#BazelCon 2021 Wrap Up

Posted by Joe Hicks, Product Manager, Core Developer

The apps, platforms, and systems that the Bazel community builds with Bazel touch the lives of people around the world in ways we couldn’t have imagined. Through BazelCon, we aim to connect Bazel enthusiasts, the Bazel team, maintainers, contributors, users, and friends in an inclusive and welcoming environment. At BazelCon, the community demonstrates the global user impact of the community—with some quirky and carefully crafted talks, a readout on the State-of-Bazel, an upfront discussion on “Implicit Bias Mitigation,” and community sharing events that remind us that we are not alone in our efforts to build a better world, one line of code at a time.

At BazelCon, the community shared over 24 technical sessions with the 1400+ registrants, which you can watch here at your own pace. Make sure you check out:

Attendees were able to interact with the community and engage with the Bazel team through a series of “Birds of a Feather” (BoF) sessions and a live Q&A session. You can find all of the BoF presentations and notes here.

As announced, soon we will be releasing Bazel 5.0, the updated version of our next generation, multi-language, multi-platform build functionality that includes a new external dependency system, called bzlmod, for you to try out.

We’d like to thank everyone who helped make BazelCon a success: presenters, organizers, Google Developer Studios, contributors, and attendees. If you have any questions about BazelCon, you can reach out to [email protected].

We hope that you enjoyed #BazelCon and "Building Better with Bazel".

How a creator’s natural hair journey built community

Google for Creators recently launched The Conversation, a new YouTube series spotlighting the experiences of women of color creators. This month, we’re featuring beauty and lifestyle creator Tyla-Lauren Gilmore, who shared how her natural hair journey led her to build an online community and become a full-time content creator. Learn more about Tyla-Lauren below and check out the full interview.

In 2014, Tyla-Lauren Gilmore graduated college and began to earn a living on her own. She was also trying to find herself, and started thinking about what kind of image she presented to the world. As she looked in the mirror, she wondered why, as a woman of color, she was straightening her natural curls — a process that, over many years, left her hair dry and damaged.

“A college friend told me, ‘Ty, people pay for your curly hair. You should embrace it,’” the native New Yorker says. “Not many of my friends had curly hair, so it was up to me. I was in search of community.”

Tyla-Lauren took to social media to find other women who looked like her. After following a few beauty bloggers on YouTube and Instagram, she began documenting her own natural hair journey. “I was figuring out what to do with my big afro,” she says. “I started posting my natural hair care tips and tricks onInstagram.” Almost immediately, other women took notice, and her online following grew.

Tyla-Lauren knew she’d tapped into something special when a widowed dad reached out for advice. “A father [messaged] me saying, ‘Hey, I just lost my wife, and I have no idea how to do my daughter’s hair,’” she recalls. “I gave him step-by-step processes of how to do his daughter’s hair. And he was so grateful. From then on, I knew this was something I wanted to do.”

She continued to grow her web presence over the next few years, including starting aYouTube channel. In 2018, she quit her 9-to-5 job at a beauty products company to become a full-time digital content creator.

Tyla-Lauren’s YouTube homepage features a hero video on her new curly hair routine, along with five other hairstyling videos.

Tyla-Lauren Gilmore’s YouTube channel features dozens of videos and has almost 10,000 subscribers.

Now, Tyla-Lauren has more than 150,000 followers across her social media channels, creating a supportive space for women to connect and share their experiences. She posts on beauty and fashion, lifestyle, cooking, parenting, travel and self-care. She aims to create authentic content that people can relate to. “I love helping people, especially younger girls looking for a role model,” she says. She has also developed business partnerships with major brands across different industries, with herTyLauren website serving as the home base for her growing portfolio.

Tyla-Lauren smiles as she sits at a wooden table with a hot drink and phone in front of her. She wears her hair long, in curls, with a beige coat and black shirt.

Tyla-Lauren Gilmore started posting about her natural hair journey on social media; today, she’s a full-time content creator.

For Tyla-Lauren, helping other women and girls on their own self-discovery journeys makes the hard work of being a full-time content creator well worth the effort. She offers two pieces of advice to other women considering becoming creators themselves.

