Scammers can bypass your Google Workspace Safety Checks

A major source of headache for system administrators these days, and has been for some time, is the uptick in phishing messages that fake the sender address so it appears to be from someone within your organization. If you are like me, this is one of the things that keeps you awake at night. Organizations using Google Workspace can take advantage of a safety feature that purports to prevent this from reaching users. You can access its settings from within the admin console under Apps->Gmail->Settings->Safety.

Unfortunately, there are still a ton of legit e-mail servers that don't authenticate, so that safety feature is not going to be very helpful.  However you can enable the checks that detect someone trying to send a message with an employee's e-mail address, your domain (or a variation on it) or even an employee's name.  These are very common attacks, and such checks regularly prevent nefarious messages from reaching our end users.  

The problem is, due to a poorly-planned filter architecture on Google's part, this whole mechanism can be bypassed, allowing a spoofed message to end up in a spam queue that is managed by an end-user.  

Google Workspace Filter Architecture places spam filters and queues ahead of "safety features" such as spoof checks.

As you can see in the diagram above, the spoof checks are effectively circumvented when they are sent to a group.  A moderator will see the message in the group's spam queue, AKA "Pending messages".  If they approve the message, it will then go through the safety checks, but by then the group manager has already seen it, and may act on it.

Cordova-plugin-ble-central without BACKGROUND_LOCATION permission

Happy New Year.

I have been developing a Cordova app on Android that uses Bluetooth Low Energy (BLE).  To accomplish this, I have been using Don Coleman's cordova-plugin-ble-central.  This is a neat plugin with a pretty simple API that lets you do serial communications over BLE. It is compatible with both Android AND iOS.  It's installable with NPM, but I recommend you get it directly from his Github.  The one on NPM seems to be broken on newer Android devices.  The issue  is that Google now requires ACCESS_FINE_LOCATION permission if you are using bluetooth, and the one on NPM is older and hasn't been updated to request this permission.  But that's not really what this post is about.

My app is essentially a remote control for a light.   All I am trying to do is communicate over bluetooth when the app is in the foreground.  However, the Don Coleman plugin demands the BACKGROUND_LOCATION permission (presumably this would be required if I was trying to continue to send/receive data notifications while the app is in the background).  The problem is that this permission comes with some fairly hefty declaration requirements if you are trying to get your app into the Play Store.  For example, you have to make a video demonstrating the feature in your app that makes use of this functionality.  As I stated earlier, I have no such feature so it will be impossible for me to get my app to pass review.  

The only solution I could see was to fork Don's plugin and remove the BACKGROUND_LOCATION permission.  So far it seems to work.  If you have a similar problem, perhaps you can benefit from this version of the plugin as well.  A couple of things:

1. In case it doesn't go without saying, if your app is in the background, you will not be able to do Bluetooth communication using this version of the plugin.
2. I have only made changes to the Android side. I don't know if the iOS side still somehow requests BACKGROUND_LOCATION permission.  If it does, I will ultimately need to address that as well since my app is going to be available for both platforms.

So here it is: High Tech Harmony's cordova-plugin-ble-central without BACKGROUND_LOCATION

To use it, go to your Cordova build folder of your project and do the following:

(only if you have Don's plugin already)
cordova plugin remove cordova-plugin-ble-central 

cordova plugin add https://github.com/HighTechHarmony/cordova-plugin-ble-central

cordova clean android

cordova build android

Read this if your DJI Spark is "Hopping" (erratic behavior)

My DJI drone has had this issue with my DJI Spark where, when I try to take off, it will  sort of hover, but then "hop" up and down.  It heads toward the ground and then seems to recover.  When it is heading toward the ground, the obstacle avoidance alert is going off.

Searching the internet, I found forums littered with a gazillion about "Fly Away" issues. I do NOT consider this is a FLYAWAY issue.  It seems like there are so many issues that are blanket described as "Fly Away", and while I suppose it is possible you could lose your drone as a result of this, it is most likely just going to hit the ground straight below, worst case.  I can technically fly it around, but it is fighting me the whole time.  The obstacle avoidance alert is intermittently on and off. The drone will ascend okay, but it descends VERY slowly (which is kind of scary if you get any sort of real altitude).  Also, at random it will just start heading vertically downward even though I didn't command it to.  Again the obstacle avoidance sensor beeping when the problem is occurring. Sadly I was not able to get this anomaly on video for a better description.

This issue cropped up seemingly out of nowhere. One day it flew fine, I put it away, next season I took it out, and it flew like crap.  I could occasionally get a problem-free flight out of it, but I never had any real confidence in it.  So for the last 2 years, I have been basically not flying my DJI Spark drone, due to this weird behavior.

