Resize and stabilize the commits
Explain the context
10:25
