7 ms·

The Woman at the Heart of Everything Google Builds

52 points by lingben 13y ago

tippytop 13y ago
I'm sure Ms. Meckfessel is a lovely person, but this is clearly a PR driven piece pumped out of Google for recruitment purposes. Throughout this entire NSA scandal people lament there's nothing we can do, but these tech companies are vulnerable to talent shortages. A simple action for a conscientious hacker is to simply not work for PRISM collaborators. Apply your talents to companies willing to make privacy assurances.
- rryan 13y ago
  > PRISM collaborators You mean companies that comply with US law? So your advice is to work outside of the US?
  - EthanHeilman 13y ago
    >You mean companies that comply with US law? So your advice is to work outside of the US? 1. Or work in areas which do not handle data that the US requires by law. You can find software jobs in the US that do not require collaboration with governmental domestic spying. For instance many people choose not to work for companies that build weapons of war for a variety of reasons. These people can still work inside the US. 2. Additionally non-US residents work for Google. Being outside the US doesn't really have much relevance to the discuss. 3. I also reject the notion that Google had no choice. Google may have been able to comply with the letter of the law without giving up user data by using e2e cryptography. One can support or question their actions, but they are not powerless victims in this drama but active agents that can be held responsible for what they do.
    - fpgeek 13y ago
      > Google may have been able to comply with the letter of the law without giving up user data by using e2e cryptography. Only at the cost of not providing the service that users want, which includes such things as fast, full-text email search, recovering accounts after passwords (and other security tokens, if any) have been lost. Once Google can extract the unencrypted email for any purpose, the practical consequences of their legal obligations make all cryptography Google provides useless against this sort of attack. Yes, Google has a choice. But let's be clear on what that choice is: They can choose whether or not to offer a mass-market email service. Once they've decided to offer that service, the practical consequences are inevitable, given the current, relevant legal framework.
      - EthanHeilman 13y ago
        I don't think you or I, or even Google knows the total set of their options, but we can sit here and come up with some alternatives. >Only at the cost of not providing the service that users want, which includes such things as fast, full-text email search, e2e encryption is completely compatible with fast, full-text email search. There are several companies that currently offer such services, that is webbased, fast searchable email, that is e2e encrypted such that no plaintext arrives on the server side (unfortunately I am under an NDA or I would tell you more but you can read the papers if you like). Stuff like this: http://www.forbes.com/sites/andygreenberg/2011/12/19/an-mit-magic-trick-computing-on-encrypted-databases-without-ever-decrypting-them/ http://www.forbes.com/sites/andygreenberg/2011/12/19/an-mit-... It's not just databases it's search engines as well. I think gmail probably loses some enterprise clients because they don't do this, but I expect "enterprise level" features like this from gmail in ~2-3 years by my guess. Probably sooner due to the nosedive in trust they just took. Google has a monopoly on new email account creation so they don't need to innovate to get new customers (hell android locks everyone in). It isn't outlandish to suggest that they could have chosen to innovate and done what has been in the research literature for some time now. Secure e2e encrypted cloud email. >recovering accounts after passwords (and other security tokens, if any) have been lost. Have you tried to get gmail accounts back because I know people that have lost all their email. Are they better at this now (maybe they are, I hope so)? Even with this as a requirement, it is achievable. The user's client just sends a copy of the key to a foreign key escrow service that will unlock their account if anything happens once they prove they are who they say they are with various forms of ID and proofs of knowledge. Paranoid users can elect not to do this. Or ask people in your circles that you have marked as trusted to attest to your identity. You could do some clever threshold cryptography with your closest family and friends. They big trick is making money off ads while not learning about the contents of the email. One way could be a bounded leakage strategy whereby the encryption scheme allows some ad matches without giving up more than one or two popular words per email. All of this is a sideshow though. The NSA wasn't going to throw the Google execs in jail for not towing the line. Google is an extremely powerful company with a strong lobby in Washington. Not to mention that just pressing the charges would be a major embarrassment for the NSA. Twitter fought and won. Likely they just offered Google some nice contracts with the US government.
  - tippytop 13y ago
    There is something these companies allowed that went beyond others, Twitter is not listed for example. As Snowden pointed out [1], these companies need to make some kind of technical assurances for privacy, otherwise customers (and potential employees) should look elsewhere. [1] "The [telcom] companies should write enforceable clauses into their terms, guaranteeing their clients that they are not being spied on. And they should include technical guarantees. If you could move even a single company to do such a thing, it would improve the security of global communications. And when this appears to not be feasible, you should consider starting one such company yourself."
  - fpgeek 13y ago
    > You mean companies that comply with US law? So your advice is to work outside of the US? What makes you think you don't have to comply with US law if you work outside of the US? If you're a US citizen living and working abroad, it will quickly become painfully clear exactly how much work you have to do to comply with US law (and how severe the penalties are if you don't). And US citizen or not, you might be surprised at how many non-US companies elect to comply with various aspects of US law for business reasons.
- infrec 13y ago
  What do you mean by PRISM collaborators? I am genuinely curious because I feel like I missed when/where that was established. To my understanding, and please correct me if I am wrong, PRISM isn't a system that companies subscribe to, but more of a government portal for requesting information from a number of companies in a legal fashion. Is this not correct? I admit I have not kept up with all of the bits of information released due to the high volume of speculations generated by just about everyone that talks about it.
  - EthanHeilman 13y ago
