8 ms·

Google IP Vandalizing OpenStreetMap [Not a comprehensive post]

233 points by tecoholic 15y ago

Hrundi 15y ago
This is the user, but I'm having a rough time trying to identify the offending edits: http://www.openstreetmap.org/user/kane123/edits http://www.openstreetmap.org/user/kane123/edits Has Google released any statement beyond the one that said "We were mortified to learn that a team of people..."? I'm overly curious on the results from Google's investigation. I can see the connection with Mocality being mentioned, but vandalizing seems odd. I would venture that this is coincidental. Pick any branch office of a large enterprise or government and run a search for the IPs they use to access the internet. You'll find vandalism on Wikipedia, ancient guestbook messages, mailing list postings, etc. I'm certainly not a Google apologist, but this just seems fishy.
- timthorn 15y ago
  Some more detail here: http://lists.openstreetmap.org/pipermail/talk-gb/2012-January/012701.html http://lists.openstreetmap.org/pipermail/talk-gb/2012-Januar...
- deleted 15y ago
  [deleted]
- Natsu 15y ago
  If these are the same as the Mocality people, I wonder how long before Google audits and fires them? I also wonder if we'll find out about any more wrongdoing. Hopefully Google shuts them down soon.
  - tylermenezes 15y ago
    I'm really suspicious of any claim that the top brass at Google honestly knew nothing about it... (What would these employees even have to gain? It's not like they have much to gain if Google's stock goes up, and if they're hiding this from management, they're not getting paid for it.)
    - redthrowaway 15y ago
      Define "top brass". If you're saying some upper-middle management at Google India, possibly. If you're saying that this is being done at the VP level, I think that's a bit tin-hatty for what we've seen so far. Regardless of whether or not you think Google is strategically sabotaging other projects, I think we can all agree that if it were under the direction of Google's top brass, they would have been smart enough not to use their own IPs. It's not an organization to which one would attribute less technological accumen than your average Wikipedia vandal.
    - kaze 15y ago
      >I'm really suspicious of any claim that the top brass at >Google honestly knew nothing about it... If Google Management knew of this, wonder why they would let this happen from Google IP addresses...
      - jrockway 15y ago
        Because Google employees generally have latitude to do whatever they want with their Internet connection at work. Even bad OSM edits. If we start blaming whoever an IP resolves to for vandalism, you're going to find that pretty much every major corporation has vandalized Wikipedia. (When I worked at BAC, our proxy was perma-banned for vandalism.) Not to mention the ISPs; Comcast is a notorious Wikipedia vandal (by this logic).
    - CWuestefeld 15y ago
      What would these employees even have to gain? Should we apply this logic to all open source contributions, and view with suspicion everything that doesn't have a price tag attached?
    - jrockway 15y ago
      In a past life, I've vandalized Wikipedia. I did it because it was funny to me and the people around me at the time. (To be fair, it was John C Dvorak's page. But the point is, I didn't do it for money.)
- wisty 15y ago
  It could also just be a broken bot. You'd think Google would be smart enough to know not to POST 100k times to an outside service, but it's possible there's someone in the ranks who just doesn't know what they are doing.
  - ZeroGravitas 15y ago
    The 100,000 hits by 17 accounts took place over a year could be 99.9% valid contributions. They mentioned that number because they have recently noted 2 accounts vandalising and so it's probably wise to check the other interactions in case they are subtle vandalism by the same person/people that went unnoticed at the time but that it'll take time to confirm either way.
deleted 15y ago
[deleted]
chrisacky 15y ago
I can understand Mocality posting on a blog their findings, but this is an awful and not very credible way of make public your accusations. Look forward to an explaination?... then contact them directly instead of "sand bagging" them (borrowing a colloquialism from Family Guy).
- gitarr 15y ago
  I disagree: Actually the best way to get answers from a too-big-to-communicate company like Google is to make the whole process as transparent and out in the open as possible. Google is notoriously difficult to contact for most people. One of the best ways to get them to respond is to let as many people as possible know about the issue at hand. Public backlash -> answers.
  - dredmorbius 15y ago
