Monthly Archives: August 2019

Expanding bug bounties on Google Play

Posted by Adam Bacchus, Sebastian Porst, and Patrick Mutchler — Android Security & Privacy

We’re constantly looking for ways to further improve the security and privacy of our products, and the ecosystems they support. At Google, we understand the strength of open platforms and ecosystems, and that the best ideas don’t always come from within. It is for this reason that we offer a broad range of vulnerability reward programs, encouraging the community to help us improve security for everyone. Today, we’re expanding on those efforts with some big changes to Google Play Security Reward Program (GPSRP), as well as the launch of the new Developer Data Protection Reward Program (DDPRP).

Google Play Security Reward Program Scope Increases

We are increasing the scope of GPSRP to include all apps in Google Play with 100 million or more installs. These apps are now eligible for rewards, even if the app developers don’t have their own vulnerability disclosure or bug bounty program. In these scenarios, Google helps responsibly disclose identified vulnerabilities to the affected app developer. This opens the door for security researchers to help hundreds of organizations identify and fix vulnerabilities in their apps. If the developers already have their own programs, researchers can collect rewards directly from them on top of the rewards from Google. We encourage app developers to start their own vulnerability disclosure or bug bounty program to work directly with the security researcher community.

Vulnerability data from GPSRP helps Google create automated checks that scan all apps available in Google Play for similar vulnerabilities. Affected app developers are notified through the Play Console as part of the App Security Improvement (ASI) program, which provides information on the vulnerability and how to fix it. Over its lifetime, ASI has helped more than 300,000 developers fix more than 1,000,000 apps on Google Play. In 2018 alone, the program helped over 30,000 developers fix over 75,000 apps. The downstream effect means that those 75,000 vulnerable apps are not distributed to users until the issue is fixed.

To date, GPSRP has paid out over $265,000 in bounties. Recent scope and reward increases have resulted in $75,500 in rewards across July & August alone. With these changes, we anticipate even further engagement from the security research community to bolster the success of the program.

Introducing the Developer Data Protection Reward Program

Today, we are also launching the Developer Data Protection Reward Program. DDPRP is a bounty program, in collaboration with HackerOne, meant to identify and mitigate data abuse issues in Android apps, OAuth projects, and Chrome extensions. It recognizes the contributions of individuals who help report apps that are violating Google Play, Google API, or Google Chrome Web Store Extensions program policies.

The program aims to reward anyone who can provide verifiably and unambiguous evidence of data abuse, in a similar model as Google’s other vulnerability reward programs. In particular, the program aims to identify situations where user data is being used or sold unexpectedly, or repurposed in an illegitimate way without user consent. If data abuse is identified related to an app or Chrome extension, that app or extension will accordingly be removed from Google Play or Google Chrome Web Store. In the case of an app developer abusing access to Gmail restricted scopes, their API access will be removed. While no reward table or maximum reward is listed at this time, depending on impact, a single report could net as large as a $50,000 bounty.

As 2019 continues, we look forward to seeing what researchers find next. Thank you to the entire community for contributing to keeping our platforms and ecosystems safe. Happy bug hunting!

If you give a student a Chromebook

We created Chromebooks to help people, students included, achieve anything. These shareable, versatile devices connect people to the internet, to each other and to quality apps and extensions. Give a student a Chromebook and you give them endless access to information and resources. By learning to find answers to their questions, collaborate with others and work independently and effectively, students build digital skills that will help them succeed throughout school and for the rest of their lives. 

So, give a student a Chromebook and they will… 

Find answers and solve problems

Chromebook apps can help students navigate the online world with confidence while improving digital literacy and comprehension skills. These apps have recently been updated for back to school: 

  • Epic!, the world’s largest digital reading platform for kids, has a massive library of books, audiobooks, videos and quizzes to help children develop a love of reading and learning. Teachers can now log in with Google single sign-on, add students with Google Classroom and download student reports into Google Sheets.

