Google's Android has now broken that.

On the web, we used to use:

<input type="file" accept="image/jpeg">

That opened the phone's photo picker and let the use upload a geotagged photo. But a while ago Google deliberately broke that.

Instead, we were encourage to use the file picker:

<input type="file">

That opened the default file manager. This had the unfortunate side-effect of allowing the user to upload any file, rather than just photos. But it did allow the EXIF metadata through unmolested. Then Google broke that as well.

Using a "Progressive Web App" doesn't work either.

So, can users transfer their photos via Bluetooth or QuickShare? No. That's now broken as well.

You can't even directly share via email without the location being stripped away.

Literally the only way to get a photo with geolocation intact is to plug in a USB cable, copy the photo to your computer, and then upload it via a desktop web browser?

Why?!?!?

Because Google run an anticompetitive monopoly on their dominant mobile operating system.

Privacy.

There's a worry that users don't know they're taking photos with geolocation enabled. If you post a cute picture of your kid / jewellery / pint then there's a risk that a ne’er-do-well could find your exact location.

Most social media services are sensible and strip the location automatically. If you try to send a geotagged photo to Facebook / Mastodon / BlueSky / WhatsApp / etc, they default to not showing the location. You can add it in manually if you want, but anyone downloading your photo won't see the geotag.

And, you know, I get it. Google doesn't want the headline "Stalkers found me, kidnapped my baby, and stole my wedding ring - how a little known Android feature puts you in danger!"

But it is just so tiresome that Google never consults their community. There was no advance notice of this change that I could find. Just a bunch of frustrated users in my inbox blaming me for breaking something.

I don't know what the answer is. Perhaps a pop up saying "This website wants to see the location of your photos. Yes / No / Always / Never"? People get tired of constant prompts and the wording will never be clear enough for most users.

It looks like the only option available will be to develop a native Android app (and an iOS one?!) with all the cost, effort, and admin that entails. Android apps have a special permission for accessing geolocation in images.

If anyone has a working way to let Android web-browsers access the full geolocation EXIF metadata of photos uploaded on the web, please drop a comment in the box.

In the meantime, please leave a +1 on this HTML Spec comment.

Are you allowed to run whatever computer program you want on the hardware you own? This is a question where freedom, practicality, and reality all collide into a mess.

Google has recently announced that Android users will only be able to install apps which have been digitally signed by developers who have registered their name and other legal details with Google. To many people, this signals the death of "sideloading" - the ability to install apps which don't originate on the official store⁰.

I'm a fully paid-up member of the Cory Doctorow fanclub. Back in 2011, he gave a speech called "The Coming War on General Computation". In it, he rails against the idea that our computers could become traitorous; serving the needs of someone other than their owner. Do we want to live in a future where our computers refuse to obey our commands? No! Neither law nor technology should conspire to reduce our freedom to compute.

There are, I think, two small cracks in that argument.

The first is that a user has no right to run anyone else's code, if the code owner doesn't want to make it available to them. Consider a bank which has an app. When customers are scammed, the bank is often liable. The bank wants to reduce its liability so it says "you can't run our app on a rooted phone".

Is that fair? Probably not. Rooting allows a user to fully control and customise their device. But rooting also allows malware to intercept communications, send commands, and perform unwanted actions. I think the bank has the right to say "your machine is too risky - we don't want our code to run on it."

The same is true of video games with strong "anti-cheat" protection. It is disruptive to other players - and to the business model - if untrustworthy clients can disrupt the game. Again, it probably isn't fair to ban users who run on permissive software, but it is a rational choice by the manufacturer. And, yet again, I think software authors probably should be able to restrict things which cause them harm.

So, from their point of view it is pragmatic to insist that their software can only be loaded from a trustworthy location.

But that's not the only thing Google is proposing. Let's look at their announcement:

We’ve seen how malicious actors hide behind anonymity to harm users by impersonating developers and using their brand image to create convincing fake apps. The scale of this threat is significant: our recent analysis found over 50 times more malware from internet-sideloaded sources than on apps available through Google Play.