Know your self-worth

Tyla-Lauren recalls the first $50 she received for creating original content. “At first, I viewed it as extra gas money for my commute into the city,” she remembers. But when she left her corporate job, Tyla-Lauren had to get savvy about how to survive and thrive as a solopreneur. She recommends researching the content creation space you’re in to learn more about what brands will pay for product reviews, content sponsorship and other types of business deals. “You may be super appreciative to [work with brands], but it’s not about working for free,” she notes. “Brands have money, and you are a contractor who is doing a job for them. I want all young creators to know this: Take pride in your work and know your self-worth. Be savage! Never sell yourself short!”

Be relatable… and vulnerable

So many social media influencers, including celebrities, curate seemingly flawless images online. Tyla-Lauren strives to create a welcoming community for all women and girls, inviting them to share their day-to-day life experiences. “I’m a creator, but I’m also a human being,” she says. “I want to erase that [ideal] that everything is perfect and all flowy dresses and vacations. That’s not what being a creator is about. I talk to people about normal stuff like laundry and grocery shopping and things that we all go through.” Her posts on mental health and self-care, including her own experiences in therapy, have been very popular with her followers. “These posts get a huge response,” she says. “People connect with you. Everyone’s story matters. We’re all human.”

Tyla-Lauren stands on a deck outside with a checkered flannel shirt. A mountain and trees with changing color leaves are in the background.

Tyla-Lauren wants her readers to be vulnerable and know their worth.

Want to hear more? Check out the full video interview with Tyla-Lauren on The Conversation.

Winter is coming: 9 ways to enjoy it with Google

As a native Oregonian, I thought living in California would be an incredible break from the nine months of rain I’d endured growing up. What I didn’t realize was that 70-degree winters felt…wrong. Where were the mittens? The down jackets? The occasional snowy days? I’ve since moved back to the Pacific Northwest, and I’ve had a renewed appreciation for winter weather.

In fact, I enjoy the chilly months of the year so much, I’ve put together a few ways to make the most of the cold weather.

  1. I love snowshoeing, and I always want to find new trails. I use Google Maps to look for mountain biking and hiking trails that are covered in snow in the winter. (Just look for the hiking icons, or the light dash lines that indicate trails.) If I come across a good one, I label it on Maps so I know how to get back.
Animated GIF showing trails on Google Maps and how you can select and label them; this one is being saved to a list called “trails.”

2. I’m a year-round runner, but once the temperature dips below 50 Fahrenheit and the roads get wet or icy, I need new gear — all of which I can find in one place using Google Shopping. You can select the Sports & Outdoors tab to browse — and turn on the deals filter for discounts.

3. And when I’m returning from a chilly run, I can use the Google Home app to turn on my Nest Thermostat before I get home, so I know I’m not wasting energy while I’m out and the house will be toasty when I come in. I also use Home & Away Routines so that Nest knows when I’m out and can adjust my temperature automatically.

4. OK fine, there’s one downside of winter weather, and that’s how early it gets dark. I use Google Assistant to notify me an hour before sunset so I can get outside for some sunshine before the sun goes down.

5. We’ve started cutting down our own Christmas tree, which is actually pretty easy to do. A quick Google Search for cutting down a tree on federal land will help you find a map (and how you can purchase a permit). Then you can just use Google Maps to take you to the right area.

6. If I’m feeling really adventurous and ready to hit the slopes, I’ll check out the Explore tool on google.com/travel. I can set my home as the point of origin and then select “skiing” under the Interests filter and see what ski towns I can visit.

Animated GIF showing the United States on Google Maps. The arrow selects the “interests” tab and then “skiing” to surface ski towns in different parts of the country.

7. I love a good Google Alert to stay up to date on what’s going on locally. Once November rolls around, I set one for “Oregon winter festivals.”

8. Pixel cameras take incredible photos in dimly lit areas, so using Night Sight for shots of light displays or snowy nights is a no-brainer. And if you’ve already snagged a Pixel 6 or Pixel 6 Pro, those photos will look even better: The new Pixel camera lets in 2.5 times as much light as the Pixel 5, and you can try out the new Motion Mode setting to capture an artsy falling snow pic.

Read Article

Take holiday photos with Night Sight in Portrait Mode

Take beautiful holiday photos with this new feature for Pixel 4a 5G and Pixel 5.

Read Article

9. Most winter nights, I make a real fire — but when I don’t feel like hauling in wood, there’s always a YouTube version, complete with crackle.