    I've managed to contact a few different organizations in a few different ways. I'm no fan of Microsoft (check post history), but when I found that a large volume of 419 spam was coming through Hotmail some years back, I looked up their main switchboard number, called, spoke briefly to the receptionist asking for the VP of the related unit (I'd looked up his name). She transferred me to him. He picked up on the first ring. I explained the situation briefly, we spoke for a few minutes, at the end of which he said he'd put me in touch with the guy who could fix things. Fifteen minutes later I was talking with him, and we exchanged information over the next few months as I helped him plug his holes. I am still highly impressed by the professionalism demonstrated at all levels. I'd also worked with Microsoft to resolve a GPL compliance issue (again, directly contacting the appropriate VP) again with minimal fuss. A southeastern US university IT contractor who's private business was spamming me (and he was denying it) ended up with a series of emails escalating up the academic food chain, ultimately to the university president (.edu websites are, or at least were, wonderfully information rich). I eventually got the response I had hoped I'd get on first contact. Another issue involving AOL at which numerous attempts to contact them failed. I ended up somewhat crashing (well, I did wrangle a late invite for a brief presentation) at which I presented data, including some which indicated AOL's little problem. Their chief postmaster was present. We talked a bit. More recently, Yahoo have had issues in severely restricting mail delivery rates to Yahoo's MXs, even for long-existing, SPF/DKIM compliant MTAs. I'd gone endless rounds with their helpdesk and had repeatedly emailed (with no response) their CTO. So I sent a group email to a roster of their top (C-level and senior VP) staff, again with some data indicating issues (pflogsumm delivery stats showing hours of delay) and an introductory text "Gentlemen, you have a problem". That finally got a response in the form of a "Yahoo concierge" who spoke with me a couple of times and sorted the problem (and also promised a review of policies in general, in case anyone else is having issues). Just a few anecdotes of different ways to get a company's attention. There's no one-size-fits-all approach, so be flexible. I generally try a direct private contact first, but ... well, if that doesn't work, I've got a bag of tricks I can pull out. Public shaming can work, but I'm willing to give the benefit of doubt first.
robinhouston 15y ago
There’s an interesting comment from Tom Hughes: “As the person who (in my role as an OpenStreetMap system administrator) first discovered this `incident' let me start by saying that I consider this post to be grossly irresponsible and wholly inappropriate. [ … ] It seems to me that this is just an attempt to get some cheap publicity by trying to like the project to the Mocality incident, and I cannot support such behaviour.”
- jc123 15y ago
  What were Tom's arguments? It would give better perspective than just his conclusion.
  - corin_ 15y ago
    "The board of OSMF are making mountains out of tiny pimples here. It seems that they want this to be some sort of organised corporate malfeasance on the part of Google which is why they have tried to link it to the recent Mocality incident where there was indeed clear evidence of such behaviour. "The reality in this case is that there is no evidence that this is any different to the numerous other incidents we get all the time where users either accidentally or deliberately make bogus edits. The only difference in this case is that there happen to be two accounts (though we do not know if that is two people) and the user or users involved happen to (presumably) work for Google. "That is the sum total of what we know, and on the back of that, and without approaching Google at all, two leading board members have decided to reveal personal information about two of our users."
    - evolve2k 15y ago
      I think the boards concens and response is fair enough, google employees have an obvious potential conflict of interest if they are vandalizing maps, even if they are acting by their own volition it is still something I would expect Google to take action around and publicly not condone, assuming even the most innocent of circumstance.
- citricsquid 15y ago
nostromo 15y ago
The founder of OSM and author of this blog post runs Bing Maps. I hesitate to bring this up and add to the melodrama -- but people should be aware of the interests of the parties involved.
- ot 15y ago
  To be completely fair, the post is signed by three people. The other two are an OSM Sysadmin and an OSMF board member. I'm not saying that there may not be a conflict of interest, but this post has some support from the board of the foundation.
ot 15y ago
According to ReadWriteWeb [1] Google PR responded We're aware of OpenStreetMap's claims that vandalism of OSM is occurring from accounts originating at a Google IP address. We are investigating the matter and will have more information as soon as possible [1] http://www.readwriteweb.com/archives/google_osm_vandalism.php http://www.readwriteweb.com/archives/google_osm_vandalism.ph...
deleted 15y ago
[deleted]
sharken 15y ago
This story is a little light on details, but the fix however is easy enough: Just rollback all edits by that user.
rea1234 15y ago
<br>hai<sgdfg>
rea1234 15y ago
<b>hai</b>
rea1234 15y ago
<html> <body> <h1>My First Heading</h1> <p>My first paragraph.</p> </body> </html>
rea1234 15y ago
<swdfghj234567><45678>
rea1234 15y ago
<vbn>
Encryptor 15y ago
Bullshit. If they really wanted to vandalize your project, they'd use a chain of anonymous proxies.
packetslave 15y ago
From http://www.readwriteweb.com/archives/google_osm_vandalism.php http://www.readwriteweb.com/archives/google_osm_vandalism.ph... Update: Google sent the following statement to ReadWriteWeb on Tuesday morning. "The two people who made these changes were contractors acting on their own behalf while on the Google network. They are no longer working on Google projects."

