12 ms·
Google backslides on federated instant messaging, on purpose?
- speeder 14y agoEvery time someone break stuff to "fight spam" I can only conclude it is one of two things: on purpose unethical behavior, or incompetence.
- jxf 14y agoKind of like how we break a lot of our legal system to "fight child pornography". Yes, they're both bad things, but fighting them cannot come at the cost of breaking otherwise perfectly legitimate and functional endeavors.
- speeder 14y agoThis might be also lots of overreaction. I've met two very intelligent women (That don't know each other) that for most things have very reasonable opinions. But throw "child abuse" and it is like telling a robot to hide in a corner in a round room, they just break and if they could they would pass laws about instantly killing suspects of child abuse. When I try to argue with them of how "x" or "y" is bad idea because of its side effects, they always reply: "I don't care, EVERYTHING is worth doing to protect children." And then I understand why so much politicians use "for the children" rhetoric when they want something.
- guard-of-terra 14y agoMaybe they're compensating for not having children they want to have or not spending enough time with their own children. They redirect their frustration by wanting to punish "child abusers" when the source of this fictional abuse is in their head. I guess that's what happen. The room is round, but their upbringing tells them to stand in a corner.
- ceejayoz 14y agoMaybe they're space aliens, while we're wildly speculating.
- guard-of-terra 14y agoDo you prefer "they're stupid and dangerous" answer? Because it's either this or that.
- waterlesscloud 14y agoOr perhaps they were abused as children. Or know someone who was. Or they were afraid of all the big adults when they were children. Or. Or. Or. There's lots of other possibilities.
- guard-of-terra 14y agoThat's not less of a speculation.
- ceejayoz 14y agoWell, that's a false dichotomy if I ever saw one. I prefer "well intentioned but misguided", "worked up by a sensationalist media that obscures the fact that kids are safer than in the 'idyllic' 1950s", etc. theories.
- guard-of-terra 14y ago"well intentioned but misguided" equals "stupid and dangerous" once you shave off the bullshit. At least in this case. It's a textbook case, exactly like the one in South Park Uncut.
- gbog 14y agoYou're wrong but I upvoted your comment.
- endtime 14y agoIf only Google would hire you, I'm sure you could solve all our spam problems (including the one I work on) in an ethical and competent way. :) Sometimes there are different classes of users with conflicting interests, and no algorithm or ML model or abundance of good intent can resolve them.
- harshreality 14y agoI thought SOP for mitigating IM spam was to require user confirmation before delivering the suspect IMs? Google doesn't have to perfectly solve the spam identification problem in order to make IM usable without rejecting all remote messages. Why won't this work: - Allow IMs if the sender's address is anywhere in the recipient's contact list, or in a separate IM-specific whitelist (see next point). - Have a separate IM whitelist that supports user@domain or @domain for special circumstances. - Automatically add any foreign outgoing-IM recipient either as a new contact in the sender's contacts (if an IM field is added) or in the separate IM whitelist, so return IM from the same address is guaranteed. - Have a list of unconfirmed senders from the last N hours/days (after which they expire and are dropped), with a web-based interface... (clarification) notifications of these requests would NOT push through to the Google user's IM interface. - Optionally reply to unknown senders: "You are not a confirmed sender of this recipient. Contact recip OOB to ensure future delivery." - Optionally add an IM field to google contacts, for instances where a remote address doesn't function as an email address.
- enjo 14y agoThe requests themselves are spam. In the last couple of months I was seeing an increasing frequency in "lisaxxxhotone wants to chat with you" requests. I always ignore them..but it's a very annoying problem. You can simply ask for user confirmation, you're bothering me about something I really don't want to deal with.
- deleted 14y ago[deleted]
- endtime 14y ago
- mmanfrin 14y agoI think I might be a minority here, but I think this is an okay move. I use gchat exclusively with people within my workplace (also on gchat) and friends who also work at places with Google apps. However, I've been getting a consistent barrage of requests from spam email accounts to chat; accounts with obscene names like 'sweety+69+for+free@freemail.ru' or something to the sort. The names/domains of each are different every time, so I can't simply block a domains. I ask: if Google does not block outside requests, what could they do to stop this sort of thing?
- mtgx 14y agoI was getting the same on MSN, and I don't think that was federated.
- cbhl 14y agoMSN/Windows Live Messenger (and now Skype) do support federation with Lync Server, which is Microsoft's corporate instant messaging server. Over the years, Microsoft has tried various attempts at making MSN/WLM interoperable with AIM, XMPP, and ICQ -- albeit with limited success.