Back in the early days of Android, you could just install any app and it would run, no questions asked. That was a touchingly naïve approach to security - extremely easy to use but left users vulnerable.

A few years later, Android changed to show user the permissions an app was requesting. Here's a genuine screenshot from an app which I tried to sideload in 2013:

No rational user would install a purported battery app with that scary list of permissions, right? Wrong!

We know that users don't read and they especially don't read security warnings.

There is no UI tweak you can do to prevent users bypassing these scary warnings. There is no amount of education you can provide to reliably make people stop and think.

Here's the story of a bank literally telling a man he was being scammed and he still proceeded to transfer funds to a fraudster.

It emerged that, in this case, Lloyds had done a really good job of not only spotting the potential fraud but alerting James to it. The bank blocked a number of transactions, it spoke to James on the phone to warn him and even called him into a branch to speak to him face-to-face.

Here's another one where a victim deliberately lied to their bank even after acknowledging that they had been told it was a scam.

Android now requires you to deliberately turn on the ability to side-load. It will give you prompts and warnings, force you to take specific actions, give you pop-ups and all sorts of confirmation steps.

And people still click on.

Let's go back to Google announcement. This change isn't being rolled out worldwide immediately. They say:

This change will start in a few select countries specifically impacted by these forms of fraudulent app scams, often from repeat perpetrators.

…

September 2026: These requirements go into effect in Brazil, Indonesia, Singapore, and Thailand. At this point, any app installed on a certified Android device in these regions must be registered by a verified developer.

The police in Singapore have a page warning about the prevalence of these scams. They describe how victims are tricked or coerced into turning off all their phone's security features.

Similarly, there are estimates that Brazil lost US$54 billion to scams in 2024 (albeit not all through apps).

There are anecdotal reports from Indonesia which show how easily people fall for these fake apps.

Thailand is also under an ongoing onslaught of malicious apps with some apps raking in huge amounts of money.

It is absolutely rational that government, police, and civic society groups want to find ways to stop these scams.

Google is afraid that if Android's reputation is tarnished as the "Scam OS" then users will move to more secure devices.

Financial institutions might stop providing functionality to Android devices as a way to protect their customers. Which would lead to those users seeking alternate phones.

Society as a whole wants to protect vulnerable people. We all bear the cost of dealing with criminal activity like this.

Given that sideloaded Android apps are clearly a massive vector for fraud, it obviously behoves Google to find a way to secure their platform as much as possible.

And Yet…

This is quite obviously a bullshit powerplay by Google to ensnare the commons. Not content with closing down parts of the Android Open Source Project, stuffing more and more vital software behind its proprietary services, and freezing out small manufacturers - now it wants the name and shoe-size of every developer!

Fuck that!

I want to use my phone to run the code that I write. I want to run my friends' code. I want to play with cool open source projects by people in far-away lands.

I remember The Day Google Deleted Me - we cannot have these lumbering monsters gatekeeping what we do on our machines.

Back in the days when I was a BlackBerry developer, we had to wait ages for RIM's code-signing server to become available. I'm pretty sure the same problem affected Symbian - if Nokia was down that day, you couldn't release any code.

Going back to their statement:

To be clear, developers will have the same freedom to distribute their apps directly to users through sideloading or to use any app store they prefer.

This is a lie. I can only distribute a sideloaded app if Google doesn't nuke my account. If I piss off someone there, or they click the wrong button, or they change the requirements so I'm no longer eligible - my content disappears.

They promise that Android will still be open to student and hobbyist developers - but would you believe anything those monkey-punchers say? Oh, and what a fricking insult to call a legion of Open Source developers "hobbyists"!

I hate it.

I also don't see how this is going to help. I guess if scammers all use the same ID, then it'll be easy for Android to super-nuke all the scam apps.

Perhaps when you install a sideloaded app you'll see "This app was made by John Smith - not a company. Here's his photo. Got any complaints? Call his number."

