Beta Channel Update for ChromeOS / ChromeOS Flex

Hello All,

The Beta channel has been updated to ChromeOS version 15823.23.0 with Chrome Browser version 124.0.6367.34 for most ChromeOS devices.

If you find new issues, please let us know one of the following ways:

Interested in switching channels? Find out how.


Google ChromeOS.

Chrome Beta for Android Update

Hi everyone! We've just released Chrome Beta 124 (124.0.6367.37) for Android. It's now available on Google Play.

You can see a partial list of the changes in the Git log. For details on new features, check out the Chromium blog, and for details on web platform updates, check here.

If you find a new issue, please let us know by filing a bug.

Erhu Akpobaro
Google Chrome

Chrome for Android Update

 Hello, Everyone! We've just released Chrome 123 (123.0.6312.118) for Android: it'll become available on Google Play over the next few days.

This release includes stability and performance improvements. You can see a full list of the changes in the Git log. If you find a new issue, please let us know by filing a bug.


Android releases contain the same security fixes as their corresponding Desktop (Windows & Mac:123.0.6312.122/123/124;  Linux: 123.0.6312.122) unless otherwise noted.


Krishna Govind
Google Chrome

Changes to displaying the “deprovisioned” status for Google Meet hardware devices

What’s changing 

Back in 2021, we introduced the “enrollment privilege”, which restricts who in your organization can enroll or re-enroll Google Meet hardware devices. Prior to introducing this privilege, Admins had to put devices in a “deprovisioned” state to prevent end users from re-enrolling devices until they were moved to a “pending” state. 



Since the enrollment privilege makes those labels obsolete, we are removing the “deprovisioned” state from the Admin console. You’ll no longer see devices in this state from the device status page (Devices > Google Meet Hardware > Devices), nor will you be able to filter for those labels.


Getting started

  • Admins: 
    • Visit the Help Center to learn more about enrolling and re-enrolling  Google Meet hardware devices into your organization, as well as licensing FAQs.
    • To prevent unauthorized users from re-enrolling devices, opt in to Enrollment Privilege Enforcement: Menu > Google Meet hardware > Settings > Service Settings and toggle ‘Require enrollment privilege’ to ON.
  • End users: There is no end user impact or action required.

Rollout pace

  • Available now.

Availability


The FCC’s "Broadband Consumer Labels” put customers in control, and that’s a good thing for ISPs

We’re living in the age of broadband internet — internet service providers (ISPs) are announcing major infrastructure investments, committing to fund significant network upgrades and building new high speed service in communities across the country. At the same time, the federal government is also investing unprecedented amounts to support the deployment of broadband in underserved areas. Given the ubiquity of the internet in our daily lives, these efforts are both long overdue and not enough to give customers what they really need from their ISP — yes, fast, reliable internet, but also a redefined customer experience that is both easy to navigate and to understand.


As part of its effort to improve broadband service nationwide — not just in terms of speed but also in terms of customer experience — the federal government is requiring all ISPs to provide broadband “nutrition labels” on their websites when purchasing service. The point of these labels is similar to the nutrition label on a cereal box (or any other food). They are designed to help consumers make clear comparisons between broadband plans based on key factors such as price and speed and to help them understand what they get for their money. 


This type of transparency is a part of Google Fiber’s origin story. Google was built on the idea that information is powerful. And finding the information you need when you need it can change the game. In fact, doing this made the internet navigable — a digital world where information was readily and easily accessible to anyone online. Historically, easy and transparent are not words that many people would associate with ISPs, and that has to change. Nutrition labels are a start in the right direction for our industry.


Choice, and even more importantly, understanding that choice, benefits customers. Informed customers are happier customers. Since the very beginning, ISPs have played confusing games when it comes to price and speed. From that mysterious 13-month price bump to incurring extra fees for everything from equipment to data usage, it can be impossible to know what you are actually getting for your monthly payment (or even what that monthly payment will be). 

 

That’s why GFiber has been fully supportive of the FCC’s broadband labels from the very beginning, and why we launched them early last October — six months ahead of this month’s deadline. These labels empower the consumer and set up a strong foundation for what will hopefully be an extremely long term & satisfying relationship for customers. 


Thumbnail

And that’s a big change. As an industry, when it comes to customer trust and satisfaction, we’re only beating gas stations. We have a lot of work to do. Internet access isn’t a luxury — it’s a basic need in a world where more and more of our lives are online. Helping customers understand what they are paying for, not only in terms of speed, but also the additional information on the broadband label, like additional charges for equipment rentals, installation fees and/or data caps, has the potential to change the ISP industry’s behavior radically. (Note: GFiber does not have these types of additional fees.) GFiber aspires to be a big part of that change — it’s what we’ve been working towards for the last twelve years and what we bring more places as we grow.  


