Jvy's Tech Blog

Solution for AppEngine Cron Job Upload - 500 Internal Server Error

2010-02-24T06:43:00.001-08:00

If you were configuring a cron job for Google AppEngine and if you encountered 500 Internal Server Error during upload, your problem could be similar to mine.

For me, in my cron.xml, I did the following:

<?xml version="1.0" encoding="UTF-8"?>
<cronentries>
<cron>
<url>/ping</url>
<description>Keep JVM alive</description>
<schedule>every 1 minute</schedule>
</cron>
</cronentries>

and I got:

Creating staging directory
Scanning for jsp files.
Scanning files on local disk.
Initiating update.
Cloning 7 static files.
Cloning 29 application files.
Uploading 0 files.
Deploying new version.
Will check again in 1 seconds
Will check again in 2 seconds
Closing update: new version is ready to start serving.
Uploading index definitions.
Uploading cron jobs.
Unable to upload:
java.io.IOException: Error posting to URL: http://appengine.google.com/api/datastore/cron/update?app_id=jvy&version=pbeta-0-2-6&
500 Internal Server Error

Server Error (500)
A server error has occurred.

at com.google.appengine.tools.admin.ServerConnection.send(ServerConnection.java:114)
at com.google.appengine.tools.admin.ServerConnection.post(ServerConnection.java:66)
at com.google.appengine.tools.admin.AppVersionUpload.send(AppVersionUpload.java:345)
at com.google.appengine.tools.admin.AppVersionUpload.updateCron(AppVersionUpload.java:101)
at com.google.appengine.tools.admin.AppVersionUpload.doUpload(AppVersionUpload.java:87)
at com.google.appengine.tools.admin.AppAdminImpl.update(AppAdminImpl.java:41)
at com.google.appengine.eclipse.core.proxy.AppEngineBridgeImpl.deploy(AppEngineBridgeImpl.java:203)
at com.google.appengine.eclipse.core.deploy.DeployProjectJob.runInWorkspace(DeployProjectJob.java:97)
at org.eclipse.core.internal.resources.InternalWorkspaceJob.run(InternalWorkspaceJob.java:38)
at org.eclipse.core.internal.jobs.Worker.run(Worker.java:55)
java.io.IOException: Error posting to URL: http://appengine.google.com/api/datastore/cron/update?app_id=jvy&version=pbeta-0-2-6&
500 Internal Server Error

Server Error (500)
A server error has occurred.

If you encoutered the same problem as me, then the way I solved it:

<?xml version="1.0" encoding="UTF-8"?>
<cronentries>
<cron>
<url>/ping</url>
<description>Keep JVM alive</description>
<schedule>every 1 minutes</schedule>
</cron>
</cronentries>

I tested both the cron.xml a few times to confirm. Tried it. If it's not working for you, let me know.

Web p2p & VoWeb (Voice over Web)

2010-02-07T03:34:00.000-08:00

VoWeb enables voice communication over the web. It requires no special desktop software download. Like Skype, p2p technology is employed along side client-server fail-over. Web p2p is a new technology with hugh potential.

tokto.org is a free & non-commercial rendezvous project to experiment web p2p & voice over web. It is in private beta, get an invitation here http://www.tokto.org/invite.html

Android Detect Sleep Movement

2010-02-02T19:44:00.000-08:00

Follow up from: http://jvyloh.blogspot.com/2009/07/record-sleep-cycle-using-android.html

There are enquiries / requests for the app / source code. I am posting some code snippets to help you get started implementing a better Sleep Cycle Detector. You are welcome to comment on it and suggest improvement. Kindly post me a link to your better app so I can try it out :-)

Well, I have no plan to publish the app as I am busy on other projects, it remains as a proof-of-concept. There are similar apps in the Android Market, one of them is by Alexander Kosenkov called Smart Alarm Clock for Android.

I also found some other code example here: http://www.clingmarks.com/?p=25

Code snippets:

1. Get the 'Sensor Service', e.g.:

SensorManager senMgr = (SensorManager)getSystemService(Context.SENSOR_SERVICE);

2. Register Sensor Listener, and set how often you like to receive events, e.g.:

senMgr.registerListener(sensorEvtLsnr, sensor, SensorManager.SENSOR_DELAY_NORMAL);

3. Create the Sensor Listener, e.g.:

private SensorEventListener sensorEvtLsnr = new SensorEventListener()

{

//your code here

};

4. Override the method that receive the sensor events:

private SensorEventListener sensorEvtLsnr = new SensorEventListener() {

@Override

public void onSensorChanged(SensorEvent evt)

{

//your code here

}

};

5. Listen to the type sensor event you interested, in this case:

Sensor.TYPE_ACCELEROMETER

There are other sensor type which are applicable for different application:

Sensor.TYPE_MAGNETIC_FIELD
Sensor.TYPE_ORIENTATION

6. Implement your algorithm what you consider a movement, for my simple POC, I monitor the change in the ACCELEROMETER X value, a change of value to consider a movement count, and I have a timer that gathers the number of movement count per minute, which you can use to plot a graph, persist to a file or post to the cloud.