    We still don't really know what PRISM is or how it functions. It does appear that US companies did provide overly broad information to the US government using the following logic. 1. The US government gets massive amounts of information from these companies and can get this information in real time with no oversight, 2. none of these companies seem upset about it, which one imagines they would be if the US government was just stealing it without their permission, 3. and these companies have cooperated with the governments misinformation campaign (denials of "direct access" and such). If they aren't responsible for initially giving them access, they are now responsible the governments continuing access since they have learned that the government does have access and they have not attempted to prevent the government from maintaining access and furthermore they have aided the government ability to maintain access by stifling public outcry about this access by lying to their users.
    - infrec 13y ago
      Your reasoning is not very convincing. Point one is pretty much the entire question so claiming it as proof seems circular. If you have evidence proving that claim I would be satisfied. Point two is simply wrong as there was a lot of writing from CEO's and engineers that seemed quite upset about the claims. And for point three, uh... what? How are their denials proven to be lies? Or are you implying that companies using the phrase "direct access" is proof? Honestly your post, combined with a lot of others' on this site, would seem to belong quite nicely in /r/circlejerk. I'm not saying that as an insult but rather how all of these speculations kept alive through echo genuinely come off as. If you have actual proof please provide a better reasoned argument.
- codex 13y ago
  Given the secrecy surrounding PRISM, is there any way to know whether a company has been recently forced to comply with a PRISM-like program? Snowden's data is already stale, and only covered the largest companies.
- jimzvz 13y ago
  >...this is clearly a PR driven piece pumped out of Google for recruitment purposes. Agreed, can someone point me in the direction of some tech writers that aren't afraid of journalism?
weareconvo 13y ago
The chick in charge of the Internal Tools team? That shit is widely regarded within Google as a dead-end ghetto, devoid of opportunities for promotion and looked down on by the other focus areas. - 5+ year Ex-Googler EDIT: I'm done with this fucking site. You won't have weareconvo to kick around anymore.
- circuiter 13y ago
  Relax and hang around. Those complaining are most likely poseur male-feminists. They might as well protest in 'chick-lit' sections of bookstores.
- SeanDav 13y ago
  This is a spiteful and misogynistic comment - you do yourself and this community, a large disservice.
  - weareconvo 13y ago
    No, it's not. It's the truth.
    - pasbesoin 13y ago
      "chick" I don't have to go past that word, to have a problem with your comment in this context.
      - weareconvo 13y ago
        Maybe you should be more open-minded then.
    - crazygringo 13y ago
      I'm only responding to this because your comment is #1 on the page right now. The factuality of your comment has nothing to do with it. Calling her a "chick" is like calling Larry Page a "boy toy" -- the word is used largely in sexual situations ("picking up chicks"), and is incredibly unprofessional and demeaning in a professional context like the workplace, or Hacker News. And talking about the Internal Tools team as "that shit" is equally unprofessional and demeaning to everyone who works on it. You should be ashamed of yourself.
WestCoastJustin 13y ago
The Wired article talks about internal tools used to compile code. In line with that, there is an interesting video "Building Software at Google Scale" [1], which seems to give an overview of the systems used. [1] http://www.youtube.com/watch?v=2qv3fcXW1mg http://www.youtube.com/watch?v=2qv3fcXW1mg
dnautics 13y ago
really, a story about a prominent female engineer, and the first paragraph is about how she dresses? I'm hardly a feminist, but this is kind of rediculous.
- mseebach 13y ago
  In context, it's actually pretty relevant. The anecdote, like the piece itself, is about how she deals with being a woman in a very male dominated world. Dress is one of the most direct and tangible differences between men and women.
  - dnautics 13y ago
    I'd disagree. But even if it is the "most direct", whatever that means, you don't think that there are more serious gender-assumption transgressions in the tech world? It's a little annoying to me that the first anecdote is the most superficial one. I give the writer a pass, if Melody herself insists that that's the most important issue, or if that was, chronologically the first thing that Melody brought up.
- sltkr 13y ago
  It's not so much a story about an engineer who happens to be female, as it is a story about female engineers, the gender gap, and general lack of diversity in engineering. Considering dress is one of the most important gender expressions in our society, why shouldn't it be mentioned in an article about gender differences? By the way, if I were Melody Meckfessel, I'd be more concerned that the WIRED editors managed to misspell my name twice in one article.
voidlogic 13y ago
>The other key thing, according to Meckfessel, is that the system compiles code with unusual speed. In typical Google fashion, it spreads compilation tasks across vast array of servers, rather than generating the executable software on the developer’s local workstation. I hope she has more than this to focus on as Go usage is picking up within Google. And with Go, just the local workstation can do it. :)
- cromwellian 13y ago
  That's only because the amount of Go code is small. Google builds all transitive dependencies from source in HEAD, so if there were 10 million lines of Go sitting in the repository, your local workstation won't cut it. It's not even the build times which are the most pressing issue these days, but the time for tests to run.
  - nostrademons 13y ago
    One of the major design goals for Go was that incremental compiles should not require a rebuild of all dependencies. I believe they bake interface information into the library files for this reason. If you don't change a file, you shouldn't need to rebuild it. If you sync to a later CL, you might need to rebuild what's changed, but even then all this should be cacheable across the company. Go was designed as a language to avoid a lot of the mess that the build tools have to deal with for C++.
    - cromwellian 13y ago
      In theory the same applies to Java, if I have a java_library, and none of the inputs have changed, I shouldn't have to rebuild anything. But the theory often doesn't match up to the reality with respect to objfs caching of dependencies in my experience. Also, any non-trivial app at Google is going to touch non-Go dependencies.
- sltkr 13y ago
  I like Go, but I always thought that was a ridiculous selling point. Just look at your own comment: if Googlers are picking up Go, it must have been for other reasons than build speed, considering they have a compile farm at their disposal that can build millions of lines of C++ code (before or after preprocessing, I wonder?) in mere seconds. I have a suspicion that if you ask people who used Go why they chose that language over the many other available options, almost none will say "because the compiler is fast!"