- mindcrime 14y agoGreat, do you want them to block incoming emails from any domain other than your own, as well?
- zdw 14y agoObviously not. But anti-spam measures are decades old at this point and well known. The argument is a "the technology isn't there yet and spammers are running rampant, so the obvious solution is block it, which isn't ideal", not "Google is doing this because they want a monopoly on chat, and broke the protocol to do it".
- mindcrime 14y agoPersonally, I'm not (necessarily) suggesting that "Google is doing this because they want a monopoly on chat, and broke the protocol to do it". But it seems to me that as much experience as Google engineers have dealing with spam in the email world, they could come up with something feasible on XMPP as well. Doing this strikes me as throwing the baby out with the bathwater.
- mindcrime 14y agoWow, not a great week for Google here. Their reputation has certainly taken a big "ding" in my eyes, between this, Reader and CalDAV.
- bentcorner 14y agoI'm not saying this is going to happen at all, but I wonder what would happen if Google had to end up putting all its horses behind automated cars and Glass (because of changes to the search marketplace, of which these changes we're seeing are just the start of a response to). In 20 years we'll be driving Google Cars and we'd tell our grandkids "You know, Google used to do email" to their great surprise. In real history, this is like telling kids that Nintendo used to make Japanese playing cards.
- patrickaljord 14y ago> In real history, this is like telling kids that Nintendo used to make Japanese playing cards. Not really, Nintendo cards weren't used by most countries on earth minus China and didn't revolutionized gaming world widely the way google did with organizing knowledge.
- mh- 14y agoperhaps their cards didn't, but NES certainly did [revolutionize gaming].
- ics 14y ago> Nintendo used to make Japanese playing cards. Well, they also made love hotels and a (taxi) cab business. Without making any predictions of my own, I agree it'll be pretty interesting to see what a company like Google will become down the road.
- zdw 14y agoThere are legitimate ways that follow the letter of the RFC to prevent spam over SMTP (greylisting, etc.), or to overlay sender/server validation on top of it (SPF, etc.), but most of these lessons aren't cross applicable to XMPP Sure, Google could spend a lot of time trying to come up with a technological solution that doesn't break federation (except for in spam cases), but it would be difficult to do on a service that fundamentally doesn't make money. This sounds like blog trackback all over again - useful, a nice idea, but nearly worthless once spammers figure out how to pee in the communal pool.
- RyanZAG 14y agoObvious fix here: only allow chat invites from people you have sent an email to. Google could return an error to blocked invites to inform them that they must get the recipient to send them an email first. I can't see any downsides and it definitely solves the spam problem. If they could make it apply to other gmail accounts as well, even better. I've gotten annoying gchat requests from sweety69@gmail.com as well.
- zdw 14y agoThis could work, and is much better than blackholing all the federation requests.
- guard-of-terra 14y agoNot all Jabber services provide e-mail. How would you write an email from one that doesn't?
- jrockway 14y ago"Great is the enemy of good."
- codemac 14y agoMost people on federated servers are specifically on servers like xmpp.us, jabber.org, etc that don't have associated email accounts. This isn't perfect being the enemy of the good, it's a description of why it's not even good.
- pseut 14y agoThe Gmail user could add the account to their contacts without sending an email. Hell, they could send an email to a nonexistent jabber address to whitelist the account (which might be easier than adding the account manually for some people). As long as the email doesn't have to go through...
- cooldeal 14y agoInteresting Google week so far. 1) Discontinuing Google reader 2) Retiring CalDAV support 3) Removing ad blocking apps from the Play Store 4) Replacing Android chief Andy Rubin with Sundar Pichai. 5) Dropping support for sending chat invites to Google chat users from other domains. Wonder what else is up for the next couple of days.
- InclinedPlane 14y agoIt's not surprising, google has been on the road to becoming the next Microsoft for a while. Though it is depressing. It's interesting though, so much of google's core business relies on trust, and they've been making a lot of moves lately to just throw away as much trust as possible. Maybe it's sustainable, but I'm skeptical.
- mehrzad 14y agoWell, it seems to be creating growing support for Mozilla and the FSF, which I think/hope we can get behind. A bunch of people disagree with the FSF though.
- mh- 14y agoGoogle is far and away the largest source of funding-revenue for the Mozilla Foundation.
- mehrzad 14y agoWell, I don't think it'll stay this way, though I'm grateful for it. If everyone who used Firefox donated a dollar...