int cAccX, //movement count per minute

float accX; //accelerometer x value

TextView tvAccelerometer; //TextView to show display data on screen

private SensorEventListener sensorEvtLsnr = new SensorEventListener() {

@Override

public void onSensorChanged(SensorEvent evt)

{

if(evt.sensor.getType() == Sensor.TYPE_ACCELEROMETER ){

if(accX != evt.values[0]){

accX = evt.values[0];

cAccX++;

tvAccelerometer.setText("Accelerometer[x] = " + cAccX + " = " + accX );

}

};

Browser Support

2009-10-02T20:32:00.001-07:00

I can't believe that in this year of 2009, StarHub website still only support Internet Explorer. I can't even pay my bill using Firefox, that means every 1 in 3 customers can't do the same.

in reference to: StarHub (view on Google Sidewiki)

Sidewiki Google Singapore

2009-09-23T21:27:00.001-07:00

Ever wanted to comment on some web pages but can't? Google Sidewiki is meant just for that, and more.

One interesting analogy: if standard web site is like Singapore Pools, then SideWiki is like private 4D collector.

The potential is hugh, Sidewiki can grow like an underground activities off the original web site / pages (comments, wikis, annotations, meta tags, links, etc.), and did I mention Semantics?

There is even an API for us to tap the power of Sidewiki http://code.google.com/apis/sidewiki/

in reference to: Google (view on Google Sidewiki)

Record Sleep Cycle using Android

2009-07-17T20:29:00.000-07:00

Yesterday night I wrote an Android App to detect and record my sleep cycle. Wanted to purchase the SleepTracker. Their concept is pretty simple, detect body movement. So I fired up Eclipse and wrote an app utilizing Android's built-in Accelerometer. I picked the parameter which gave me a count when there's tiny movement. It timed the number of counts per minute. I put my htc magic on/against my bed to see whether it even worked. I was expecting 'nothing' or random 'noise'. Surprisingly, after I uploaded the data to Google Spreadsheet in the morning, the graph showed me the patterns. So I calculated the peak movement and I got two readings of 105 mins, pretty close to the 110 mins which I timed myself manually last time.

The draw back is that this app detects bed movement, not body movement like that of SleepTracker wrist watch. So if you have more than 1 person on the bed, it will be the composite readings. You also need a bed which is firm. When the phone lies flat on the bed with nobody on it, the reading has to be zero or detects very low movement. And if you have a tiny bed, make sure your phone doesn't drop off the bed.

Google / gmail video chat

2008-11-11T21:48:00.000-08:00

So what do you think?

Well, if you are thinking about Gmail vChat vs Skype, then that is not what I wanna lead you to...

Think about it, Gg doesn't like their services depending on third party proprietary technology. And that I mean Flash, used heavily in YouTube and Gg Video.

Well, I didn't thought they will come out with an alternative so fast, while Flash is still alive and kicking. Don't get me wrong, I love Flash.

So, here goes, Gmail vChat Plugin & Flash, they both speak H.264. So if 1 day Flash needs to be replaced for whatever reason, the vChat Plugin will be the ready stand-in replacement.

-Sick today-

test

2008-04-01T07:15:00.000-07:00

Google's official comment on security bug pertaining to Singapore in July 07

2007-08-06T00:41:00.000-07:00

This is google's official comment posted by Matt Curtis on googlesystem, 5 Aug 07:

"
We had an isolated bug in our interaction with a proxy server in Singapore, and we've reached out to the local ISP to straighten this out. The Google Reader team has already pushed a fix; we will take steps on our side to prevent this from happening again. If you see any more instances, please contact us here: http://www.google.com/support/accounts/bin/request.py?contact_type=general&ctx=reader
"

Please see the the complete comment here [search for the comment posted by Matt Cutts]: http://googlesystem.blogspot.com/2007/07/users-report-gaining-access-to-random.html

Google Serious Security Breach - Final Update - 25 July 07

2007-07-25T00:02:00.000-07:00

Dear all,

Since last Saturday after Google Reader was patched (need confirmation from Google whether the Google Reader or local ISP proxy/cache played a bigger part in this security problem), I have not noticed any more security glitches. Two other Singapore users who contacted me also reported no more security issues since then. So, we have enough reasons to think that the security issues related to what I have reported have been eliminated.

So in this final update article, I will just document some of the information which I have missed out from my previous posts, particularly:

Background articles (so that I don't have to repeat again)
The common steps that I clicked through triggering the session-crossover
List of services breached, which were affected, which were not, and to what extend
Additional findings & references
Personal view

Background articles:

The common steps:

I document this because I think it may be helpful for Google or anyone else who would like to have a better picture how it all occurred.

using gmail.com
using Google Toolbar

via Bookmarks
via Gmail

Access Gmail
From Gmail top left menu, select more -> Reader
Access Reader

If session-crossover hadn't occurred, click Settings (top right)

from Reader Settings, click top left corner Google Reader Labs Logo instead of << Back to Google Reader, most of the session-crossover occurred after this, else, from Reader, click My Account (top right), if it occurred at this point, you would be asked to fill in your account password (which shouldn't happen when single-sign-on was working properly), repeat these steps if none had happened so far, if after 3 iterations and no crossover occurred, it was less likely to happen in this particular session.