#BazelCon 2021 Wrap Up


The apps, platforms, and systems that the Bazel community builds with Bazel touch the lives of people around the world in ways we couldn’t have imagined. Through BazelCon, we aim to connect Bazel enthusiasts, the Bazel team, maintainers, contributors, users, and friends in an inclusive and welcoming environment. At BazelCon, the community demonstrates the global user impact of the community—with some quirky and carefully crafted talks, a readout on the State-of-Bazel, an upfront discussion on “Implicit Bias Mitigation,” and community sharing events that remind us that we are not alone in our efforts to build a better world, one line of code at a time.


At BazelCon, the community shared over 24 technical sessions with the 1400+ registrants, which you can watch here at your own pace. Make sure you check out:
  • “Reproducible builds with Bazel” — Stories about the meaning of "hermetic" and how to achieve it in the context of builds and a meditation on the aesthetic aspects of build reproducibility.
  • “Streamlining VMware's Open Source License Compliance” — Solving the complexities of identifying and tracking open-source software (OSS) to comply with license requirements by using Bazel to create an accurate bill of materials containing OSS and third-party packages during a build.
Attendees were able to interact with the community and engage with the Bazel team through a series of “Birds of a Feather” (BoF) sessions and a live Q&A session. You can find all of the BoF presentations and notes here.

As announced, soon we will be releasing Bazel 5.0, the updated version of our next generation, multi-language, multi-platform build functionality that includes a new external dependency system, called bzlmod, for you to try out.

We’d like to thank everyone who helped make BazelCon a success: presenters, organizers, Google Developer Studios, contributors, and attendees. If you have any questions about BazelCon, you can reach out to [email protected].

We hope that you enjoyed #BazelCon and "Building Better with Bazel".


By Joe Hicks, Product Manager, Core Developer

Google turns purple for International Day of Persons with Disabilities

Over one billion people worldwide have some form of disability: that’s one in seven. Many of those disabilities are invisible, while others can affect any of us at any time in our lives.

Today, our offices in Zurich, London, Wroclaw and Munich, and the Hyperlink Bridge in Dublin that connects three Google buildings, will light up purple to celebrate International Day of People with Disabilities (IDPwD). We will also be arranging to light up a city monument in Nairobi, Kenya. This United Nations observed day is aimed at increasing public awareness, understanding, and acceptance of people with any form of disability.

With this initiative we join #PurpleLightUp, a global movement started by PurpleSpace.org that celebrates and draws attention to the economic contribution of the 386 million disabled employees around the world. Since 2017, #PurpleLightUp has been driving momentum for disability inclusion across many organisations, with initiatives that span from hosting employee events and workshops, to lighting up iconic buildings purple, from developing new workplace policies to sparking conversations about disability inclusion.

  • Interior picture of Hyperlink Bridge connecting three Google offices, Dublin. Bridge is lit up in purple and can be seen from external view points.

    The Hyperlink bridge connecting three Google buildings in Dublin

  • Building front of Google building in Europalle Zurich, highlighted in purple. On second level, white text reads #PurpleLightUp.

    Our office in Zurich

  • Kenyatta International Convention Centre, Nairobi, Kenya, lit up in purple with text around the top reading #PurpleLightUp.

    The Kenya International Convention Centre in Nairobi, Kenya

  • Building front of Google office in Munich, highlighted in purple to celebrate #PurpleLightUp

    Google's office in Munich

Google became a member of PurpleSpace earlier this year, as a result of the commitment of the many Googlers from our employee resource group the Disability Alliance in Europe, the Middle East and Africa. Working with PurpleSpace will help us further raise awareness of the unique value of the disabled community, encouraging people to be more and more inclusive.

There’s a great opportunity for us to change perceptions, to destigmatize what it means to have a disability, to allow people to see all the diverse perspectives of who we are, and to amplify the value people with disabilities bring. It takes devotion and intention, but together, we can really make a difference.

You’re invited to join us in celebrating #PurpleLightUp day this year. Find out how your organisation can get involved by visiting PurpleSpace.org.

You cannot spell Slovenia without ‘love’

What comes to mind when thinking of the beautiful country of Slovenia? Its fresh air, clean water, amazing green landscapes, breathtaking views from the mountains and charming beaches. You cannot spell Slovenia without ‘love’ and it's for a reason. It’s sometimes referred to as a mini version of Europe as it has all the natural diversity one could dream of, making it a perfect destination for any types of tourists.