- eloisant 14y agoGoogle is not subsidizing Mozilla, they have a search contract that is as much in the interest of Google as Mozilla. * Mozilla can switch to a different default search engine (like Bing) and still get as much revenue without depending on Google. * Google can't act like it controls Mozilla, because they don't want to lose the partnership either
- cs702 14y agoThe "unintended side effect of filtering spam" explanation makes no sense. How likely is it that the same company which builds bleeding-edge machine-learning systems to track and predict our behavior online, and which uses these AI predictions constantly to maximize their ad revenue, somehow cannot find a better way to filter out spam invites? How likely is it that the same company that houses the likes of Hinton, Norvig and Kurzweil under the same roof can't find a better way? Google is packed with experts at solving the "spam filtering" (i.e., pattern recognition) problem. It appears this was done on purpose[1], driven by a corporate culture that no longer cares as much about openness. [Please read jholman's responses below. He's right, I went too far with this last sentence.] -- [1] http://mail.jabber.org/pipermail/operators/2013-February/001571.html http://mail.jabber.org/pipermail/operators/2013-February/001... -- Edits: added "it appears" at the end, to tone down the language. Also, reworded and added sentences to make my point clearer, and corrected text to refer to invites, not messages (thanks for pointing that out, mdc!) and point out that this was indeed done on purpose.
- cma 14y agoMaybe Hinton didn't make any progress on it yesterday so they decided to call it quits? It does suck that they did this. I have been hit with many spam requests through Google Talk recently though. You should at least be able to whitelist people in your address book or something. Yeah, you can still send them an invite, but what if the third party's service adopted the same policy as Google? They should at least let you opt in to requests.
- onemorepassword 14y agoI have spam-filtered email addresses through 3 different email providers, one of them being Google. Only Google manages to constantly produce falls positives (including mail from, sweet irony, Google services like Analytics) and regularly allow spam and phishing mails through. The other two, ran by relatively small providers, are nearly perfect. Don't overestimate Google. (The same "intelligent" Google also seems to be unable to figure out which language I use, despite me telling them on a regular basis.)
- 14y ago
- agwa 14y ago> This change is akin to Google no longer accepting incoming e-mail for @gmail.com addresses from non-Google domains. That would be unthinkable. The sad thing is that I no longer consider this unthinkable. There's an extremely disconcerting email monoculture emerging around gmail. Practically everyone I exchange email with uses gmail. Companies and universities are switching to gmail. It can be difficult to get your mail accepted by gmail if you run your own servers: I help administer the servers at one organization whose mail (personal correspondence, not mailing list posts or the like) often gets sent straight to gmail's spam folder and we're doing everything right in terms of DNS/SPF/DKIM/etc (in fact, the same config works great elsewhere). Try to look for help on gmail's website and all you can find for this problem are the "Bulk Sender Guidelines" - as if the only people who aren't using gmail already are bulk senders. Now consider Google's actions as of late. I could totally see them one day saying, "we're not going to accept email from you unless we've emailed you first or you've contacted us to ask for permission." There would be outrage, but I also wonder how many people would actually stop using gmail if they did this. Edit: I'm not saying this will happen, I'm just saying it's not unthinkable, which is sad.
- jeremyjh 14y agoJust curious have you checked to see if those servers have IPs that are on a Spam Haus or other spam block-lists?
- agwa 14y agoI have checked and they are not.
- jiggy2011 14y agoUnlikely, there's enough big orgs that use exchange etc for all kinds of reasons. Google apps is fine if you are a small company and just want to get some email working but I've always found it hits limits pretty quick.
- __david__ 14y ago> It can be difficult to get your mail accepted by gmail if you run your own servers: I help administer the servers at one organization whose mail [...] often gets sent straight to gmail's spam folder... As a counterpoint, I've been running my own mail server for 15 years (from various hosted and dedicated servers) and I haven't ever had a problem delivering to gmail...
- rachelbythebay 14y agoI was very disappointed when I found out they don't use TLS when federating XMPP. Basically, if you're chatting with someone who uses them for XMPP (Jabber) service, your stuff is riding in the clear between the two servers. It's been like this for years.
- mike-cardwell 14y agoPeople should use OTR anyway. That way not even Google can see your messages.
- pseut 14y agoHow many gmail chat users use an external IM client?
- cdcarter 14y agoThe client built into the gmail interface supports OTR.
- pseut 14y agoWrong OTR Edit: that came out a little curt. The OTR protocol is different than what Gmail calls OTR. Gmail's just turns off logging; the protocol is encryption.