52 points by lingben 13y ago

I'm sure Ms. Meckfessel is a lovely person, but this is clearly a PR driven piece pumped out of Google for recruitment purposes. Throughout this entire NSA scandal people lament there's nothing we can do, but these tech companies are vulnerable to talent shortages. A simple action for a conscientious hacker is to simply not work for PRISM collaborators. Apply your talents to companies willing to make privacy assurances.

rryan 13y ago
> PRISM collaborators You mean companies that comply with US law? So your advice is to work outside of the US?
- EthanHeilman 13y ago
  >You mean companies that comply with US law? So your advice is to work outside of the US? 1. Or work in areas which do not handle data that the US requires by law. You can find software jobs in the US that do not require collaboration with governmental domestic spying. For instance many people choose not to work for companies that build weapons of war for a variety of reasons. These people can still work inside the US. 2. Additionally non-US residents work for Google. Being outside the US doesn't really have much relevance to the discuss. 3. I also reject the notion that Google had no choice. Google may have been able to comply with the letter of the law without giving up user data by using e2e cryptography. One can support or question their actions, but they are not powerless victims in this drama but active agents that can be held responsible for what they do.
  - fpgeek 13y ago
    > Google may have been able to comply with the letter of the law without giving up user data by using e2e cryptography. Only at the cost of not providing the service that users want, which includes such things as fast, full-text email search, recovering accounts after passwords (and other security tokens, if any) have been lost. Once Google can extract the unencrypted email for any purpose, the practical consequences of their legal obligations make all cryptography Google provides useless against this sort of attack. Yes, Google has a choice. But let's be clear on what that choice is: They can choose whether or not to offer a mass-market email service. Once they've decided to offer that service, the practical consequences are inevitable, given the current, relevant legal framework.
    - EthanHeilman 13y ago
      I don't think you or I, or even Google knows the total set of their options, but we can sit here and come up with some alternatives. >Only at the cost of not providing the service that users want, which includes such things as fast, full-text email search, e2e encryption is completely compatible with fast, full-text email search. There are several companies that currently offer such services, that is webbased, fast searchable email, that is e2e encrypted such that no plaintext arrives on the server side (unfortunately I am under an NDA or I would tell you more but you can read the papers if you like). Stuff like this: http://www.forbes.com/sites/andygreenberg/2011/12/19/an-mit-magic-trick-computing-on-encrypted-databases-without-ever-decrypting-them/ http://www.forbes.com/sites/andygreenberg/2011/12/19/an-mit-... It's not just databases it's search engines as well. I think gmail probably loses some enterprise clients because they don't do this, but I expect "enterprise level" features like this from gmail in ~2-3 years by my guess. Probably sooner due to the nosedive in trust they just took. Google has a monopoly on new email account creation so they don't need to innovate to get new customers (hell android locks everyone in). It isn't outlandish to suggest that they could have chosen to innovate and done what has been in the research literature for some time now. Secure e2e encrypted cloud email. >recovering accounts after passwords (and other security tokens, if any) have been lost. Have you tried to get gmail accounts back because I know people that have lost all their email. Are they better at this now (maybe they are, I hope so)? Even with this as a requirement, it is achievable. The user's client just sends a copy of the key to a foreign key escrow service that will unlock their account if anything happens once they prove they are who they say they are with various forms of ID and proofs of knowledge. Paranoid users can elect not to do this. Or ask people in your circles that you have marked as trusted to attest to your identity. You could do some clever threshold cryptography with your closest family and friends. They big trick is making money off ads while not learning about the contents of the email. One way could be a bounded leakage strategy whereby the encryption scheme allows some ad matches without giving up more than one or two popular words per email. All of this is a sideshow though. The NSA wasn't going to throw the Google execs in jail for not towing the line. Google is an extremely powerful company with a strong lobby in Washington. Not to mention that just pressing the charges would be a major embarrassment for the NSA. Twitter fought and won. Likely they just offered Google some nice contracts with the US government.