This year, to inspire people all around the world when it comes to picking their next travel destination, Google Arts & Culture partnered with the Slovenian Tourist Board and a handful of cultural partners, like the National Library of Slovenia, Beekeeping Museum Radovljica and Slovenian Alpine Association to release the project ‘Slovenian Stories’. This online exploration takes you through the country ​​in the most unexpected ways: users will meet the locals and discover the crafts of one of Europe’s most forested countries. Let’s dive in!

  • An aerial picture of trees in a forest with a bridge walkway cutting through

    Take a magnificent treetop walk in Rogla (Ski Resort in Slovenia)

  • A picture of a large lake surrounded by trees and against a backdrop of ice-capped mountains. In the middle of the lake is a small island with a few buildings on it surrounded by trees.

    Enjoy the colors of the famous lake Bled in October

  • The courtyard of a castle with a clock tower in the middle of it and ornate gold-yellow window decorations

    Stroll around in the yard of the 400-year old Gewerkenegg castle

  • An image of a bridge and groom outside surrounded by friends, one of whom is holding a Concertina

    Be invited to the marriage in the village, enjoying festivities with the bride and the groom

  • A picture of a man skiing in the snow with vintage skis and holding one large wooden pole

    Step onto the mountain slope with this elegant vintage skier, using equipment from 1950s

  • An illustration of an old King sleeping at a stone table, with his very long white beard flowing all the way down to the ground. He is against a serene blue background with yellow dots, and green patterns to signify landscape.

    Listen to to the legends of the Slovene childhood , while enjoying beautiful illustrations by Meta Wraber

  • A wall of beehive panels, all of which have been painted brightly with different illustrations of people, landscapes and symbols like hearts

    Get to know more about the unique to Slovenia art of painting beehive panels

1. The Crafts and Traditions

Have you ever wondered how to chase away winter and welcome spring? ​​Slovenes are great at that! Be a guest at one of the most recognizable carnivals in north eastern Slovenia, where impressively dressed kurents (Slovenian mythical figures) from all across the country gather to scare the winter away. Then say ‘hello’ to spring during St. Gregory’s Day, as some of the local rivers get magically decorated with little lights.

Another tradition that survived hundreds of years is the one of salt production in Sečovlje and Strunjan. These saltworks are one of the last in the Mediterranean to use the traditional medieval method of manually harvesting salt by ranking it with wooden scrapers into heaps. It’s an arduous, yet beautiful and rewarding process, yielding three different types of salt.

2. The Experiences

With its focus on natural ingredients and the great care that is given to its land and water, Slovenia is teaming with taste! Discover a potica dessert that you would find on the holiday menu of Slovenians, or stroll across the famous and the lesser known vineyards of Slovenia. People here have always had a special love for wine. The tradition is that entire families get together to pick grapes at harvest, visited also by family friends and relatives who gladly lend a helping hand in exchange for great food, great company, and some wine!

3. The Nature and Art

You can’t go any higher up in Slovenia than the top of Triglav, its highest mountain, which is one of the favorite destinations of every true Slovenian. So, we partnered with the Alpine Association to create the first 360 panoramic digitization of the top of Triglav. You will now be able to navigate your way up to the top of Triglav and admire the vistas. Are you already feeling dizzy?

Slovenia is also the land of bees and it has one of the oldest in Europe traditions of beekeeping. It is also known for a unique folk art not to be found anywhere else — decorating beehive panels, some of which date back to the 18th century!

Curious to see more? Stroll around these six Slovenian Experiences you cannot find anywhere else and immerse yourself inthe lush naturescapes of the country. Alternatively, check out g.co/travelslovenia, download the Android or iOS app or visit Google Arts & Culture. Uživajte!

Beta Channel Update for Chrome OS

The Beta channel is being updated to 97.0.4692.36 (Platform version: 14324.27.0) for most Chrome OS devices.

If you find new issues, please let us know by visiting our forum or filing a bug. Interested in switching channels Find out how. You can submit feedback using ‘Report an issue...’ in the Chrome menu (3 vertical dots in the upper right corner of the browser). 

Cole Brown,

Google Chrome OS 

Exploring Container Security: A Storage Vulnerability Deep Dive

Posted by Fabricio Voznika and Mauricio Poppe, Google Cloud 

Kubernetes Security is constantly evolving - keeping pace with enhanced functionality, usability and flexibility while also balancing the security needs of a wide and diverse set of use-cases.