- mike-cardwell 14y agoI don't know. Most of them?
- pseut 14y agoI was thinking almost none of them.
- mike-cardwell 14y ago
- cbhl 14y agoWhile this is unfortunate, I don't think it's particularly surprising. For example, Facebook allows accessing their Chat servers using XMPP, but they don't support federation at all.
- diminoten 14y ago> We hope that Google will retract this change and find a solution that does not undermine the distributed nature of the Internet. I'm sick of this kind of language, why does EVERYONE who does advocacy have to speak like this? Can no one be reasonable?
- icebraining 14y agoWhat exactly is your issue with it?
- diminoten 14y agoIt's too grandiose a statement, considering the act.
- sergiosgc 14y agoA distributed Internet based on open protocols is grandiose now??? Are we that far down the rabbit hole?
- diminoten 14y agoNo, the idea that Google making this specific action is "DESTROYING" a distributed Internet is grandiose.
- icebraining 14y agoThey didn't say destroy, they said "undermine", which means "To weaken or work against", which this action certainly does.
- diminoten 14y agoSame problem, and no it doesn't.
- bgruber 14y agowhile this does sound really horrible, the pragmatic part of me is forced to agree with google's decision here. Other gtalk users undoubtedly account for the lion's share of incoming requests, while non-gtalk requests undoubtedly account for the lion's share of spam. it's much, much easier to whitelist the few 'good' jabber providers than to filter the spam.
- losethos 14y agoberp. God, whatcha wanna talk about? Soap operas? Maybe, people confide problems? God says... You_fix_it vein want defile whilst straightening while loud differently beholdeth crossed blesseth increased bread disk hedged appeal melody Spain rebel uncertainties mirth yielded spokest evincing gardens chooses feeding early o'er weakest hint outward annual complaints that's_for_me_to_know recite adoption impious spoken homo overcome torrent Czech_Republic eat fearful Wondrous conveyedst Prof lessons limbs suck die- Jove's houseless choler stomachs dinner yieldeth against disclaimers warring Verity conformably examined East_Timor deceiving purposed not_the_sharpest_knife_in_the_drawer Let infantine feeding BRB finds evident dignity You people can just say stuff out-loud in your room. God? What's Yer favorite language? God says... saying partake plot Manichee extended flung beggar chambering nurses
- fluidcruft 14y agoHa! I think Google must have realized that over the last two days I have deleted my Google+ and youtube accounts, shut off/deleted blogger, purged Chrome from all my desktops, laptops and phones and registered for an @jabber.org XMPP address. And I'm not the only one, my friends are all on board with excising the hydra. Still hesitating about the effort needed to migrated from gmail, though. Time to organize exodus parties.
- icebraining 14y agoIt's not really that hard. Backing up is relatively easy (offlineimap or similar) and you just need to forward the Gmail account to your new one for a transitional period, while you gradually change your address.
- mh- 14y agoperhaps if worldwide release parties are organized they'll defer taking Reader offline.
- Semaphor 14y agoGood thing I never gave up my @jabber.org address… To think I recently held them up as properly working with the XMPP consortium to add official features unlike facebook.
- zeen 14y agoI'm one of the authors of the Prosody XMPP server, and a member of the XMPP software foundation. Prosody operators have been reporting this for more than a week now. Google users have apparently been flooded with subscription requests from spammers, and the flooding suddenly became massive. The problem is, there are a large number of jabber servers out there which have open account registration without captchas. Most jabber server software doesn't come with a captcha module included by default, and of course, most admins don't bother changing defaults, even while running a public server with open registration. Unlike some other comments here, I don't think Google has any malicious intent in this. This seems like a stop-gap measure, while they figure out and implement a proper solution. As to the proper solution, the XMPP community is largely moving towards having captchas, or other forms of verification, and there are a number of proposed standards. The thing to understand here is that the XMPP community has historically not had a spam problem. Due to the nature of the protocol, spoofing wasn't possible from the start, and there were no large lists of JIDs for spammers to abuse, so things worked out fine for a decade despite a lack of captchas. The good news is that the XSF was already preemptively working on the spam problem, and the speed with which XMPP specs (XEPs) get defined, implemented and deployed in servers and clients is far faster than any other large scale open protocol that I'm aware of.