The FCC’s broadband labels put all the information out there, giving customers control so they can make the decision that works best for their households. Everything is on the table, so there’s nowhere for disingenuous tactics to hide. 


As a country, we’re making a huge investment in our internet infrastructure. Initiatives like this one will help make sure that customers are getting a return on that investment, improving the overall customer experience and ensuring more transparency across the industry. And that’s a very, very good thing for all of us. 


Posted by Dinni Jain, CEO


Stable Channel Update for Desktop

The Stable channel has been updated to 123.0.6312.122/.123 for Windows 123.0.6312.122/.123/.124 for Mac and 123.0.6312.122 to Linux which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log


Security Fixes and Rewards

Note: Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven’t yet fixed.

This update includes 3 security fixes. Below, we highlight fixes that were contributed by external researchers. Please see the Chrome Security Page for more information.


[$21000][331237485] High CVE-2024-3157: Out of bounds write in Compositing. Reported by DarkNavy on 2024-03-26

[$10000][328859176] High CVE-2024-3516: Heap buffer overflow in ANGLE. Reported by Bao (zx) Pham and Toan (suto) Pham of Qrious Secure on 2024-03-09

[$10000][331123811] High CVE-2024-3515: Use after free in Dawn. Reported by wgslfuzz on 2024-03-25


We would also like to thank all security researchers that worked with us during the development cycle to prevent security bugs from ever reaching the stable channel.


Interested in switching release channels? Find out how here. If you find a new issue, please let us know by filing a bug. The community help forum is also a great place to reach out for help or learn about common issues.




Srinivas Sista
Google Chrome

Google Season of Docs announces participating organizations for 2024

Google Season of Docs provides support for open source projects to improve their documentation and gives professional technical writers an opportunity to gain experience in open source. Together we improve developer experience through better documentation, increase our understanding of best practices in open source documentation, and raise the profile of technical writers in open source.

For 2024, Google Season of Docs is pleased to announce that eleven organizations will be participating in the program! The list of participating organizations can be viewed on the website.

The project development phase now begins. Organizations and the technical writers they hire will work on their documentation projects from now until November 22nd. For organizations still looking to hire a technical writer, the hiring deadline is May 22nd.


How do I take part in Google Season of Docs as a technical writer?

Start by reading the technical writer guide and FAQs which give information about eligibility and choosing a project. Next, technical writers interested in working with accepted open source organizations can share their contact information via the Season of Docs GitHub repository; or they may submit a statement of interest directly to the organizations. We recommend technical writers reach out to organizations before submitting a statement of interest to discuss the project they’ll be working on and gain a better understanding of the organization. Technical writers do not need to submit a formal application through Google Season of Docs, so reach out to the organizations as soon as possible!


Will technical writers be paid while working with organizations accepted into Google Season of Docs?

Yes. Participating organizations will transfer funds directly to the technical writer via OpenCollective. Technical writers should review the organization's proposed project budgets and discuss their compensation and payment schedule with the organization before hiring. Check out our technical writer payment process guide for more details.


General Timeline

May 22, 2024

Technical writer hiring deadline

June 5, 2024

Organization administrators start reporting on their project status via monthly evaluations

December 10, 2024

Final date for Organization administrators submit their case study and final project evaluation

December 13, 2024

Google publishes the 2024 Season of Docs case studies and aggregate project data

May 1, 2025

Organizations begin to participate in post-program followup surveys

See the full timeline for details.


Care to join us?

Explore the Google Season of Docs website at g.co/seasonofdocs to learn more about the program. Use our logo and other promotional resources to spread the word. Review the timeline, check out the FAQ, and reach out to organizations now!

If you have any questions about the program, please email us at [email protected].

By Erin McKean, Google Open Source Programs Office

Achieving privacy compliance with your CI/CD: A guide for compliance teams

Posted by Fergus Hurley – Co-Founder & GM, Checks, and Evan Otero – Product Manager, Checks

In the fast-paced world of software development, Continuous Integration and Continuous Deployment (CI/CD) have become cornerstones, enabling teams to deliver high-quality software faster than ever. However, the rise of rapid innovation, increasing use of third-party libraries, and AI-generated code have accelerated vulnerabilities and risks. Therefore, addressing these issues early in the development lifecycle is essential so that teams can launch their products quickly and confidently.

The introduction of Checks privacy compliance CI/CD tooling feature represents a significant stride towards addressing these concerns, by reducing manual intervention and automating compliance and privacy standards as part of a release cycle.