- tippytop 13y ago
  There is something these companies allowed that went beyond others, Twitter is not listed for example. As Snowden pointed out [1], these companies need to make some kind of technical assurances for privacy, otherwise customers (and potential employees) should look elsewhere. [1] "The [telcom] companies should write enforceable clauses into their terms, guaranteeing their clients that they are not being spied on. And they should include technical guarantees. If you could move even a single company to do such a thing, it would improve the security of global communications. And when this appears to not be feasible, you should consider starting one such company yourself."
- fpgeek 13y ago
  > You mean companies that comply with US law? So your advice is to work outside of the US? What makes you think you don't have to comply with US law if you work outside of the US? If you're a US citizen living and working abroad, it will quickly become painfully clear exactly how much work you have to do to comply with US law (and how severe the penalties are if you don't). And US citizen or not, you might be surprised at how many non-US companies elect to comply with various aspects of US law for business reasons.
infrec 13y ago
What do you mean by PRISM collaborators? I am genuinely curious because I feel like I missed when/where that was established. To my understanding, and please correct me if I am wrong, PRISM isn't a system that companies subscribe to, but more of a government portal for requesting information from a number of companies in a legal fashion. Is this not correct? I admit I have not kept up with all of the bits of information released due to the high volume of speculations generated by just about everyone that talks about it.
- EthanHeilman 13y ago
  We still don't really know what PRISM is or how it functions. It does appear that US companies did provide overly broad information to the US government using the following logic. 1. The US government gets massive amounts of information from these companies and can get this information in real time with no oversight, 2. none of these companies seem upset about it, which one imagines they would be if the US government was just stealing it without their permission, 3. and these companies have cooperated with the governments misinformation campaign (denials of "direct access" and such). If they aren't responsible for initially giving them access, they are now responsible the governments continuing access since they have learned that the government does have access and they have not attempted to prevent the government from maintaining access and furthermore they have aided the government ability to maintain access by stifling public outcry about this access by lying to their users.
  - infrec 13y ago
    Your reasoning is not very convincing. Point one is pretty much the entire question so claiming it as proof seems circular. If you have evidence proving that claim I would be satisfied. Point two is simply wrong as there was a lot of writing from CEO's and engineers that seemed quite upset about the claims. And for point three, uh... what? How are their denials proven to be lies? Or are you implying that companies using the phrase "direct access" is proof? Honestly your post, combined with a lot of others' on this site, would seem to belong quite nicely in /r/circlejerk. I'm not saying that as an insult but rather how all of these speculations kept alive through echo genuinely come off as. If you have actual proof please provide a better reasoned argument.
codex 13y ago
Given the secrecy surrounding PRISM, is there any way to know whether a company has been recently forced to comply with a PRISM-like program? Snowden's data is already stale, and only covered the largest companies.
jimzvz 13y ago
>...this is clearly a PR driven piece pumped out of Google for recruitment purposes. Agreed, can someone point me in the direction of some tech writers that aren't afraid of journalism?