When it happened, I would notice that my account id jvyloh@gmail.com changed to other users. As mentioned, out of the popular 5, most likely it was victor.xxx.xx@gmail.com. I will touch on this later because another user from Singapore mark...@gmail.com contacted me telling me he did crossover to the same victor.xxx.xx@gmail.com a couple of times.
When crossover occurred, you were literally in another user session rather than yours. In Reader, I would notice that none of the subscriptions were mine.
At this point, new subscriptions could be added. Existing subscriptions could be deleted. One could add a new subscription to your own blog, rendering artificial visitor statistics. One could manage the subscriptions, performed rename, delete, change folder, new folder, add/remove tag, unsubscribe, delete all subscriptions, etc...
One could view the trend in the other user's Reader Trend, got a feel of the user reading habit, like which topics were read, when most reading occurred in a day or week.
One could mark certain items as shared, star/unstar them, add tags.
The most serious violation was possible as one could open an item and click Email(Updated), a small ajax layer would pan out, one could gmail to arbitrary emails using the other user's account, click the email to: field, start typing from alphabet a to z to have a drop down of a list of Gmail contacts, send out the email with a customized note without having to save a copy in the Gmail sent box. The recipient would get that email.
Sometimes the session would suddenly crossover to a different user, and one would be seeing things from the 'new users'. I suspect that most of this session-crossover happened in between users who were online and login to Google account at the same time. Besides the security bugs that Google Security Team had fixed with their Google Reader, whether there were other factors which contributed to this (e.g. ISP Proxy/Cache Server), was beyond me. Google did ask me about my ISP. More on that later.

Access iGoogle:

From Google Reader, clicked My Account(top right), single-sign-on wouldn't work, and I would be shown with my email id and prompted to enter password. At this point, even with my correct email id and password, I wouldn't be able to login most of the time.
From here, click iGoogle, the iGoogle page would appear. For a couple of days, what happened was that I would be presented with whatever the user had added to their iGoogle.
At this point, one could change the iGoogle theme, add stuff, re-layout gadgets, one could possibly add some of the more critical gadgets like Gmail, Google Docs, Google Calendar, etc. The list of Google services that could be added include: Google Finance Portfolios, Gmail, Google Calendar Viewer, Google Notebook, Googe Docs & Spreadsheet, Google Talk, Google Reader, My Google Groups, Google Map Search, Picasa Web Photos, etc...
One of the most serious security breach I have encountered, I was crossovered to 1 such user who had already added his/her Gmail and Google Docs in iGoogle. The Gmail and Google Docs gadgets allowed one to change the number of messages to display up to a total of 9. So a summary of 9 Gmail messages would be presented. One couldn't have further access to Gmail services without additional login though. However, for the Google Docs gadgets, the security breach was the worst. Instead of just the docs title, one could click on the docs and had them open up in full editable mode. The whole document was exposed. Fortunately further access to Google Docs Home wasn't possible. Some other ToDo gadgets could be edited as well.
Fortunately these didn't happen all the time to all the session-crossover. Most of the time when I was redirected to iGoogle, I would be redirected away 50% of the time, especially at the later stage, nearer to the date of Google solving the bugs.
By clicking around Google services, one could easily figure out what services were granting access and what not. The fact was, one didn't have to do anything much, just clicking around the usual way you switching around Google services (when you were a frequent user of Google), was enough to send you roaming into other user's account, although we wouldn't want to, including services available through Google Toolbar and Firefox extension, e.g. Google Notebook.

List of services breached, which were affected, which were not, and to what extend:

Google Reader - Action/Access Possible (to 3rd party):

Access subscriptions (view, read, add)
Manage subscriptions (delete, delete all, rename, change folder, new folder, add/remote tag, unsubscribe)
Access Google Trends (view user reading habits)
Individual Reader Items (share/unshare, star/unstar, add tags)
Access Gmail contacts from Reader (view the whole list of contacts from a-z)
Send item to arbitrary emails and attach a note, without saving in user sent box

Google Reader - Action/Access Not Possible (to 3rd party):

None

iGoogle - Action/Access Possible (to 3rd party):

View existing gadgets
Change gadgets settings (e.g. number of items/summary to show)
Add/remove gadgets
Change theme, layout
If not redirected away, Gmail could be added and up to 9 messages title would be available
If not redirected away, Google Docs could be added and up to 9 docs title would be available. Individual docs could be open for editing, deletion and save.

iGoogle - Action/Access Not Possible (to 3rd party):

Full access to Gmail not possible.
Further access to Google Docs Home not possible.