  • CK-12 offers a free, personalized learning platform spanning K-12 math, science and more. Their customizable FlexBook® Courses foster interactivity and continuous feedback, and now include new reports showing class level insights for Google Classroom assignments. 

  • DOGO media teaches literacy, reading fluency and global awareness through current events, books and movies. They’ve also launched Spanish-language resources that integrate with Google Classroom. 

TIP: Head to the Chromebook App Hub, where you can find educator and admin preferred apps, hear from app developers directly for up-to-date information, and get real classroom inspiration from teachers. Educators interested in apps on the App Hub should connect with their IT admins who can evaluate purchasing options. 

Learn alongside peers 

Thanks to built-in accessibility features and an array of assistive apps, students with learning differences can develop new strategies. Check out these apps with recently updated features and new integrations: 

  • Capti Voice is a reading support tool. Its new Classroom integration allows teachers to accommodate different learning needs and make tests accessible to more students. 

  • Texthelp offers assistive technology for reading, writing and language learning. With a new WriQ Classroom integration, educators can view dashboards with writing metrics by class and monitor student progress.

  • Don Johnston’s curriculum, learning and evaluation tools are designed to support all types of learning styles and abilities. For tools that integrate with G Suite/Classroom and support dyslexia and dysgraphia, check out the Snap&Read and Co:Writer extensions.

  • ViewSonic’s myViewBoard is an interactive, cloud-based whiteboard teachers can use to engage students. And it now integrates with Classroom and Drive.

  • BeeLine's reading tool is a Chrome extension that improves reading fluency and reading comprehension by displaying text using a color gradient that draws the reader’s eyes from the end of one line to the beginning of the next.

TIP: Once settings on a Chromebook are customized for a student, they’re applied every time they log in on any managed Chrome OS device. Bookmark this handy guide about Google’s accessibility tools for the classroom. 

Connect and collaborate in new ways

Virtual communication and collaboration are skills that students will use throughout their lives. With Chromebooks, they can cement these skills as they collaborate with peers in apps and sites or built-in ones like Docs, Sheets and Slides. Here are a few recently-updated apps that teachers can use to engage students while fostering communication and collaboration:

  • Remind, a communication app designed to connect parents, guardians, educators and others who matter to student success, has integrated connected accounts in Classroom and Drive. 

  • Kami, a PDF and document annotation app that fosters collaboration, now integrates with the Classroom grading page. Kami assignments are categorized to support Classroom’s topics.

  • Nearpod, a platform for creating engaging lessons or using existing ones, now lets you embed and edit activities directly within Google Slides.

TIP: Different devices work for different types of students. A rugged laptop, for example, can work well for young students. Touchscreen tablets with stylus compatibility and cameras in the front and back, on the other hand, work for students conducting science experiments or creating artistic masterpieces. With different options, you can customize the outside as much as you customize the inside. 

Schools pick Chromebooks because they are versatile, affordable and easy to manage. When you give an admin a fleet of Chromebooks with the Chrome Education Upgrade, they can easily and securely deploy and manage any number of devices from one cloud-based console. And they no longer need to worry about updating devices. Chromebooks update automatically and have multi-layered security, so—like students—they continue to improve over time. Read more about why admins love Chromebooks, and explore Chromebooks built for education and a range of apps that transform them into learning devices.

Join our effort to help Americans find local job training

Pathways is part of our Grow with Google initiative to bring economic opportunity to all Americans. For job seekers looking to acquire new skills or pivot to a new career, information about relevant training programs can be difficult to find. This new feature in Search is designed to help people across America develop new skills and find local programs that prepare them for in-demand jobs in their communities. 

In the early stages, we worked with partners like the State of Virginia, the Virginia Community College System, and local employers to pilot Pathways. Here’s more about how the feature works in two communities in Virginia, and new ways for training programs to get involved when Pathways becomes available more broadly. 