weareconvo 13y ago

The chick in charge of the Internal Tools team? That shit is widely regarded within Google as a dead-end ghetto, devoid of opportunities for promotion and looked down on by the other focus areas. - 5+ year Ex-Googler EDIT: I'm done with this fucking site. You won't have weareconvo to kick around anymore.

circuiter 13y ago
Relax and hang around. Those complaining are most likely poseur male-feminists. They might as well protest in 'chick-lit' sections of bookstores.
SeanDav 13y ago
This is a spiteful and misogynistic comment - you do yourself and this community, a large disservice.
- weareconvo 13y ago
  No, it's not. It's the truth.
  - pasbesoin 13y ago
    "chick" I don't have to go past that word, to have a problem with your comment in this context.
    - weareconvo 13y ago
      Maybe you should be more open-minded then.
  - crazygringo 13y ago
    I'm only responding to this because your comment is #1 on the page right now. The factuality of your comment has nothing to do with it. Calling her a "chick" is like calling Larry Page a "boy toy" -- the word is used largely in sexual situations ("picking up chicks"), and is incredibly unprofessional and demeaning in a professional context like the workplace, or Hacker News. And talking about the Internal Tools team as "that shit" is equally unprofessional and demeaning to everyone who works on it. You should be ashamed of yourself.

WestCoastJustin 13y ago

The Wired article talks about internal tools used to compile code. In line with that, there is an interesting video "Building Software at Google Scale" [1], which seems to give an overview of the systems used. [1] http://www.youtube.com/watch?v=2qv3fcXW1mg http://www.youtube.com/watch?v=2qv3fcXW1mg

dnautics 13y ago

really, a story about a prominent female engineer, and the first paragraph is about how she dresses? I'm hardly a feminist, but this is kind of rediculous.

mseebach 13y ago
In context, it's actually pretty relevant. The anecdote, like the piece itself, is about how she deals with being a woman in a very male dominated world. Dress is one of the most direct and tangible differences between men and women.
- dnautics 13y ago
  I'd disagree. But even if it is the "most direct", whatever that means, you don't think that there are more serious gender-assumption transgressions in the tech world? It's a little annoying to me that the first anecdote is the most superficial one. I give the writer a pass, if Melody herself insists that that's the most important issue, or if that was, chronologically the first thing that Melody brought up.
sltkr 13y ago
It's not so much a story about an engineer who happens to be female, as it is a story about female engineers, the gender gap, and general lack of diversity in engineering. Considering dress is one of the most important gender expressions in our society, why shouldn't it be mentioned in an article about gender differences? By the way, if I were Melody Meckfessel, I'd be more concerned that the WIRED editors managed to misspell my name twice in one article.

voidlogic 13y ago

>The other key thing, according to Meckfessel, is that the system compiles code with unusual speed. In typical Google fashion, it spreads compilation tasks across vast array of servers, rather than generating the executable software on the developer’s local workstation. I hope she has more than this to focus on as Go usage is picking up within Google. And with Go, just the local workstation can do it. :)

cromwellian 13y ago
That's only because the amount of Go code is small. Google builds all transitive dependencies from source in HEAD, so if there were 10 million lines of Go sitting in the repository, your local workstation won't cut it. It's not even the build times which are the most pressing issue these days, but the time for tests to run.
- nostrademons 13y ago
  One of the major design goals for Go was that incremental compiles should not require a rebuild of all dependencies. I believe they bake interface information into the library files for this reason. If you don't change a file, you shouldn't need to rebuild it. If you sync to a later CL, you might need to rebuild what's changed, but even then all this should be cacheable across the company. Go was designed as a language to avoid a lot of the mess that the build tools have to deal with for C++.
  - cromwellian 13y ago
    In theory the same applies to Java, if I have a java_library, and none of the inputs have changed, I shouldn't have to rebuild anything. But the theory often doesn't match up to the reality with respect to objfs caching of dependencies in my experience. Also, any non-trivial app at Google is going to touch non-Go dependencies.
sltkr 13y ago
I like Go, but I always thought that was a ridiculous selling point. Just look at your own comment: if Googlers are picking up Go, it must have been for other reasons than build speed, considering they have a compile farm at their disposal that can build millions of lines of C++ code (before or after preprocessing, I wonder?) in mere seconds. I have a suspicion that if you ask people who used Go why they chose that language over the many other available options, almost none will say "because the compiler is fast!"