After months of pondering (and letting my warranty lapse), I contacted DJI.  I described the issue and they recommended I send it in  to DJI for paid repair.  On the repair estimate, it said that the drone had crashed:

"After carrying out the damage assessment, we found that the unit has physical impact damage, unfortunately the damage that is not caused by product malfunction is Non- warranty repair; We'll either repair it or replace it with a product that's new or equivalent to new in both performance and reliability after payment has been received. For more information, please visit (http://www.dji.com/service/policy) - DJI North America"

The bit about impact damage was BS. I am the only one who has ever flown this thing, and I baby it.  The most I have ever done is buzzed a wall.  It has never impacted anything.  My guess is this is what they write on anything that gets shipped to them that doesn't fall under "warranty repair".  But I had no other viable options so I told them just to go ahead.

Weeks and $150 + shipping later, I got my drone back with a slip saying they replaced the vision system.  And lo, it did fly correctly... For a few (gentle!) test flights.  Then one day I took it out to fly and it started doing the hopping thing again.  I tore my hair out, ready to scrap this noisy money pit.  One last time I refocused my Google search terms to include "hopping", and that's when I hit the jackpot.  I found a handful of postings on DJI's forum of people who seemed to have the exact same problem. While there were a ton of the usual unhelpful responses (i.e. "Get rid of it! Sell it to me!"), I saw a couple of postings saying that the issue was solved by replacing the props. At first I just wrote this off.  Why would props make any sort of difference as to how the craft would fly (other than, maybe, FLY or NOT FLY)?  Okay maybe "FLY but be LOUD"...  But this post got my attention.  after a while, I realized I had the following options:

1. Throw away drone?
2. Buy a full set of genuine DJI props, and then throw away drone after proving it makes no difference.

So I did the latter.

And it worked.

WTF?!?!?

So naturally I now have some new questions.  How the hell is this behavior really caused?  One idea I had is that excess prop vibration somehow causes the obstacle avoidance sensor to falsely trip. 

Then there is the issue of the earlier "repair".  This was obviously the problem all along. It seems that DJI was more than happy to take my money to "fix" the craft, when the only issue was the props.  Think about it, there must be thousands of people who have experienced this problem, and I'm sure DJI customer service has enough data to recognize this as being a prop issue right off.  But either they didn't, or they chose not to tell me.  I would give them the benefit of the doubt, but then they did tell me they found "crash damage".

Anyway, lesson learned.  If your unit is out of warranty, think twice before sending it in to DJI for repair.  The only guarantee appears to be that you will pay them a hefty repair fee.

Defuddling JamKazam Vol. 2: Don't believe everything you read

I feel that one of the most important things to get out of the way are the truths of many, many claims and misnomers that are floating around on social media - no doubt a common issue with very rapid adoption of a complex tool.  We'll do this Snopes.com style.  Here are some, in no particular order:

Claim: "You Can't Use WiFi with JamKazam"
Status: Partly true
Explanation:
Well, you CAN use WiFi.  But it's better if you use an ethernet cable.  For starters, the nature of WiFi is that it tends to deliver packets via different physical transmission paths, which causes them to arrive in the wrong order.  On the other side, these packets have to be queuing them into a buffer (temporary holding tank for data), and reassembled into a contiguous stream.  Then they are released for you to hear. Ethernet cables require less of this action to be required, so JamKazam uses a smaller buffer, and therefore you end up with lower latency.  Now consider that most people have total shit WiFi setups at their homes, and using WiFi becomes an even worse choice.  Bottom line is, use an ethernet cable.

Claim: "You need the best internet plan available"
Status: Very unlikely
Explanation:
JamKazam is, contrary to what seems to be a rampant believe, not very bandwidth intensive.  It is the equivalent of a video conference call.  If someone is using solid audio gear, and having problems with latency or "choppiness" (which is a very vague description), it is most likely their computer or networking gear that is at fault.  It is very likely that the computer or router is on the edge of what it can handle in terms of load.

Claim: (Windows user) "You need to download ASIO4ALL"
Status: Very unlikely
Explanation:
Your audio interface hopefully has a native ASIO driver available from the manufacturer's website. This is what you should use.  If they don't, you can try ASIO4ALL, which is a third-party, lower latency wrapper for Windows' standard (high latency) WDM drivers. In some cases it works, but in most cases it doesn't seem to work very well.  It is definitely a second choice.

Claim: "A Chromebook is a viable cheap laptop option"
Status: False
Explanation:
While a Chromebook is, in fact, a laptop, Even if the processor power was enough, it does not run Windows or MacOS, which as of this writing are the only supported operating systems.  Chromebooks run ChromeOS, so, no go. If you are looking for the cheapest machine you can buy new that still has enough power, it's probably going to be a mini desktop computer, like the Intel NUC (bring your own monitor/keyboard/mouse).