But what's going to happen is that people will get their IDs stolen, or be induced to register as a developer and then sign some malware. They'll also be victims.

So What's The Solution?

I've tried to be pragmatic, but there's something of a dilemma here.

0. Users should be free to run whatever code they like.
1. Vulnerable members of society should be protected from scams.

Do we accept that a megacorporation should keep everyone safe at the expense of a few pesky nerds wanting to run some janky code?

Do we say that the right to run free software is more important than granny being protected from scammers?

Do we pour billions into educating users not to click "yes" to every prompt they see?

Do we try and build a super-secure Operating System which, somehow, gives users complete freedom without exposing them to risk?

Do we hope that Google won't suddenly start extorting developers, users, and society as a whole?

Do we chase down and punish everyone who releases a scam app?

Do we stick an AI on every phone to detect scam apps and refuse to run them if they're dodgy?

I don't know the answers to any of these questions and - if I'm honest - I don't like asking them.

First of all, Google is lying. It does meet security standards and it is not rooted. I get that I have no right to run someone else's software in an environment they don't like, but this is just misinformation. 3rd party OSes are often more secure that a stock OS which has been left to rot by an unresponsive manufacturer.

Anyway, here's how you can use contactless payments on Graphene.

Prerequisites

I'm going to tell you what I did. If you found another way, leave a comment or write your own blog post.

I'm using the latest version of Graphene (2025062000) with Play Services installed. The app is running in my main profile. None of the advanced app protection has been toggled for the app. NFC is on.

You will have to agree to Curve's privacy policy. And the privacy policy of your credit card. Look, if you're using Graphene, you're probably overly privacy sensitive. If you're concerned about The Man™ knowing that you used your card to buy a breakfast beer and then sharing that with 958 trusted partners, just use cash instead.

Install Curve

Here's a referral link to install Curve - join and you get £10. Or, you can install directly from the Play Store.

You'll need to create an account and pass KYC / AML checks. Curve are regulated by the FCA so you should feel safe giving your details to them.

Add a card

Curve is a virtual card provider. So add your existing Visa or MasterCard to the app (no Amex). When you spend on Curve, you're actually spending on the underlying card you've added. Curve promise cheaper foreign exchange fees and a few other perks. But what we're really interested in is NFC payments.

Set up Curve Pay

On your app's dashboard, you should see a banner saying "Curve Pay is good to go!". If not, head into your account and set it up there.

If it has all set up, you should see a welcome tutorial explaining how contactless works.

Set your default wallet

On your phone, go to Settings → Connected devices → Connection Preferences → NFC → Contactless Payments.

Or, search your settings for Pay.

Select your default wallet app - in this case, Curve.

Pay for something

You need to make sure NFC is turned on before you can use NFC payments. I know that sounds obvious, but I forgot to do it the first time and got very confused.

Go to a local shop, pick up something, hand it to the merchant, wave your phone over the payment terminal like you are a technowizard from the future.

Enjoy eating whatever you paid for!

That's it!

Once you're done, you can turn of NFC if you're paranoid.

Apparently, Curve also works with Garmin Smart Watches - but I don't have one to test out.

If you've found this blog post useful, I'd be grateful if you signed up with my referral link for Curve.

To geeks, it is a compelling attraction. Something cool and esoteric lives in there! All sorts of goodies to explore and configure.

To normal people, it is invisible. Normal people don't go pushing random icons on their apps because computers are fragile and may break if you do the wrong thing.

To me, it is a sign that product managers are a menace and must be stopped. A hundred thousand icons vying for your attention have been stuffed away because no one has the authority to prioritise user needs.

As a | user who has received some spam

I want to | easily report it as spam

So that | Google's AI can become ever stronger my inbox is easier to manage

How do you report spam? On the web, it is possible if you're prepared to enter the forbidden lair of ⋮. Click the one nearest the message and you'll see:

But there is no "report spam" button in the Gmail app. Try to find it. I promise you it isn't there.