Google Web History - Action/Access Possible (to 3rd party):

Trends
Interesting Items
Bookmarks

Google Web History - Action/Access Not Possible (to 3rd party):

All History (Web, Images, News, Products, Sponsored Links, Video, Maps)

Google Bookmarks (Toolbar/Web) - Action/Access Possible (to 3rd party):

View, add, edit, remove, labeling, export

Google Bookmarks (Toolbar/Web) - Action/Access Not Possible (to 3rd party):

None

Google Notebook(FireFox Ext/Web) - Action/Access Possible (to 3rd party):

New note, delete note

Google Notebook(FireFox Ext/Web) - Action/Access Not Possible (to 3rd party):

None to my knowledge

Google Groups - Action/Access Possible (to 3rd party):

Access to My Groups and Recently Visited

Google Maps - Action/Access Possible (to 3rd party):

Access to Saved Location

Google News / Finance - Action/Access Possible (to 3rd party):

Viewable

Gmail (Toolbar/Web) - Action/Access Possible (to 3rd party):

Sending to arbitrary emails from Google Reader
Can be added to iGoogle, summary viewable if not redirected away from iGoogle

Gmail (Toolbar/Web) - Action/Access Not Possible (to 3rd party):

Full access requires additional login

Google Calendar (Toolbar/Web) - Action/Access Possible (to 3rd party):

Can be added to iGoogle, not sure about summary access from iGoogle

Google Calendar (Toolbar/Web) - Action/Access Not Possible (to 3rd party):

Full access requires additional login

Google Talk - Action/Access Possible (to 3rd party):

Can be added to iGoogle, not sure about summary access from iGoogle

Picasa Web Photos - Action/Access Possible (to 3rd party):

Can be added to iGoogle, not sure about summary access from iGoogle

Google Analytics, Blogger, Orkut - Action/Access Not Possible (to 3rd party):

Full access requires additional login

Additional findings & references:

As mentioned, the behaviors of the problem this round was different from the latest reported earlier this year:

However, it might be slightly better than the previous case because one couldn't choose which user session to crossover to.
But, it could be even worse solely because no known exploits had occurred previously whereas for this round, anyone that encountered a session-crossover could immediately perform serious damages to the other party (e.g. delete all the valuable bookmarks)
The occurrence was particularly obvious in Singapore. It happened in a span of days to weeks. Especially when another user who read my blog emailed me that he also crossovered to the same user as mine.
A few sources, including Tony Ruscoe, Ionut Alex Chitu from Googlesystem, Matt Cutts from Google, Google Security Team had first suspected a problem with ISP proxy/cache server, straydog from Singapore was having the same issue, both of us were using SingNet, an ISP belonged to SingTel who was launching a nationwide IPTV service in Singapore the same week this problem intensified, it fact, it was officially launched the same day (Friday) I reported these problems, refer here.
Mark from Singapore and myself crossovered to the same user couple of times, the user was from Singapore too. I had in fact contacted the user victor.xxx.xx@gmail.com informing him that I had crossovered to his session and some modification I was making to myself were being reflected in his Google account.
On 20 July, Mark emailed me: Yes, I'm in Singapore, and SingNet is my ISP. And I'm still crossing over other users.
On 20 July, Tony Ruscoe wrote to me: I'm guessing you are connecting through an ISP that uses a proxy server.
On 20 July, straydog left me a comment: I am a singtel user and since this morning I am experiencing the same thing as you with the reader. Gmail seems ok though.
On 21 July, Ionut Alex Chitu from Googlesystem wrote a blog about this. Some of the comments in the blog were compiled below:

Other Google user complains over at Google Groups: "Whenever I use Google Reader, I would 'cross-over' to another user's account."
And another one: "I've been login to other users today, seeing their feeds instead of mine. I login to gmail and google reader. While reading the feeds halfway I would see my feeds change into other user's [feeds], my account will also change to other google user account."
Other report from a regular reader of this blog: "While I was reading posts in Google Reader today, my account was switched to someone else's account. The account name on the upper right corner changed and I could see all his or her subscriptions in my Google Reader. I closed the Reader and open it again. Nice! I could read another person's subscriptions. I tried iGoogle and it was also changed."
Update. Matt Cutts, from Google, posted this: "Given that most of these reports are coming from a single area (Singapore), it sounds like an ISP isn't handling their connections correctly. We've certainly seen ISPs mess up their proxies before. I'll still ask about this though."
Adam Boeglin said on July 20, 2007 6:29:00 AM PDT:
I had the same problem once in Google reader. I hit refresh, and it showed some different feeds. I refreshed the whole page, and it was someone else's account. After restarting Firefox, everything was back to normal. It was very odd.
Tegla said on July 20, 2007 6:49:00 AM PDT:
If I were you, I would definitely have a look at whether the university has some badly set-up proxy...
Gustavo Caixeta said on July 20, 2007 7:09:00 AM PDT:
i had the same problem at google groups at 29/06/2007
it havens when i was managing the users of my group
Mousuke said on July 20, 2007 7:21:00 AM PDT:
I'm one of those being affected by this problem. I think it might be my ISP, because once I reached work, I have none of those problems, but I continue to have the problem at home.
While I am from one of the named Singapore universities, I was not using the varsity connection, so I wouldn't know if it was in fact, isolated there.
straydog said on July 20, 2007 7:30:00 AM PDT:
I am this problem a couple of times already today on the reader. And yes, I am from Singapore.
Can this problem be from the ISP?
Jim LoVerde said on July 20, 2007 7:49:00 AM PDT:
I have had this problem happen starting yesterday at a client site. If it's not on Google's server side (e.g. giving out redundant cookie session ids).
I'd highly suspect that it is proxy server related. Either Google changed some of their cache directives, or some proxy servers have changed their behavior for some reason.
In this case, the proxy server is Novell Border Manager, if that helps.
It's also worth noting that it happened twice, and both times I ended up looking at the wrong Google Reader feeds but for the same user.
Choo said on July 20, 2007 9:10:00 AM PDT:
this is really bizarre, my friend ended up in my account!!
luckily, he did not modify my feeds, though he did screw up some other guy's iGoogle... :(
Justin said on July 20, 2007 10:10:00 AM PDT:
I'm from Singapore too. I was using NUS network when I got the problem.
But, on my IE, I have a different account other than the one that encountered the problem. When I used that account, there was no problem at all, even at the same time when I was having the same problem in the other account in Firefox! I logged off the problematic account in Firefox and logged in with the account from IE, there was no problem. I logged in again with that problematic account (also in Firefox) then the problem came back again!!!!
I still don't know what had caused this problem. My testing with two accounts further confused the problem.
Matt Cutts said on July 20, 2007 10:22:00 AM PDT:
Given that most of these reports are coming from a single area (Singapore), it sounds like an ISP isn't handling their connections correctly. We've certainly seen ISPs mess up their proxies before. I'll still ask about this though.
Matt Cutts said on July 20, 2007 11:41:00 AM PDT:
Both the security team and the Google Reader team were already on it. Even though it's not on Google's side as near as we can tell, the Reader team are looking for a way to prevent faulty proxies/caching from affecting users.
Brian said on July 20, 2007 1:53:00 PM PDT:
It's totally a proxy problem...this used to happen when I was at a university and I would login to Yahoo! only to get someone else's Yahoo! account.
ymerej said on July 20, 2007 8:17:00 PM PDT:
This used to happen on my computer. I would log in to my "igoogle" back wen it was called Google Home Page and I would get my igoogle but with my girlfriends mail. She had the same problem. I wrote google but they didn't help except told to be sure we logged out.
yasart said on July 21, 2007 1:30:00 PM PDT:
I am from Turkey. I had this problem with IGoogle. Someone else's homepage is presented instead of mine.
yasart said on July 21, 2007 1:30:00 PM PDT:
I am from Turkey. I had this problem with IGoogle. Someone else's homepage is presented instead of mine.
yasart said on July 21, 2007 1:30:00 PM PDT:
I am from Turkey. I had this problem with IGoogle. Someone else's homepage is presented instead of mine.

On 21 July, Google Security contacted me to ask me to furbish more information about my ISP.
On 21 July, 3 and a half hours later, Google Security emailed me:
Hi Jvy,
We believe we've fixed the problem on our end for Google Reader. Please
let us know specifics if you notice it happening again (on reader, or any
other Google properties). Thank you again for reporting this to us.
Regards,
Will, The Google Team
I did some testing and found some javascript error, so I feedback to them. Since then, no more problem occurred.
On 22 July, Mark from Singapore emailed me: It seems that the problem has been resolved around sat night, sometime before midnight SG time.. No problems thus far.

Personal View:

So far, I believe this problem has been fixed by Google, either that there was some bugs with Google Reader (which is still in lab version), or that Google made some changes to Google Reader so that it can better workaround some of the ISP proxy/cache server problems. May be Google can further clarify on this.
If it was indeed a ISP proxy/cache server problem, we have gathered that at least 3 users (including myself) in Singapore had confirmed to be using SingNet, an ISP from SingTel (Singapore Telecom), who has just launched IPTV service in the same week (Friday) where the problem peaks. See the CNET article about the launch. Is SingTel IPTV service part of the contributor to this problem? If so, we have seen Google done their part, but has the Telco done anything yet? It may be affecting other services, including 1 yahoo service reported by 1 such user in googlesystem.blogspot.com.
All software system are subjected to bugs especially a lab version, all trial user have to be aware of that bugs are inevitable at this level of release.
I am highly impressed with Google's response time. They got the problem fixed within 3 and a half hours. My confidence with Google stays strong.

If you have any comments, do drop it here or email me: jvyloh@gmai.com. If you had this problem or still having this problem, do let us know too.

Feel free to link to this article.

Regards,
Jvy

Google Serious Security Breach - update 4 - 22 July 07

2007-07-21T15:39:00.000-07:00

Hi,

Just to inform anyone affected by this problem:

Google had contacted me and within hours of the correspondence and troubleshooting, we believe problem on the end for Google Reader has been fixed (need confirmation from Google whether the Google Reader or local ISP proxy/cache played a bigger part in this security problem). Thanks to Google. Their response is really fast. They do take security very seriously. I have since conducted testing on my end using IE7, FF2005 on 2 machines. No problem so far. I will be monitoring for another few more days.