Pathways in Virginia

Now in Hampton Roads and Richmond, Virginia, when people search for things like “ jobs near me” or “job training” on Google, they’re able to find jobs that are in demand in their area and discover local training programs to prepare them for those jobs. They can then easily compare program costs and outcomes and learn how to enroll. 

Pathways VA Gif

The Pathways pilot feature includes information about training programs across industries like healthcare, information technology and machining. And you can find out about occupations like nursing, medical technicians, software developers, and welding. We’re focusing on programs that can help people develop marketable skills and get into the workforce: these are full-time degree or certificate programs of up to two years in length, or longer if they include paid training, like an apprenticeship.

Expanding the impact of Pathways

How long will it take me to complete a program? How much does it cost? How much might I make when I finish, and how might that compare with another occupation? These are all questions prospective students often think about when considering a new training program, but the answers aren’t always easy to find online, making it difficult to find the right program to match their career aspirations. 

To reach the goal of making Pathways available nationwide, we’re asking organizations to structure their program data to ensure their programs can be easily discovered not only on their websites, but also on Google Search. Learn more about eligibility and how to structure your data to help Americans find a path to their next job.

My Path to Google: Goodman Lepota, Associate Account Strategist

Welcome to the 35th installment of our blog series “My Path to Google.” These are real stories from Googlers, interns, and alumni highlighting how they got to Google, what their roles are like, and even some tips on how to prepare for interviews.

Today’s post is all about Goodman Lepota. Read on!



Can you tell us a bit about yourself?
I am originally from a township in the north of Johannesburg, South Africa. I was fortunate to have spent the past five years living and studying in the United States on an academic scholarship awarded by MasterCard. I hold a Bachelor of Science in Business Administration from Marist College in New York. I am also a graduate of the African Leadership Academy.

When I am not working you can find me reading. I was a publisher of three student newspapers from high school, prep school, to college. I am still fascinated by the different forms of creativity writers employ in their storytelling.
(photo credit: Googler Zach Louw)


What’s your role at Google?
I am an Associate Account Strategist in Dublin, Ireland (Google's Europe, Middle East, and Africa headquarters) working with the Sub Saharan African Google Customer Solutions team.

I often say what we do is like getting a free MBA, because you learn so much from different people. My role includes consulting over 120 clients, focusing on digital growth for their businesses, and advertising. We have an unprecedented scope of successful business models across Africa.

My favorite part about the job is that I get to make an impact and help small and medium sized businesses grow. I work with some of the most exceptional and supportive people everyday. Everyone on our team is invested in making sure everyone else succeeds.

Complete the following: "I [choose one: code/create/design/build] for..." 
I build for a more inclusive and prosperous future.

What inspires you to come in every day?
I am excited about Google’s projects in Africa, particularly focusing on internet access such as Google Station and other internet infrastructure projects. Google is a status equalizer. It gives access to the same level of information for someone living in a rural area with less resources as it does for someone in a cosmopolitan urban area. Google creates opportunity.
 Goodman (center right) with teammates Sashin Pillay (Associate Account Strategist), José Alguem (Google Customer Solutions, Africa lead), and Kristin Ransome, (Associate Account Strategist).
(photo credit: Googler Zach Louw)
How did the recruitment process go for you?
I came across the opportunity on LinkedIn and applied directly on the Google Student Careers website. I had five interviews with Google. Although I was in the process of interviewing for other companies, Google’s hiring process was probably one of the best. Here’s why: they paired me up with a recruiter who facilitated and communicated with me as I prepared for all the interviews. The Googlers who interviewed me also influenced my decision because I felt they were invested in me succeeding during the interviews.

Can you tell us about your decision to enter the process?
I was always interested in business marketing, technology, and policy making. I was excited by the idea of taking on a challenging role after graduating from college, but even more so, I wanted to work for an organization with an amazing team. Google was that place.