No, not even behind the door of mysteries which is ⋮. See:

Ah ha! FOOLISH USER!! You thought that you could transfer a mastered skill from one environment to another? You are an idiot. A buffoon. The Eloi at Google mock your Morlock ways.

Here is the report spam button in the Gmail app - hidden in the top ⋮ menu!

And, just for completeness, here's what the top ⋮ on the web has.

Why?!

Why do the Monkey-Punchers at Google have such scorn for its users? Is it because their illegal monopoly means they don't have to compete for users? Do their perverse internal politics only reward employees for adding features, not removing them? Perhaps the web team and the app team are engaged in holy war around a doctrinal schism over icon placement?

We may never know.

OK, but why?

Why do the overflows on the web have icons but on the Android app they're barren?

Why is the order of the options completely different on both?

Why are the names different for the same functions?

We can only assume that the web team are Montagues and the app team Capulets.

What is going on?

Moving a UI from the big screen to the small screen is difficult. Some options aren't relevant in either context. Some labels are too big. Some prioritisation needs to happen. I accept that.

But users only have limited cognitive plasticity. They have a mental model of how a UI works and they expect it to be reasonably consistent.

I keep making the same mistake. Whether I'm on the web or app, I always go to the wrong option! This makes me feel like an idiot. I have a hundred apps to use, each with subtly different UIs - I can't be expected to keep them all straight. But I do expect the a common set of paradigms if the services are under the auspices of a single company.

Why are there two ⋮ menu options? I think the top relates to the conversation whereas the second relates to the specific message? But maybe I'm wrong.

Two out of three ain't bad

I lied earlier. There's a third way to report spam.

On the web, hover over one of the mysterious small icons - the ones with ridiculously thin lines and low contrast - and you'll be rewarded with this:

Make it make sense!!

Most people are reluctant to try new things. Even in the exciting world of proto-smartphones, convincing someone to download, install, configure, and use a new app was difficult. Sure, we could run expensive advertising campaigns. Send hopeful text messages. Have a big celebrity endorsement. Or maybe get our customer service reps to push it.

In the end, we pre-installed it on every device we sold. Then we forcibly pushed it to every supported phone on our network. The backlash was incredible. As you might expect, people think of their phones as their own personal space. Having a new app shoved on there felt like an invasion. It took up memory space, true, but more importantly it took up psychological space. We had reminded customers that we thought of them as little more than cattle; a resource we controlled with an aim to extract value.

Google is in a similar boat today. They have absolutely no confidence that their Gemini AI Assistant is any good. They've run countless tests with customers and it is a dud. But they've invested a lot of money, so it needs to launch. Customers, in the main, decline to install it and they certainly refuse to pay for it. So what's Google's solution?

They have forcibly installed it, jacked up the prices, and made it impossible to remove.

These are not the actions of a company which believes in its own products.

To be fair to Google, it is a problem seen in many businesses. They crave instant success, they want to see massive overnight numbers, and they have a winner-takes-all mentality. But the real world isn't like that. Customers aren't morons but they lead busy and complex lives. You product is important to you, but it is utterly irrelevant to most customers. It is your job to convince people that your product has merits. You have to listen to them and get their consent.

People don't deserve to be tricked into installing something. Forcing people to use your product is disrespectful

But now, under pressure from Apple's incredible Find My network, Google has started rolling out a similar service to modern Android phones. In theory it should be much better; Android has a higher market share than iOS in most parts of the world I'm interested in visiting. But Apple's monoculture means they can quickly roll out the network to a much higher range of devices than Google.

The Pebblebee "Universal" range works with both Apple and Android's networks. But, crucially, not at the same time. You can reset the device and swap it between your iPhone and Galaxy - but it won't connect to both networks simultaneously.

Hey, remember when Google and Apple collaborated so that Covid tracing apps were interoperable no matter the device? Good times, man! But, y'know, this is just for protecting property, not life. So we'll give them a pass…

This is what the Pebblebee Clip looks like.