For those Singapore users affected by this, kindly let me know whether you don't see this problem anymore.

As I will be away for 2 days, so I will not be able to work on this task during this time and for those who is trying to contact me via Gmail, I will only be able to reply on the 24th, Singapore Time.

Once we have confirmed that the problem is fixed, I will keep everyone informed. So far, Google response has been A+++.

Regards,

Google Serious Security Breach - update 3 - 20 July 07

2007-07-20T00:18:00.000-07:00

Well,

This is by far the most serious findings:

I was redirected to someone else's iGoogle who apparently turned on their gg docs and gmail, to do list, etc.

I was able to:

1. Preview gmail summary, change the settings if I want (number of message to show)
2. Preview docs created with gg docs. I AM ABLE TO OPEN THE INDIVIDUAL DOCS TO VIEW AND EVEN ALLOWED TO EDIT THE CONTENT !!!
3. View a list of todo [not sure this is a google service], and create a new todo if I wish.

This is getting out of hand, I will report to google soon.

Regards,

Google Serious Security Breach - update 2 - 20 July 07

2007-07-19T23:22:00.000-07:00

Ok,

There are more findings coming along the way, after I spent a bit more time on this subject this morning.

I suspect that this is a problem related to cookies. Previously Google was reported to have security problem with cookies:

Details of Google’s Latest Security Hole

Google Security Hole Allows Account Hijacking

I think the problem I am encountering is slightly different. No one is attempting to hijack whoever else's session. And yet, ppl's session randomly appears in my login session. And it happens with certain frequency and patterns:

1. It has been rotating around 5 users, the most notable being victor.xxx.xx@gmail.com that happens 95% of the time, I am sorry victor, while doing my findings, i got to know you much better as a stranger.

2. Those users' session that appear in mine seems to be originating from the same city, which is Singapore, and I suspect some of them are students, by browsing through the gg reader feeds presented to me, and supposingly 'my bookmarks'. One of them appeared to be a lecturer because he/she has a gg reader folder that reads 'students', and many names in it.

3. Not only did it appear in Singapore, those users seem to be from the same organization, which are local univerties, 1 from NTU, and some may be from NUS, and fyi the 2 top universities in Singapore are located in the west of Singapore, and I am in the north-west, which is pretty near to each other.

4. It ever occurred once after I cleaned up everything in my gg reader (no more feeds), this problem seemed to occur less, and on my laptop it seemed to stop appearing temporarily.

5. Google seems to have 2 groups of security for 2 groups of services. Those services that I was able to accidentally browse into include those like gg reader, gg bookmarks, gg notebook, gg maps and sometimes iGoogle, etc. Some of the more secure services requires additional login, those are gmail, gg cal, gg docs, etc.

6. All these problem have repeatedly appearred in my IE 7.0.5730.11, Firefox 2.0.0.4 and 2.0.0.5 that I have just upgraded.

So:

1. Can it be a problem not with google but a problem with the ISP cache server? May be due to some caching issues that their session cookies was somehow redirected to me? I was more of a software engineer than a security expert, and I know nothing about hacking, so I will leave it to the security expert to tell me.

2. If it is google's problem, can it be gg reader? The problem patterns usually start after I login and access gg reader.

3. If it is gg reader, can it be related to gg gears offline feature? I have 1 gg gears installed in my desktop, but my laptop installation has not been successful till today. Both computer exhibit the same google security problem, interesting.

4. Can it also be related to the feeds we subscribed? I took notice that most of the users mentioned and myself share some similar feeds from ChannelNewsAsia (Singapore) and if I am not wrong, BBC as well. I need to document this part when it occurs again.

Again as mentioned, anyone with similar problems please contact me at jvyloh@gmail.com. I would like to compile all these findings asap so that google can replicate the problems and get it fix. So I can have peace of mind going back to use my gg bookmarks, else I am telling you I will be switching to yahoo soon.

Google Serious Security Breach - update 1 - 20 July 07

2007-07-19T22:24:00.000-07:00

Hey guyz,

I am a heavy user of google services, you name it, i have it. Recently I have been experiencing a lot of google problems, and it went from seemingly benign to pretty serious, from first occurrence, to once a day, until it's like every session. So I decided to document my findings in this series, to find a reliable way to replicate the problem before I submit to google again [I have alerted them during the first occurrence, but I only got an auto-reply]

It started off when I was using gg docs and after closing 1 of my docs, I was returned to my 'doc home', however, someone else's email was reflected at the top instead of mine. It disappeared soon after before I could catch what was going on. I immediately tried to click around to see whether the problem came back, but no. Following that I went to google and sent them a report via one of their 'report a bug' form. I got an auto-reply after that, nothing much, just the usual machine auto-reply. I didn't think it was that serious because I remembered none of the other party's docs were flashing in front of my eyes. So I soon forget about it.