Recently, the GKE Security team discovered a high severity vulnerability that allowed workloads to have access to parts of the host filesystem outside the mounted volumes boundaries. Although the vulnerability was patched back in September we thought it would be beneficial to write up a more in-depth analysis of the issue to share with the community.

We assessed the impact of the vulnerability as described in vulnerability management in open-source Kubernetes and worked closely with the GKE Storage team and the Kubernetes Security Response Committee to find a fix. In this post we’ll give some background on how the subpath storage system works, an overview of the vulnerability, the steps to find the root cause and the fix, and finally some recommendations for GKE and Anthos users.


Kubernetes Filesystems: Intro to Volume Subpath
The vulnerability, CVE-2021-25741, was caused by a race condition during the creation of a subpath bind mount inside a container, and allowed an attacker to gain unauthorized access to the underlying node filesystem and its sensitive files. We’ll describe how that system is supposed to work, and then talk about the vulnerability.

The volume subpath feature in Kubernetes enables sharing a volume in multiple containers inside a pod. For example, we could create a Pod with an InitContainer that creates directories with pre-populated data in a mounted filesystem volume. These directories can then be used by containers in the same Pod by mounting the same volume and optionally specifying a subpath field to limit what's visible inside the container.

While there are some great use cases for this feature, it’s an area that has had vulnerabilities discovered in the past. The kubelet must be extra cautious when handling user-owned subpaths because it operates with privileges in the host. One vulnerability that has been previously discovered involved the creation of a malicious workload where an InitContainer would create a symlink pointing to any location in the host. For example, the InitContainer could mount a volume in /mnt and create a symlink /mnt/attack inside the container pointing to /etc. Later in the Pod lifecycle, another container would attempt to mount the same volume with subpath attack. While preparing the volumes for the container, the kubelet would end up following the symlink to the host’s /etc instead of the container’s /etc, unknowingly exposing the host filesystem to the container. A previous fix made sure that the subpath mount location is resolved and validated to point to a location inside the base volume and that it's not changeable by the user in between the time the path was validated and when the container runtime bind mounts it. This race condition is known as time of check to time of use (TOCTOU) where the subject being validated changes after it has been validated.

These validations and others are summarized in the following container lifecycle sequence diagram.




Volume subpath validations before the container startup

A New TOCTOU Vulnerability: CVE-2021-25741
The latest vulnerability was discovered by performing a symlink attack similar to the one explained above, with the difference being that it constantly swapped the symlink with a directory in a tight loop, using the RENAME_EXCHANGE option with renameat(2). If the timing is just right, the kubelet will see the path as a directory and pass the validation check. Then the mount utility may find that the path is a symlink pointing to the host and follow it, exposing the host filesystem to the container. This is visualized in the following diagram:


The expectation and the attack outcome

The GKE Security and Storage teams worked closely to revise the fix done previously to find a solution. The previous fix takes several steps to ensure that the directory being mounted is safely opened and validated. After the file is opened and validated, the kubelet uses the magic-link path under /proc/[pid]/fd directory for all subsequent operations to ensure the file remains unchanged. However, we found out that all of the efforts were undone by the mount(8) linux utility which was dereferencing the procfs magic-link by default. Once the problem was understood, the fix involved making sure that the mount utility doesn't dereference the magic-links by using the --no-canonicalize flag in the mount command.

The fix is in

Once the problem was well understood, we fixed it inside Kubernetes and quickly released the fix to GKE and Anthos. If GKE auto-upgrade is enabled in your clusters there's no action on your part for this vulnerability, your nodes have already been patched. We strongly recommend that customers utilize auto-upgrades. Auto-upgrade gives peace of mind that your clusters are running with the latest patches.

GKE released a Google Kubernetes Engine security bulletin on this vulnerability, which detailed what customers can do to immediately remediate this issue across GKE and Anthos. We also provided guidance to customers who manually manage their node versions, ensuring that fixed releases were available in every region for our Static and Release Channels.

Moving forward
Google continues to invest heavily in the security of GKE and Kubernetes. We encourage users interested in finding vulnerabilities to participate in the Kubernetes bug bounty program and in the Google Vulnerability Rewards Program (VRP) which was recently expanded to cover GKE vulnerabilities. For the latest guidance on security issues, please follow our GKE Security Bulletins.