It's a fairly unobtrusive small disk. Clip it to a thing with the included clip, hide it in the lining, glue it to a device. The logo is a clickable button which is used for pairing the device, resetting, and checking the battery.

It also comes with a ridiculously short USB-C-to-C cable which can only be used for charging.

Dump it and grab a longer cable from your big box of cables. Total e-Waste, shouldn't have been included.

When you tell the app to make the PebbleBee identify itself, you're rewarded with this display of loud beeps and disco lasers.

The lights are bright and the sound is piercing - especially considering its size. It fits neatly in a hand and is small enough to tuck away in a pocket.

But what's it like to use?

Pros

• USB-C rechargable. No more faffing about trying to find a new battery. No e-Waste. No worrying if it'll last an entire trip. Shove it into to any USB power source and you're good to go.
• Loud beeper. One of the main reasons I got this was that it (reportedly) has the loudest speaker on the market. I can't compare it to others but it is certainly good enough for hearing in a crowded train carriage.
• Lights. The sides light up - handy for giving you a visual cue as to where it is.
• Small, light, and includes a keyring connector.
• You can share trackers between accounts. My wife and I each have a suitcase. We don't just want to know where our own bag is - we both want to know where both bags are.

Cons

The downsides of the device are minimal - depending on your use case.

• Not waterproof. Certainly water resistant - but the USB-C socket is an ingress point for fluids.
• No Ultra Wide Band. That means you don't get a precise direction when looking for something - just the distance. UWB isn't supported on Google's "Find My Device" network right now, so this isn't a great loss.
• No wireless charging.
• Cost. Even in bulk, with a discount, they were £25 each.

Security

Anyone who finds your tracker can factory reset it. I can't help but feel there should be a way to prevent that. But, to be honest, if a thief has found your token they can just throw it away or destroy it.

Firmware updates aren't available in the Google Find My app. So you'll need to use Pebblebee's own app.

The USB-C port is for power only. They don't show up as a device when connected to a computer.

Testing

I wasn't able to connect to the PebbleBee using GrapheneOS - one of the downsides of using a hyper-secure version of Android.

I used a separate phone, but couldn't get the device to pair. I kept getting this message:

I had to go to Setting → Google → Devices → Scan for nearby devices. Only then could I add it to Find My Device.

The FMD service lets you share devices with another Google account. Perfect for families and loved ones! When I tried to use it, I got this error message on the GrapheneOS phone.

That's probably a GrapheneOS issue. But it is dissapointing these sorts of things aren't standardised and baked into the OS.

In terms of tracking - a bit crap. In Gatwick airport - a pretty busy destination - they stayed tracked for a bit after we dropped off our bags. But in less busy destinations, they never pinged the network. They claim a 150m range which ought to several times better than an AirTag. But without a critical mass of Android users opted-in to the network, it is pointless.

Privacy

I'm a bit of a privacy nut. There's no doubt that these can be used to stalk people - but the Find My app is supposed to alert you if it detect a tag following you.

Is having Google and Apple know where all your stuff is a good thing? Well, probably not. But if it is a choice between seeing where a thief has taken my laptop bag and a multinational knowing what train I took, I guess I'm surprisingly OK with it.

Yes, it is a Devil's Bargain. Location is useful for surveillance (be it advertising or police) but it is also useful for personal security. It isn't nice living in a Panopticon but it also isn't nice to lose your expensive possessions.

Verdict

From a tech point of view - they sort of work! BLE is now an established technology and is well supported on all modern phones. Google's "Find My" app is basic, but works at tracking your devices when they're near you. The device is loud, bright, and is quickly recharged.

If you have a phone that support it, they're a reasonable device. At £25 each, they are optimistically priced. Especially given the coverage issues.

And that's the crux of the issue. As of yet, the network simply isn't as expansive as the Apple version. Apple have the ability to push out a service to millions of users, Google don't. While there are more Android users (certainly in my part of the world) there isn't a mechanism to bootstrap this network.