What do you wish you’d known when you started the process?
There are some myths about interviewing for Google like asking you tricky and unsolvable questions, which I found to be far from reality.
(photo credit: Googler Zach Louw)

Do you have any tips you’d like to share with aspiring Googlers?
I wanted to share my advice to two kinds of students. The first one is to someone who grew up not imagining they could join Google. I can tell you now that Google will make you feel welcome.

The second one is for the students who are studying in a country that is different from their home country and looking for an amazing opportunity. Google has an exceptional team to support you in relocating in the event that you get accepted.

And I always say this to people — you always have to have that strong conviction that your dreams in life are possible.

How The Baltimore Sun is growing digital subscriptions

Editor’s note: Throughout the month of August, the GNI Subscriptions Lab hosted workshops with 10 U.S. and Canadian news publishers, including The Baltimore Sun, to explore new opportunities for digital subscriptions growth. Last week, we co-published a report with the Local Media Association (LMA) and FTI Consulting to share what we’ve learned.  

Just today, as I write this post, we at The Baltimore Sun launched a new tactic: Some non-subscribers will be prominently asked to enroll in a free newsletter before reading their first free article of the month. The test was born out of the GNI Subscriptions Lab. Here’s how we used data and collaboration to come up with the idea.

Our digital subscriptions team at Tribune Publishing is always seeking new ideas to boost subscriber relationships and digital revenue to help fund our journalism. In this pursuit, we have attended conferences, participated in webinars and devoured research papers on the topic. So, when the Google News Initiative, FTI Consulting and LMA started the GNI Subscriptions Lab earlier this year to help news publishers accelerate their approaches to digital subscriptions, we eagerly joined with one of our storied brands, The Baltimore Sun. 

Job one in the Lab was measuring the health of our digital subscriptions business. We deployed our data analysts to collect 27 months of observations across 300 variables that contribute to our subscriptions model. After compiling our insights across the entire Lab, we had over 80,000 data points to compare and contrast with our fellow participants. 

This is where the power of the Lab first emerged. We focused on 10 of the most critical performance metrics for a digital subscriptions business, such as visits per unique reader, engagement with the paywall (Meter Stop Rate) and effectiveness in monetizing subscribers (Average Revenue Per Unit). We saw which news organizations had best-in-class metrics, and heard directly from those participants about how they achieved success. 

For example, The Baltimore Sun had one of the highest paywall conversion rates in the group. My team shared how our promotional calendar for subscriptions is thoughtfully constructed; we focus our best offers at the end of each month, which is when most readers finish their monthly free-article allotments and hit our paywall. Conversely, comparing our metrics to our fellow publishers, we saw that we should work to increase the number of times each unique reader visits our site. So, we are now prioritizing desktop alerts as an immediate, peer-recommended method for growing visitor frequency. 

With this aerial view of where we’ve been and, more importantly, where we need to go next, The Baltimore Sun is focused on projects to improve soft spots in our subscriptions metrics.

We selected email capture as our first bulls-eye. We have email addresses for about two percent of our unique users, which is below the Lab's target level of five percent. After brainstorming with the group about how we could improve that metric, we developed our first experiment: a free newsletter offer for some readers before their first metered article. Our goal is to generate more email-sourced subscribers and drive greater newsletter engagement through this approach. 

In the coming weeks and months, we look forward to further collaboration among expert organizers and supportive peer-participants in the Subscriptions Lab. As our expectations rise and new challenges emerge, we must seek (or create!) cooperative environments like this to learn and thrive together as an industry.

Google Drive apps and Editor add-ons moving from Chrome Web Store to G Suite Marketplace

What’s changing

In the coming weeks, we’ll move all Google Docs, Sheets, Slides, and Forms add-ons and Google Drive apps from the Chrome Web Store to the G Suite Marketplace. See our Cloud Blog for more details on this change. If an add-on’s developer hasn’t taken action to migrate their listing, new users won’t be able to install it. We’re calling these add-ons “unmigrated add-ons.”