233 points by tecoholic 15y ago

This is the user, but I'm having a rough time trying to identify the offending edits: http://www.openstreetmap.org/user/kane123/edits http://www.openstreetmap.org/user/kane123/edits Has Google released any statement beyond the one that said "We were mortified to learn that a team of people..."? I'm overly curious on the results from Google's investigation. I can see the connection with Mocality being mentioned, but vandalizing seems odd. I would venture that this is coincidental. Pick any branch office of a large enterprise or government and run a search for the IPs they use to access the internet. You'll find vandalism on Wikipedia, ancient guestbook messages, mailing list postings, etc. I'm certainly not a Google apologist, but this just seems fishy.

timthorn 15y ago
Some more detail here: http://lists.openstreetmap.org/pipermail/talk-gb/2012-January/012701.html http://lists.openstreetmap.org/pipermail/talk-gb/2012-Januar...
deleted 15y ago
[deleted]
Natsu 15y ago
If these are the same as the Mocality people, I wonder how long before Google audits and fires them? I also wonder if we'll find out about any more wrongdoing. Hopefully Google shuts them down soon.
- tylermenezes 15y ago
  I'm really suspicious of any claim that the top brass at Google honestly knew nothing about it... (What would these employees even have to gain? It's not like they have much to gain if Google's stock goes up, and if they're hiding this from management, they're not getting paid for it.)
  - redthrowaway 15y ago
    Define "top brass". If you're saying some upper-middle management at Google India, possibly. If you're saying that this is being done at the VP level, I think that's a bit tin-hatty for what we've seen so far. Regardless of whether or not you think Google is strategically sabotaging other projects, I think we can all agree that if it were under the direction of Google's top brass, they would have been smart enough not to use their own IPs. It's not an organization to which one would attribute less technological accumen than your average Wikipedia vandal.
  - kaze 15y ago
    >I'm really suspicious of any claim that the top brass at >Google honestly knew nothing about it... If Google Management knew of this, wonder why they would let this happen from Google IP addresses...
    - jrockway 15y ago
      Because Google employees generally have latitude to do whatever they want with their Internet connection at work. Even bad OSM edits. If we start blaming whoever an IP resolves to for vandalism, you're going to find that pretty much every major corporation has vandalized Wikipedia. (When I worked at BAC, our proxy was perma-banned for vandalism.) Not to mention the ISPs; Comcast is a notorious Wikipedia vandal (by this logic).
  - CWuestefeld 15y ago
    What would these employees even have to gain? Should we apply this logic to all open source contributions, and view with suspicion everything that doesn't have a price tag attached?
  - jrockway 15y ago
    In a past life, I've vandalized Wikipedia. I did it because it was funny to me and the people around me at the time. (To be fair, it was John C Dvorak's page. But the point is, I didn't do it for money.)
wisty 15y ago
It could also just be a broken bot. You'd think Google would be smart enough to know not to POST 100k times to an outside service, but it's possible there's someone in the ranks who just doesn't know what they are doing.
- ZeroGravitas 15y ago
  The 100,000 hits by 17 accounts took place over a year could be 99.9% valid contributions. They mentioned that number because they have recently noted 2 accounts vandalising and so it's probably wise to check the other interactions in case they are subtle vandalism by the same person/people that went unnoticed at the time but that it'll take time to confirm either way.

deleted 15y ago

[deleted]

chrisacky 15y ago

I can understand Mocality posting on a blog their findings, but this is an awful and not very credible way of make public your accusations. Look forward to an explaination?... then contact them directly instead of "sand bagging" them (borrowing a colloquialism from Family Guy).