Back in the day when Google was ambitious, they would have stuck sensors all around the country or ran a massive campaign encouraging people to get involved or launched a cool API or given out a million trackers as freebies. But Google is now a timid and cautious shadow of its former self. Everyone in tech half-expects the Find My Device network to join the Google Graveyard like so many other interesting projects.

So, for now, these are great if you're within a few hundred metres of them. And they're barely adequate under any other circumstances.

Back in 2013, Google created the "Noto" project. Its aim? To include "all the world's languages". They wanted to banish "tofu" - the little white blocks □ which indicate a missing character - hence the name "No Tofu" / "Noto".

There was great flurry and excitement which has, thankfully, been sustained over the years. Noto continues to churn out regular updates to their fonts. Android began to use Noto but, for some unknown reason, it only rarely uses the latest versions. This means whole swathes of modern characters are missing from Android.

You can see all the fonts included in the Android Open Source Project. If you want to download them all, run: git clone https://android.googlesource.com/platform/external/noto-fonts

Open up the fonts in your favourite editor, and you'll see just how outdated they are.

For example, Gujarati is stuck on 2013's version (1.03) despite v2.106 being released in 2023

It's a similar story for the technical symbols block - Android is stuck on v1.09 despite a decade of advances.

A few, like Hentaigana were only created recently - and so are on the latest version. But the majority are woefully outdated.

Perhaps that's just a lack of love for AOSP? Not at all. I downloaded the latest beta version of Android 15 and went through all the fonts it included. They're exactly the same⁰.

How bad is it?

I decided to compare all the recently published Noto fonts and those available in AOSP.

I downloaded all the most recent Noto fonts from GitHub. It does take some time for fonts to be tested on phones so, in the spirit of fairness, I grabbed the 2024-01-01 release.

Here's what I found.

Of the 224 non-Emoji fonts in Noto, AOSP only has about 140. About a third are simply missing.

Of the fonts included with Android 15, how many were updated within the last 2 years? Ten. Not a typo.

Despite a regular publishing cadence from another Google project, Android is ignoring the vast majority of updates.

This means Android is missing entire languages, has severely outdated fonts in others, and - most importantly - doesn't include the Unicode Power Symbol.

Noto is a great effort - but Android is failing to keep up.

What now?

I've raised a bug on the AOSP bug tracker¹. And I've published this ranty blog post. If you work for Google, or an Android manufacturer, please give the Android team a nudge and get them to update.

Ideally, Project Treble would allow for these fonts to be updated, so even older versions of Android could benefit from them.

Full List of Fonts, Dates, and Versions

I've generated this based on the 2024-01-01 release of Noto and the AOSP source code from 2024-09-13. I've placed the dates next to each other for ease of comparrison. Empty cells means the font doesn't exist in that release.

I've tried to transcribe all the data accurately. Corrections very much welcome.

Code

This Python code will get all the TTF fonts in a directory, and its sub-directories, and then print a Markdown table of name, version, and copyright date.

import os
import glob

filelist = glob.glob('**/*.ttf', recursive=True)

for file in sorted(filelist):
        filename = os.fsdecode(file)
        if filename.endswith(".ttf"):
                font = ttLib.TTFont(filename)
                ttf_name      = font["name"].getDebugName(1)
                ttf_style     = font["name"].getDebugName(2)
                ttf_version   = font["name"].getDebugName(5).split()[1].split(";")[0]
                ttf_copyright = font["name"].getDebugName(0).split()[1].split("-")[-1]
                print ( f"| {ttf_name} {ttf_style} | {ttf_version} | {ttf_copyright} |")

People often send DMCA requests to Google saying "this site has stolen my copyrighted content - please remove that page from Google."

Google, to their credit, let me know that they'd recently received a complaint about me 😢

Ah, dammit! What photo had I inadvertently copied?⁰ Here's what Google said:

Huh? Back in 2020, I wrote a blog post called "This blog strips off for CSS Naked Day". It contains a single image:

That's a screenshot that I took of Firefox. My use of my image on my site isn't a copyright infringement.