Claim: "You need USB 3 (aka USB 3.1) ports"
Status: False
Explanation:
USB 2.0 max throughput = 480 Mbps
Even if you run 192KHz @ 24 bits < 10 Mbps
The latency of USB 3 is not improved over USB 2.0.
Even if you are using a 100 Mbps USB Network Adapter, JamKazam will not come close to saturating your connection.

Claim: "You need a (quad-core Intel Core i7 or other crazy CPU) if you want JamKazam to work as well as it can."
Status: False
Explanation:
You do need a real bit of processor power.  Practically speaking, I'd say, minimum dual core Core i3. Preferably a quad core Core i5 or better.  But to be fair, the amount of peak processor power you actually need for JK varies with how you are using it.  I've actually tested it with a Core 2 Duo from 2011, and it was "enough processor power to have a jam session".  Just barely.  As you add musicians, and use features like the video stream or Jam Tracks, that is when you will exceed your processor power, and when that happens, the result is NOT pretty.  Basically it's a sea of loud sparks and crackles in yours and everyone else's headphones.

Claim: "Turn off your video, it adds latency"
Status: Partially True
Explanation:
The video can have no impact, or a lot of impact, depending on a lot of factors.  The specific claim that it adds latency seems to be a little bit of a generalization, as though latency is the only evil one experiences on JK.  In fact, what it really does is add a ton more data that JamKazam has to coordinate which, if you or anyone in the session is on the edge, will very definitely result in a variety of problems - latency being only one.  Playing with the video on is more fun, but it's best to assume it is going to be a luxury and not a guarantee.  If everyone is getting good results, then congrats and enjoy - but it seems to vary with each session and the participants.

More parts coming soon!

DeFuddling JamKazam Vol 1: What you really need

Intro

This is the first installment of a series on demystifying JamKazam for newcomers.  As previously mentioned, there are video tutorials and a pretty good forum that can help you get through the setup step-by-step. You can start with those.  There is also a Facebook Group, Subreddit, etc. where people are chatting about their JamKazam experiences.  I would stay away from those for a little while - there is some helpful info, but also a lot of misinformation. Once you are up and running, you can explore those in-depth discussions, and weigh what you read with your own experience.

Another word of warning: Unless you have a working home studio already, you are very likely going to have to spend some "real" money to get this running.  It could be $50 for a few odds and ends, or it could be around $1,000 if you just have a guitar and an internet connection.  It really depends.   If you want to jam online, listen to my advice and the things I tell you not waste time with, and forge onward my friend!

To that end,  I am here to give my perspective on some of the concepts that people seem to be missing, which help a lot.  I have been using JamKazam for many weeks now.  I have tested it on various equipment and I have assisted many musicians with getting their JK setups tweaked.  At this point pretty much every session I get into has very tolerable latency and basically no dropouts.  There are a lot of seat-of-the-pants "experts" out there who think they know what you need to have in order to make it work.  Here are some of the conclusions I have reached about what is required.

Equipment

Computer

The first thing you are going to need is a decent laptop or desktop computer running Windows or MacOS. Sorry folks - this is not going to run on your iPad, iPhone, Android, or even a netbook.  Dual core Intel Core i3 minimum.  It doesn't have to be new, but a good rule of thumb would be something made in the last 5 years.  

Ethernet Cable to Your Router/Modem

Believe it or not, this seems to be the deal breaker for a lot of JK tire kickers (I guess its a sign of how dependent we have become on WiFi). There are real reasons why using an ethernet cable will result in lower latency, and a good JK experience depends on the lowest latency possible.  Even if you are jamming fairly distant from your router, you can buy really long ethernet cables - I saw a 200' one on Amazon for around $20.  Anyway, again, we'll get into this more later, but just know that if you have to use WiFi, you may not have a good experience and end up deciding that JamKazam is not worth using.

Audio Interface

No, you can't use your computer's built-in sound for JamKazam.  An audio interface is like an advanced sound card that converts sound to/from bits that your computer can manipulate.  Even though your computer has some built-in capability already, it is not designed for the performance you need for JamKazam.  Currently, the best interface for JamKazam is the 3rd gen Focusrite Scarlett.  The "Solo" (one mic input, one instrument input) is $109 - that is, if you can get one (but of course right now they are all on backorder because everyone is buying them for online jamming).  There are certainly other audio interfaces that will work, but YMMV. We'll get into that later.

Headphones

You will want to have a good set of over-the-ear headphones.  If you are looking for a recommendation, the Audio Technica ATH-M50x is a favorite of mine. You can get by with earbuds, but if you do, I feel sorry for you. A good set of headphones can make you forget you are not in the same room together with other musicians.