Who’s impacted

Admins and end users

Why it matters

Existing users of unmigrated add-ons will continue to be able to use them. However, if they uninstall Editor add-ons or Drive apps, they won’t be able to reinstall them. Moreover, if an existing user creates a template with one of these add-ons, any users who don’t already have the add-on installed won’t be able to use the add-on within the template.

How to get started


  • Admins and end users: No action is required. To check whether an add-on has been migrated, search for it in the G Suite Marketplace. 
  • Developers: Drive apps and Editor Add-ons must have a G Suite Marketplace listing prior to September 9, 2019. For more information on how to migrate your add-ons, see here for Drive developers and here for Editors developers.

Helpful links



Availability

Rollout details

  • Rapid Release domains: Extended rollout (potentially longer than 15 days for feature visibility) starting on August 28, 2019
  • Scheduled Release domains: Extended rollout (potentially longer than 15 days for feature visibility) starting on August 28, 2019

G Suite editions

  • All G Suite editions


Stay up to date with G Suite launches

Simplifying our content policies for publishers

One of our top priorities is to sustain a healthy digital advertising ecosystem, one that works for everyone: users, advertisers and publishers. On a daily basis, teams of Google engineers, policy experts, and product managers combat and stop bad actors. Just last year, we removed 734,000 publishers and app developers from our ad network and ads from nearly 28 million pages that violated our publisher policies.

But we’re not just stopping bad actors. Just as critical to our mission is the work we do every day to help good publishers in our network succeed. One consistent piece of feedback we’ve heard from our publishers is that they want us to further simplify our policies, across products, so they are easier to understand and follow. That’s why we'll be simplifying the way our content policies are presented to publishers, and standardizing content policies across our publisher products.

A simplified publisher experience
In September, we’ll update the way our publisher content policies are presented with a clear outline of the types of content where advertising is not allowed or will be restricted.

Our Google Publisher Policies will outline the types of content that are not allowed to show ads through any of our publisher products. This includes policies against illegal content, dangerous or derogatory content, and sexually explicit content, among others.

Our Google Publisher Restrictions will detail the types of content, such as alcohol or tobacco, that don’t violate policy, but that may not be appealing for all advertisers. Publishers will not receive a policy violation for trying to monetize this content, but only some advertisers and advertising products—the ones that choose this kind of content—will bid on it. As a result, Google Ads will not appear on this content and this content will receive less advertising than non-restricted content will. 

The Google Publisher Policies and Google Publisher Restrictions will apply to all publishers, regardless of the products they use—AdSense, AdMob or Ad Manager.

These changes are the next step in our ongoing efforts to make it easier for publishers to navigate our policies so their businesses can continue to thrive with the help of our publisher products.


Posted by:
Scott Spencer, Director of Sustainable Ads


Source: Inside AdSense


Simplifying our content policies for publishers

One of our top priorities is to sustain a healthy digital advertising ecosystem, one that works for everyone: users, advertisers and publishers. On a daily basis, teams of Google engineers, policy experts, and product managers combat and stop bad actors. Just last year, we removed 734,000 publishers and app developers from our ad network and ads from nearly 28 million pages that violated our publisher policies. 


But we’re not just stopping bad actors. Just as critical to our mission is the work we do every day to help good publishers in our network succeed. One consistent piece of feedback we’ve heard from our publishers is that they want us to further simplify our policies, across products, so they are easier to understand and follow. That’s why we'll be simplifying the way our content policies are presented to publishers, and standardizing content policies across our publisher products.

A simplified publisher experience

In September, we’ll update the way our publisher content policies are presented with a clear outline of the types of content where advertising is not allowed or will be restricted. 

Our Google Publisher Policies will outline the types of content that are not allowed to show ads through any of our publisher products. This includes policies against illegal content, dangerous or derogatory content, and sexually explicit content, among others. 