Lately, the google problem came up again. Nearly everytime I boot up my computer, and login to google toolbar or gmail, I began to notice that when I went further to click on other google services, e.g. gg reader, very often I went into someone else's reader. Not just their email id replacing mine at the top, it was literally someone's reader. I could read their feeds and so on.

At first I didn't pay that much attention to that because:

1. I was busy.

2. I seldom use google reader. The reason I open gg reader was because gg gears was launched and gg reader was the first one that uses this technology. Anyway, gg gears had a lot of installation problem when it was first available for public testing. I went back to gg reader after sometime to check the progress of the gg gears installation problem.

As of these few days, I started to pay attention to it because it had spread to other gg services that I use very frequently, like gg bookmarks, gg notebook, igoogle, gg groups, gg maps, gg history trend, gg news, gg finance.

Further more, it was no longer just a single email id that started with victor.xxx.xx@gmail.com but it started to changed to random users [but still that few ones, rotating around]. And I realized that those users were mainly from Singapore, the same city I am in. I knew this because their gg readers showed subscriptions related to news in Singapore.

The MOST SERIOUS thing so far is that you can accidentally made changes to other user's account while you think you are modifying your own. I realized that when I was making changes/adding items, like adding a bookmark, adding a feed into my reader, and adding notes to my notebook, adding gg gadgets to my igoogle, rearranging my igoogle layout, the changes all went to the other party, not mine, and hey this is scary!!!

It was that serious till I realized that other users are just equally viewing my pages as well. I quickly exported all my bookmarks to local hard disk because the bookmarks can be changed or deleted, I knew that because I could although I didn't.

So far I have randomly been redirected to about 5 users, which I realized mainly originated from local universities, one of them I suspect is a lecturer, and the rests look like students to me. For confidentiality, I can't disclose their email id here.

The only problem I have so far was, I couldn't find a reliable way to replicate the problem. Sometimes it was very frequent, nearly every login session, I encounter this, with certain click through patterns [all within google]. However, when I was more intentious in replicating the problem, it just refused to emerge. Since I am IT trained, I have decided to track this problem methodologically for eventual submission to google.

I encourage anybody who encounters similar problems described above to contact me at jvyloh@gmail.com

I will follow up with more findings.

Google Reader Problem

2007-07-19T19:08:00.000-07:00

I have recently encountered some problem with google reader. I have noticed that random feeds being added to my reader, anybody else has the same problem?

Do share with us.

Visitor from Minsk

2007-07-17T19:38:00.001-07:00

Wow,

Kind of excited when I got my first visitor from Minsk, Belarus:

*photo courtesy of wikipedia

This is my traffic report:

My First Google Mashup with Flash

2007-07-17T19:23:00.000-07:00

Hey Guyz,

As mentioned, I was evaluating gm, it has some bugs, of course, it is still in beta, i wanted to see whether gm works with flash, i managed to embed a flash demo* in my first google mashup. Google mashup relies on iframe which load a flash object from external source. * Please try again if google mashup server is down.

Please check this out: [flash 8 min, flash 9 preferred] http://jvyloh.googlemashups.com/

Google Mashup Galery: http://gallery.googlemashups.com/

* flash demo courtesy of papervision3d

Google Intelligence 2.0

2007-07-16T19:39:00.001-07:00

You know, we know about artificial intelligence, we head about collective intelligence, so what is google intelligence?

You know, I have been relying on google services that much, from email to blog, from documents to calendar, from search to toolbar, from bookmarks to ...there are just endless list. Scary as hell if you are a paranoid.

Oh ya, I currently run everything on Microsoft, but MS doesn't have all my data, but gg does. All my data is on gg server. And gg is well known for search and analytics. They search and mine the data every nano second, that includes you, because you are a piece of data, or keyword, imagine people going to gg and search jvyloh, yes, that is me, and hell lots of data about me is revealed (especially with web 2.0) and hell lots more that gg keeps for themselves.

Do I have a problem? Well, as long as gg does not disclose my data to third party, i am ok. Anyway, those data I put on the internet are suppose to be public (emails excluded) Any data that's supposed to be private remains on my desk and it never goes out.

I don't know what is the state of GI at this point. May be GI 1.0 or already GI 2.0. I pressume when it is GI 3.0, 4.0 or 5.0, the google brain knows I am typing an article about her.

USR - iRobot !!!

I hope gg stick to their motto, 'do no evil'

Anyway, it is important for y! to survive and remains independent from acquisition from the 'dark side' to balance the force. Lets see what Jerry Yang can do.

Google Mashup - Invites !!!

2007-07-16T19:09:00.000-07:00

Ok, after a week or so, I finally got the permission to use ggms. Can't help to quickly browse thru the tutorial although I have tones of other things scheduled to complete. May only have time to play with it later.

I want to see how ggms scores in the built-in ajax ui component. It definitely make sense to have it because those ajax ui will be (eventually) be able to plug-in to your blog, social space, iGoogle, google desktop, or perhaps google toolbar too.