Microphone

No, you can't use your computer's built-in microphone for JamKazam.  Even if you could get this to run through your proper interface (you can't), it's going to pick up all kinds of sound from your computer.  And for two, come on, that mic is going to be garbage.  A good dynamic microphone like the stalwart Shure SM-58 is probably the best option here.  In a pinch you can communicate your USB chat mic/headset, but it's going to make you sound like garbage when you are talking or singing.

Instrument DI or Microphone(s)

If you are playing guitar or bass, keys, etc., you will ideally want to use a pedal or DI box.  Having  a lot of room sound is not conducive to a good mix for you or anyone else in the session (honestly, this is the case even if you are jamming in the same room, but don't bother telling the guitarist who brings his Marshall half stack to rehearsal).   You will plug this into one of the the inputs on your audio interface. 

If you are a drummer, a popular option is to use an electronic kit.  Obviously that is not going to work for everyone.  On a real drum kit, you can use an entry level mic kit like the Samson 7-kit. These typically run about $300-$400.  You can also get by with a couple of SM-57s (see the Glyn Johns configuration). Run these into a mixer and then plug the mixer into your audio interface.

Effects (Optional)

You may wish to have some effects on your vocals or instrument(s). The best and simplest way to do this is to run an outboard effects unit before the audio interface.  Examples of this include your effect pedal chain or a rack mount processor of some sort.  Other methods, such as running effects on your computer, are technically possible but at best complicated, and at worst, induce too much additional latency and/or stealing too much CPU from JamKazam.

If you have all of the above needs met, you can move on to getting setup. In the next installment, we will discuss the concepts that make all of these specifications important.

Next Post in Series: Don't Believe Everything You Read

JamKazam: Online Jamming for Quarantined Musicians

This is month 2 of Armageddon for musicians.  If you are one, or know someone who is, you are aware that they are climbing the walls because all of their shows, rehearsals, and even jam sessions have been taken off the table since March.  Playing together online using Zoom or Meet sounds like a great idea, until you try it and find out no one can line up the rhythm due to the inherent delays.

Enter JamKazam - the service for jamming online.  Musicians sign up, login, and can jam with each other for free. And it uses a different method of delivering audio to each other, so it actually works! Sounds great, right?  Well this service has been running since 2015, and the world is just finding out about it now.  What gives?

The barrier to entry is fairly high.  Make no mistake about it, achieving success with JamKazam sessions is not for the faint of heart.  If you are expecting to download an app to your phone, set it on the table, and magically play along with your buds from all over the world, move along.  That is not even close to what is going to happen here.  You need the right gear, the right settings, a lot of patience, and ability to adapt.  But if you can get through the process, real-time jamming is waiting for you on the other side.  My guess is that there has not been a critical mass of tech-savvy musicians who were motivated to stick with it.  But as my friends and I have joked, "wow, who knew all it would take to stimulate the online jamming economy is a global pandemic?"

There are copious tutorials available on how to set up and get the best performance from JamKazam, and a great forum that has been really active in the last couple of months, so I am not going to duplicating those effort here.  Over the next few posts, I will attempt to demystify some of the aspects of JamKazam that tend to befuddle newcomers. 

Next post in series: What you really need

New technology could prevent neighbor-spoofed robocalls if implemented

As an update to my previous post, there is apparently some movement afoot to implement a method of secure verification of caller ID info.  It is similar to how e-mail and websites are encrypted and authenticated, using certificates.

STIR/SHAKEN is a technology standard that incorporates an authentication service, a verification service, and a certificate repository.  When a call is made, the authentication certificate issued by the caller's provider is looked up by the recipient's provider, and the call info is verified as being authentic or not.

The standard appears to be designed to be implemented at the service provider level.   As I stated previously, carriers will be slow to adopt anything that will cost them money, due to the amount of power they wield, and this case is no exception.  The call for them to adopt such a standard was put out by the FCC in 2014.  Nonetheless, 5 years later some providers, including Verizon, are going public with announcements that they intend to implement this standard, which would conceivably have a major impact on the type of robocalling - and by extension, the entire robocall industry.  By preventing the misuse/abuse of caller ID information, customers can then, in turn, effectively utilize tools such as spam filters to recognize and block calls from spammy sources.

As for when this all happens, Verizon says that in March, 2019 they begin offering their anti-spam service for free for their wire-line customers, which they say supports the STIR/SHAKEN call authentication.  Even if you are not a Verizon customer, it is a good thing for it to be adopted by any of the big providers.  At worst, it will reduce the cost effectiveness of these robocalls, and the volume will begin to drop, which will affect everyone.

Let's all hope this happens without a hitch, and our telephone infrastructure can become sane again.