Our Google Publisher Restrictions will detail the types of content, such as alcohol or tobacco, that don’t violate policy, but that may not be appealing for all advertisers. Publishers will not receive a policy violation for trying to monetize this content, but only some advertisers and advertising products—the ones that choose this kind of content—will bid on it. As a result, Google Ads will not appear on this content and this content will receive less advertising than non-restricted content will.  


The Google Publisher Policies and Google Publisher Restrictions will apply to all publishers, regardless of the products they use—AdSense, AdMob or Ad Manager.


These changes are the next step in our ongoing efforts to make it easier for publishers to navigate our policies so their businesses can continue to thrive with the help of our publisher products.

Simplifying our content policies for publishers

One of our top priorities is to sustain a healthy digital advertising ecosystem, one that works for everyone: users, advertisers and publishers. On a daily basis, teams of Google engineers, policy experts, and product managers combat and stop bad actors. Just last year, we removed 734,000 publishers and app developers from our ad network and ads from nearly 28 million pages that violated our publisher policies.

But we’re not just stopping bad actors. Just as critical to our mission is the work we do every day to help good publishers in our network succeed. One consistent piece of feedback we’ve heard from our publishers is that they want us to further simplify our policies, across products, so they are easier to understand and follow. That’s why we'll be simplifying the way our content policies are presented to publishers, and standardizing content policies across our publisher products.

A simplified publisher experience

In September, we’ll update the way our publisher content policies are presented with a clear outline of the types of content where advertising is not allowed or will be restricted.

Our Google Publisher Policies will outline the types of content that are not allowed to show ads through any of our publisher products. This includes policies against illegal content, dangerous or derogatory content, and sexually explicit content, among others.

Our Google Publisher Restrictions will detail the types of content, such as alcohol or tobacco, that don’t violate policy, but that may not be appealing for all advertisers. Publishers will not receive a policy violation for trying to monetize this content, but only some advertisers and advertising products—the ones that choose this kind of content—will bid on it. As a result, Google Ads will not appear on this content and this content will receive less advertising than non-restricted content will. 

The Google Publisher Policies and Google Publisher Restrictions will apply to all publishers, regardless of the products they use—AdSense, AdMob or Ad Manager.

These changes are the next step in our ongoing efforts to make it easier for publishers to navigate our policies so their businesses can continue to thrive with the help of our publisher products.


Source: Inside AdSense


Simplifying our content policies for publishers

One of our top priorities is to sustain a healthy digital advertising ecosystem, one that works for everyone: users, advertisers and publishers. On a daily basis, teams of Google engineers, policy experts, and product managers combat and stop bad actors. Just last year, we removed 734,000 publishers and app developers from our ad network and ads from nearly 28 million pages that violated our publisher policies.

But we’re not just stopping bad actors. Just as critical to our mission is the work we do every day to help good publishers in our network succeed. One consistent piece of feedback we’ve heard from our publishers is that they want us to further simplify our policies, across products, so they are easier to understand and follow. That’s why we'll be simplifying the way our content policies are presented to publishers, and standardizing content policies across our publisher products.

A simplified publisher experience

In September, we’ll update the way our publisher content policies are presented with a clear outline of the types of content where advertising is not allowed or will be restricted.

Our Google Publisher Policies will outline the types of content that are not allowed to show ads through any of our publisher products. This includes policies against illegal content, dangerous or derogatory content, and sexually explicit content, among others.

Our Google Publisher Restrictions will detail the types of content, such as alcohol or tobacco, that don’t violate policy, but that may not be appealing for all advertisers. Publishers will not receive a policy violation for trying to monetize this content, but only some advertisers and advertising products—the ones that choose this kind of content—will bid on it. As a result, Google Ads will not appear on this content and this content will receive less advertising than non-restricted content will. 

The Google Publisher Policies and Google Publisher Restrictions will apply to all publishers, regardless of the products they use—AdSense, AdMob or Ad Manager.

These changes are the next step in our ongoing efforts to make it easier for publishers to navigate our policies so their businesses can continue to thrive with the help of our publisher products.


Source: Inside AdSense