gitarr 15y ago
I disagree: Actually the best way to get answers from a too-big-to-communicate company like Google is to make the whole process as transparent and out in the open as possible. Google is notoriously difficult to contact for most people. One of the best ways to get them to respond is to let as many people as possible know about the issue at hand. Public backlash -> answers.
- dredmorbius 15y ago
  I've managed to contact a few different organizations in a few different ways. I'm no fan of Microsoft (check post history), but when I found that a large volume of 419 spam was coming through Hotmail some years back, I looked up their main switchboard number, called, spoke briefly to the receptionist asking for the VP of the related unit (I'd looked up his name). She transferred me to him. He picked up on the first ring. I explained the situation briefly, we spoke for a few minutes, at the end of which he said he'd put me in touch with the guy who could fix things. Fifteen minutes later I was talking with him, and we exchanged information over the next few months as I helped him plug his holes. I am still highly impressed by the professionalism demonstrated at all levels. I'd also worked with Microsoft to resolve a GPL compliance issue (again, directly contacting the appropriate VP) again with minimal fuss. A southeastern US university IT contractor who's private business was spamming me (and he was denying it) ended up with a series of emails escalating up the academic food chain, ultimately to the university president (.edu websites are, or at least were, wonderfully information rich). I eventually got the response I had hoped I'd get on first contact. Another issue involving AOL at which numerous attempts to contact them failed. I ended up somewhat crashing (well, I did wrangle a late invite for a brief presentation) at which I presented data, including some which indicated AOL's little problem. Their chief postmaster was present. We talked a bit. More recently, Yahoo have had issues in severely restricting mail delivery rates to Yahoo's MXs, even for long-existing, SPF/DKIM compliant MTAs. I'd gone endless rounds with their helpdesk and had repeatedly emailed (with no response) their CTO. So I sent a group email to a roster of their top (C-level and senior VP) staff, again with some data indicating issues (pflogsumm delivery stats showing hours of delay) and an introductory text "Gentlemen, you have a problem". That finally got a response in the form of a "Yahoo concierge" who spoke with me a couple of times and sorted the problem (and also promised a review of policies in general, in case anyone else is having issues). Just a few anecdotes of different ways to get a company's attention. There's no one-size-fits-all approach, so be flexible. I generally try a direct private contact first, but ... well, if that doesn't work, I've got a bag of tricks I can pull out. Public shaming can work, but I'm willing to give the benefit of doubt first.

robinhouston 15y ago

There’s an interesting comment from Tom Hughes: “As the person who (in my role as an OpenStreetMap system administrator) first discovered this `incident' let me start by saying that I consider this post to be grossly irresponsible and wholly inappropriate. [ … ] It seems to me that this is just an attempt to get some cheap publicity by trying to like the project to the Mocality incident, and I cannot support such behaviour.”

jc123 15y ago
What were Tom's arguments? It would give better perspective than just his conclusion.
- corin_ 15y ago
  "The board of OSMF are making mountains out of tiny pimples here. It seems that they want this to be some sort of organised corporate malfeasance on the part of Google which is why they have tried to link it to the recent Mocality incident where there was indeed clear evidence of such behaviour. "The reality in this case is that there is no evidence that this is any different to the numerous other incidents we get all the time where users either accidentally or deliberately make bogus edits. The only difference in this case is that there happen to be two accounts (though we do not know if that is two people) and the user or users involved happen to (presumably) work for Google. "That is the sum total of what we know, and on the back of that, and without approaching Google at all, two leading board members have decided to reveal personal information about two of our users."
  - evolve2k 15y ago
    I think the boards concens and response is fair enough, google employees have an obvious potential conflict of interest if they are vandalizing maps, even if they are acting by their own volition it is still something I would expect Google to take action around and publicly not condone, assuming even the most innocent of circumstance.
citricsquid 15y ago

nostromo 15y ago

The founder of OSM and author of this blog post runs Bing Maps. I hesitate to bring this up and add to the melodrama -- but people should be aware of the interests of the parties involved.

ot 15y ago
To be completely fair, the post is signed by three people. The other two are an OSM Sysadmin and an OSMF board member. I'm not saying that there may not be a conflict of interest, but this post has some support from the board of the foundation.

ot 15y ago

According to ReadWriteWeb [1] Google PR responded We're aware of OpenStreetMap's claims that vandalism of OSM is occurring from accounts originating at a Google IP address. We are investigating the matter and will have more information as soon as possible [1] http://www.readwriteweb.com/archives/google_osm_vandalism.php http://www.readwriteweb.com/archives/google_osm_vandalism.ph...

deleted 15y ago

[deleted]

sharken 15y ago

This story is a little light on details, but the fix however is easy enough: Just rollback all edits by that user.

rea1234 15y ago

rea1234 15y ago

rea1234 15y ago

<html> <body> <h1>My First Heading</h1> <p>My first paragraph.</p> </body> </html>

rea1234 15y ago

rea1234 15y ago

<vbn>

Encryptor 15y ago

Bullshit. If they really wanted to vandalize your project, they'd use a chain of anonymous proxies.

packetslave 15y ago

From http://www.readwriteweb.com/archives/google_osm_vandalism.php http://www.readwriteweb.com/archives/google_osm_vandalism.ph... Update: Google sent the following statement to ReadWriteWeb on Tuesday morning. "The two people who made these changes were contractors acting on their own behalf while on the Google network. They are no longer working on Google projects."