- morsch 14y agoSo what's the best alternative for mobile XMPP messaging? I've tried a couple of the popular ones, and none of seemed to work as well as GTalk (reliable delivery with no effect on battery life). I assume that GTalk is only a slim client, and the XMPP stuff happens server side, which aids in that. I suppose there are other services that work the same way. Anything self hosted? Also, not having OTR messaging (ie. the socialist millionaire protocol, not Google's private mode) just seems stupid in this day and age. And so does not using TLS for federated messages, if what I've just read in another comment is true. It really is time to switch.
- mh- 14y agoGTalk does not have "no effect on battery life". I'm assuming you're on an android device (you didn't say) -- all¹ Android devices are "always" connected to GTalk already. GCM (C2DM) sends all push notifications/wakeup requests over this channel, and therefore the framework ensures the socket remains open even when sleeping. ¹ - ones with Google Services
- morsch 14y agoOkay. TANSTAAFL. Regardless, in my experience, apps like Jabiru tended to drain the battery noticeably faster while at the same time being less resistant to outages when interrupted briefly (elevator, subway, etc.).
- andyl 14y ago"Don't be evil" et tu, Google?
- camus 14y agoAt least Microsoft folks do not pretend they are not evil , Google is even more devilish when they claim they are not evil ... Well they are at least as bad in PR as Adobe , that's a relief.
- Nux 14y agoI can see a pattern here. :-) Again: people, run your own shit. Stop playing the google roulette.
- ebiester 14y agoI have 15 minutes a month to run my own shit. What solution do you have? No, really. I would rather spend that five hours making sure shit works with my boyfriend, or my family, or my friends, or learning something that will make me money, or working on a pretty cool hack I thought of while in the museum last week, or working on my unfinished novel that has been languishing, or work on proofreading a paper for a friend, or just relax. Yeah, system administration is under those priorities. I am more than willing to pay. I just want to pay one person for everything. I want that integration. I want webmail. I want to be able to access it from my phone without issue. I like integration. I may be a geek, but I have better things to do than figure out why my email isn't getting to a friend because someone's IP address ended up on spamhaus.
- jamespo 14y agoPay a sysadmin to do it for you
- ebiester 14y agoIsn't that what I'm doing by using hosted services?
- Nux 14y agoEbiester: if you want a decent email platform with webmail, calendaring and maybe xmpp, have a look at Zimbra. It's super easy to install, all you need is a VPS with Centos 6 or Ubuntu 12.04 and a static IP address, then download and execute the installer. I understand it's not so easy to run your own stuff, but it's also not as hard as some people believe, especially if all your need is a small setup for personal use. I'll try to wrap up some tutorials in the near future to help people run stuff on their own. I'll remember to ping you when done.
- Zash 14y agoThey have been doing this since at least the beginning of March. And the blocking is also done in a way that causes the user to not be notified, basically by replying in the wrong direction. http://mail.jabber.org/pipermail/operators/2013-March/001610.html http://mail.jabber.org/pipermail/operators/2013-March/001610...
- kushti 14y agoAnother fail of Evil Corporation. However, we need for a new generation of Internet Jedis to smash the Dark Empire of Darth Serge and Darth Larry
- jfoster 14y agoNot sure about the headline, but the tone of this message from the FSF suggests a maturing of their efforts. Notably missing is a lack of the word "evil" or strongly worded demands. It makes them far more credible, I think.
- ChrisCinelli 14y agoFrankly, after I received some spamming bot services to contact me, I do not think that the Google solutions is that bad. You can request to be white listed if you are a legit site. This increases the quality of gmail's user service and still let other legit player to access gmail's users. As a gmail user, I think what they did was good and if somebody has a better idea... please... I am waiting =)
- dn7dt3qmpldi 14y ago“This change is akin to Google no longer accepting incoming e-mail for @gmail.com addresses from non-Google domains”. No, it’s not. It’s this kind of constant exaggerated claims that give a bad reputation to people that speak for free software, and make them look like out‐of‐touch conspiracy theorists (think Stallman). Now, I’m not saying I disagree with the message as a whole; it is bad that google closes the door to this kind of interaction, but it’s nowhere close to what they claim (and in bold). With their example, you’d effectively only be able to speak to the person on the other side, but never receive their messages. This case is very different, as only the initial contact is unilateral (the person with the gmail account has to invite the other one), but after that, it works just as well. It’s this kind of stupid exaggerated argument that drives people away from your message.
- mwcampbell 14y agoFor those who would like to move away from Gmail+GTalk but don't want the hassle of running a VPS, Dreamhost offers XMPP as part of its web hosting service.