In this post, we explore the meaning of CI/CD for compliance team members unfamiliar with this technology and how Checks can weave privacy and compliance protection practices into that pipeline.


What is CI/CD?

Continuous Integration (CI) and Continuous Deployment (CD) are foundational practices in modern software development. They enable development teams to increase efficiency, improve quality, and accelerate delivery.

Continuous Integration (CI) automatically integrates code changes from multiple contributors into a software project. This practice enables teams to detect problems early by running automated tests on each change before it is merged into the main branch.

Graphic showing CI/CD continuous cycle

Continuous Deployment (CD) takes automation further by automatically deploying all code changes to a testing or production environment after the build stage. This means that, in addition to automated testing, automated release processes ensure that new changes are accessible to users as quickly as possible.


Shifting issue-spotting left with CI/CD pipelines

The automation of CI/CD processes is typically called “pipelines.” CI/CD pipelines automate the steps software changes go through, from development to deployment. These steps include compiling code, running tests (unit tests, integration tests, etc.), security scans, and more. If all automated tests pass, the changes go live without human intervention in a specific environment, such as testing or production.

These pipelines are designed to catch issues as early as possible, embodying the practice known as “shifting left.” The benefits of “shifting left”, particularly when applied through CI/CD pipelines, include:

  • Improved quality and security: Automated testing in CI/CD pipelines ensures that code is rigorously tested for functional and compliance issues before it reaches production. This early detection enables teams to address vulnerabilities and errors when they are generally easier and less costly to fix.
  • Faster release cycles: By catching and addressing issues early, teams avoid the bottlenecks associated with late-stage discovery of problems. This efficiency reduces the time from development to deployment, enabling faster release cycles and more responsive delivery of features and fixes.
  • Reduced costs: Detecting issues later in the development process can be significantly more expensive to resolve, especially if they're found after deployment. Early detection through CI/CD pipelines minimizes these costs by preventing complex rollbacks and the need for emergency fixes in production environments.
  • Increased reliability and trust: Software that undergoes thorough testing before release is generally more reliable and secure. This reliability builds trust among users and stakeholders, crucial for maintaining a positive reputation and ensuring user satisfaction.

Checks brings privacy and compliance tests to your CI/CD

TChecks CI/CD tooling seamlessly integrates app compliance scanning into CI/CD pipelines via plugins for GitHub, Jenkins, and FastLane. You can also use Checks in any other CI/CD system that supports custom scripts, such as GitLab, TeamCity, Bitbucket, and more.

image showing logos of CI/CD systems that support custom scripts - FastLane, Jenkins, GitHub, Atlassian BitBucket, GitLab, Azure DevOps, and Team City

When Checks scans an app, the binary undergoes dynamic and static analysis to understand your data collection and sharing practices, including app dependencies such as SDKs, permissions, and endpoints. This data is then tested against global regulatory requirements, store policies, your custom Checks policies, and your privacy policy to find potential issues and opportunities for improvement.


Top 5 benefits of integrating Checks into your CI/CD

image showing checks report highlighting potential issues

By adding Checks as a step in your CI/CD pipeline, you can automate app and code compliance scanning as part of the development lifecycle.

The top 5 benefits of integrating Checks in your CI/CD are:

  1. Real-time, intelligent alerting: You can stay informed of new compliance issues or changes in data behavior across your product portfolio with instant notifications via email or Slack. 
  2. Understand data sharing & SDKs: Checks can help ensure secure third-party data sharing by gaining visibility into SDK integrations, permissions, and data flow analysis. By using Checks, you can be confident in your third-party dependencies before your public release. 
  3. Ensure new builds follow your company policies: Checks enables you to automate data governance with custom policies that let you set up safeguards against specific endpoints, SDKs, data types, and permissions, tailoring privacy to your specific needs. These policies help ensure all new releases comply with your company’s data policies. 
  4. Keep your Google Play Data safety section up-to-date: Checks can recommend Google Play Data safety section disclosures and alert you if you should make an update before releasing publicly, ensuring your declarations are always up-to-date. 
  5. Deploy quickly and with confidence: When Checks finds issues in the CI/CD, these vulnerabilities are caught and remedied early, significantly reducing the risk of compliance violations once you deploy the app. Checks helps you maintain high compliance standards without slowing down the release cycle, enabling teams to deploy with confidence and ensuring that user data is protected from the outset.

Next steps

Getting started is simple. Start by first signing up for Checks and then adding Checks to your CI/CD pipelines with these simple configuration steps. Once configured, Checks is ready to perform a variety of privacy and compliance verifications.

This proactive approach to privacy and compliance safeguards against potential risks and aligns with regulatory compliance requirements, making it an invaluable asset for any compliance and development team.