Google: You've Been Owned. Fix Your F'ing Security

by Dietrich Schmitz

Theatrics.  That's all it is.  We see blustering, cries of 'outrage' by Eric Schmidt in a public reaction of 'surprise' to the fact that the NSA penetrated their firewall and set up camp reading any and all of their 'clear text' data files with impunity.

This same company, prides itself on selling Chromebooks with an unblemished record at Pwnium 2013 of no successful hack which resulted in fully owning the ChromeOS operating system.

How is it that so much effort can be put forth to develop ChromiumOS with a sincere intent to make security a prime order of concern yet Google's data centers store data in clear text?

This isn't being discussed in any of the media stories.

The real 'top dog' priority for Google is advertising revenue.  And, they know full well that if they encrypted the public's data they could no longer parse it to exploit, mine, for advertising purposes and that would put a major choke hold on a part of their revenue stream they so cherish.

The public's trust, good faith, and right to privacy takes a 'back seat' to Google's penchant for profit.  Google is colliding directly with 'Do No Evil' as they continue to change their ways with a clear intent to take major portions of their technology base proprietary. 

That is the bottom line and there is no clear indication from them policy-wise, one way or another, as to what they plan to do at this point, if at all, other than public 'feel good' talk and expletives from Google Engineers seen in today's news.

Google.  You've been owned real bad and at the Public's expense.  It's time for you to fix your F'ing security.  I think you just might have screwed the pooch this time.

-- Dietrich

Related articles

• Google's Eric Schmidt says NSA spying outrageous if true: Wall Street Journal
• Google Employees On NSA: 'F*ck These Guys'
• Google Engineers Speak Out Against NSA Surveillance, And Drop The F-Bomb While Doing So

Read More

The JSON API: An Example

by Dietrich Schmitz

I'm not one to let things go.  If I can't figure something out, it simmers and brews, sometimes for days, even weeks at length until I get an answer.

That was my experience with JSON.  I'm not a web uber geek by any stretch of the imagination and have spent over two decades doing IT programming all without coding a line of html.

I am quite fine with that.  But I was confronted by what seemed to be a simple exercise in configuring this website: having it return a list of posts 'by Author'.

Well, no.  It turns out that there isn't a lever, toggle, switch one can pull to make that happen.  Yes, a post does indeed have category tags, but to have that work reliably one must explicitly append a 'tag' to the post, i.e., the name of the Author.  One omission will result in the query missing a post.  That isn't acceptable.

So, I thought there must be a way to get that seemingly basic information from a post. Yes?

Yes!  It turns out that Google has an array of APIs to their product line and, categorically, Blogger has its very own.  It's called Javascript Object Notation or JSON for short.

This is good news. Yes?

So, I proceeded to pour over the documentation in earnest hoping that if I stared long enough and tried various API calls I could get it to cooperate.

This went on for over two weeks with my poking at it periodically without success.

Finally, I decided to try a simple test to see what Google's API would return using JSON.  It is pretty basic:

When I saved the html and opened the test.html from my local share, it returned to the screen 'Undefined' 'Undefined' as if to taunt me once again.  I was taunted.

So, I double-checked my settings in the Google API console, even recreated my apikey just to be sure and then took just the RESTful portion (I've obfuscated the api key as 'xxxxxxxxxxxxxxxxxx'), and ran it from a terminal command line to see what was in the response.  It returned 200 OK but the response included information I had not seen up to this point, a clue to what was keeping my simple JSON query from giving over the goods:

// API callback
handleResponse({
 "error": {
  "errors": [
   {
    "domain": "usageLimits",
    "reason": "dailyLimitExceededUnreg",
    "message": "Daily Limit for Unauthenticated Use Exceeded. Continued use requires signup.",
    "extendedHelp": "https://code.google.com/apis/console"
   }
  ],
  "code": 403,
  "message": "Daily Limit for Unauthenticated Use Exceeded. Continued use requires signup."
 }
}
);

Ah hah!  Now we are getting somewhere.  So, in spite of my due diligence in obtaining an api key, it turns out that obtaining an api key has a very limited quota so I had spent it in my previous incantations and the message was clear in saying I should 'sign up'.  So, yesterday, late in the day, I signed up and sent off the form to Google which replied that it might take as much as several days before my request would receive a review.

Late last night, an email came from a chap at Google who enabled my apikey.  I was quite pleased with the quick turn-around and sent him a thank you email.

With that I dispatched directly back to firing off my test.html opening it from my local share.  Much to my pleasant surprise, it dutifully responded with a response:

My test.html to exercise the Blogger JSON api confirms success

So, as you can see above, the issue wasn't my JSON--it was the fact that the apikey was not 'authorized'.  Once enabled it worked flawlessly.

This now opens the door to an array of possibilities for adding addition features, widgets, etc.

Initially, I would like to have a link in the post 'About the Author' box which when clicked will open a browser tab and display the title and link to each article belonging to the Author.  Should be easy right?  That is on today's plate.

Okay then, that is just a very simple JSON api example which I hope might help some of the readers to get motivated to do the same for their website.  -- Dietrich

Related articles

• JSON: The Undisputed King of Web Interchange APIs
• Google APIs finetuning Cloud Storage JSON API
• Designing A RESTful API That Doesn't Suck
• JSON for jQuery EasyUI
• Parsing JSON API response with php

Read More