So now the MVC model is complete, actually not quite yet, if ggms is able to store my user data on the server, you know if you create a web app from scratch by hand, you have the php as the controller, the html assets as the view, and the data(models) got to be persisted in a database (e.g. mysql). I always stress the importance of the final link, the data persistence. May be somehow I am able to persist the data in google doc spreadsheet, just treat it like a database, but not sure how is the performance, or perhaps ggGear may help in conjuction, but ggGear is still buggy at the moment, anyway, i think it is going to happen in '08, if not, then is there a "Google Idea" service for me to submit?

Well what is my point? my point is if mashup has the complete mvc framework and platform support from the service providers (gg, y!, etc), then I am going to say everyone can be an entry level web developer, everyone can create simple and personal web app that plug into you blog, social space, homepage, toolbar, desktop, RIA (like a super OLE), that left php and the likes for serious entreprise biz. What you need is to have an IQ greater than 100, capable of a bit abstract logic thinking, knows what is html, xml and javascript.

So you see, information technology moves really fast. If you haven't learn any new technology in the past 1 year, you are out of the market. I always liken it to the Mafia - "If you stays where you are, you are dead !!!"

I think non-seriuos developer in the market (e.g. Sg) today has to be worry, unless you are top-notch enterprise grade, and you love the technology chase, it is better to explore around what IT related position available next to you. The very few developer jobs left will be also heading to India very soon.

Scary ya, so what is the next big thing? Hee...go figure out.

Papervision3d on Wikipedia

2007-07-15T20:57:00.000-07:00

Guyz,

I have just created the papervision3d page on Wikipedia today. It only contains a summary description and and external links only. Need more time to add more content to the stub. Please help to contribute to it.

The link is here: http://en.wikipedia.org/wiki/Papervision3d

Google Supercomputing

2007-07-14T18:40:00.000-07:00

Google is building the biggest data center facilities across the globe and buying up chunks of dark fiber. Can I say they are having the largest supercomputing farm and the amount of bandwidth to rival any telcos?

Just in case you are not aware, Google's own web server (used only by themselves) ranked high in Netcraft global web server survey? That just shows how many servers Google has, as of this writing, it's close to 500,000.

Suddenly it reminds me of USR in iRobot.

PopFly vs Pipes

2007-07-14T03:00:00.001-07:00

I have played with Yahoo Pipes and watched a youtube demo of PopFly. So what is my take?

When I first saw pipes, I was impressed. And I told myself that this is how non programmers create program, "personal program", may be I should trade-mark that.

Next I saw PopFly. And wow, your personal program can really fly!!! Not that I am impressed with Silverlight, we all know that it is vector graphics, that is what vector graphics should be able to do, we are too accustom with Flash. But I think this is a very smart Microsoft strategy to make Silverlight inroad into the web-ecosystem - getting the bloggers to create their own programs pulling in all their collective web contributions and pop them in their blogs/social space. Well, MS knows that the designers/advertisers will not buy their Silverlight story at this point. With windows automatic update pushing from the other end, Silverlight may have a chance against Flash. Now, Adobe, please wake up. Can we have the Flash SDK 9 please? PS3 and Wii is waiting for it.

So my points are: Yahoo Pipes is great, but where is the presentation layer? People needs to have some cool ajax to present the pipes, and better still plug into Yahoo Widgets and Google Desktop. Google Mashup, it allows scripting, which is great, but guyz, you are crawling too slow.

What is the score now: MS PopFly 2, Y! Pipes 1, Gg Mashup 0.

Transformers

2007-07-14T02:35:00.001-07:00

Guyz, I love it !!!

I just love the hollywood CGI, it is really unparallel. I have never been a fan of transformers, my gf reminded me that was because my childhood was indulged in books, I have to agree with her.

Besides the CGI, I am also amazed in how it transforms from a compact car into a giant twice its size [I'm talking about autobot here]. May be I should get 1 when I got the budget.

iPhonemania

2007-07-14T02:26:00.000-07:00

Let me ask you 1 simple question, will you get an iPhone?

For me, the answer is no, even if it is iPhone 2.0 with 3.5G. The current iPhone 1.0 is a closed system with serious weakness in terms of its non replaceable battery.

I am tend to make the conclusion that the iPhone closed system exemplified that a company culture is very much an inheritance from the company founder or leader. Steve Jobs show that pretty clearly.

So what am I going to get? Well the answer is a simple slim phone that can play radio, podcast (and probably video). I prefer to listen (bbc, dananddavidshow) rather than looking at any screen smaller than 800x480.

What else would I need? I don't need to hang on to a smart/pda phone for compulsive organizing. But I can hardly leave away from the web, so just give me a MID 2.0 running linux on Silverthorne, and I hope this device is the start of consumer linux.

New Prototype - Nanotech Webcam

2007-01-30T17:46:00.000-08:00

This is one of the first IT product that uses NT. The photo sensors are very sensitive, allowing capturing images in pitch-black lighting condition.

Check it out:

New technology - Digital Pen & Mouse

2006-12-18T01:39:00.001-08:00

Check it out: Digital Pen