WTAF?

Scrolling through the legal complaint I found I was in illustrious company.

After accessing the full report, I discovered that the complaint was made on behalf of an OnlyFans user called "firefoxs" who has - to quote her bio - the "#1 Nicest Tits On OF"¹.

Needless to say, I dispute the allegation and I've filed a DMCA Counter Notification.

Perhaps this is just a case of an overzealous lawyer hitting every website which contains an image called "Firefox"? Or perhaps it is a ploy to get a bunch of irate webmasters to visit an OnlyFans page to assess the evidence?

Either way, I think the biggest pair of tits on the Internet are firefoxs' copyright lawyers!

Google used to have some beautiful logos for its apps. Each had a distinct shape, style, and colour. Then, someone decided that they all needed a consistent visual language. And this mess was born.

*sigh* I get it. I really do. Brand is a thing. Users often use visual heuristics to identify similar groups. Having each team go wild on an icon design doesn't always reflect the professionalism and consistency that you want to project. The logos aren't awful - but I find them a little boring. Not the worst sin in the world. Though that's only half the problem.

In Google's Android, they've decided that - for consistency - all icons must be firmly encased in a white circle. It makes everything look clean, consistent, friendly, and...

...oh.

I apologise for getting old. My visual acuity isn't what it once was. When I'm staring at my phone, with its screen caked in fingerprint grease, on a juddering bus, after a long day at work, all I want is a quick way to identify the app I want to use.

Like most people, my brain has evolved to take mental shortcuts. It looks for a distinct shape and colour to identify things. I simply can't do that with modern Android's adaptive icons. They all look like white circles with a splodge of colour in the middle.

A few years ago, I wrote about fixing Android's circular icons. Sadly, I don't have the skill to produce my own icon pack. But using the open source Iconeration I was able to manually set my icons to be beautifully inconsistent.

With a glance, I can immediately see which is which. Do I care that they're not all aligned perfectly? Nope!

I've got a high-resolution screen, I want high-resolution artwork. Look at that Firefox icon! It is gorgeous! It isn't a pale, flat, blob - it has texture and uniqueness.

Phones used to be wild and unique - now they're all boring black rectangles. User Interfaces used to reflect the aspirations of their designers - now they're just a bland corporate mediocrity.

I hope, one day soon, the fashion pendulum will swing back and interfaces can become interesting again. Until that day, I'll use Iconeration to make my phone easier and more delightful for me.

Before starting, I booted the Google OS to install the latest firmware and an eSIM. After a few days of enduring Google's naggy software, I was ready to commit to installing something better.

I tried using the Web Installer. It managed to flash some of the partitions and then failed with:

Failed to execute 'claimInterface' on 'USBDevice'

So I used the CLI instructions which were comprehensive. Worth re-reading them a few times to make sure you understand what needs doing. I (foolishly) assumed my fastboot didn't need updating. Tsk!

And then... it just worked!

Well, almost. The device saw the previously installed eSIM, but wouldn't connect to its network. I manually removed it, reloaded it. Still nothing. So I manually chose the network and that seemed to fix it. No idea if that's a problem with the network, the eSIM, or something else.

Bugs

As soon as I booted, my network provider sent me a text. I opened up the default messaging app and saw this error:

This is a known problem but it makes for a crappy user-experience. There's no way to update the app in Graphene - you need to manually install your preferred SMS app.

In similar UX fails, I tried to add the clock widget to my home screen. This is what I saw.

If you peer carefully, you'll see an analogue and digital clock. I hadn't switched to dark mode or anything like that - this is the default experience.

I wanted to see how long I could go before installing Google Play Services. The answer was... five minutes. I tried to log in to my password manager using a WebAuthN token and it wouldn't work. The default Vanadium browser can't handle them. Again, this is a known problem - but it does slightly undermine the attraction of Graphene. I'm privacy conscious and want as little Google in my life as possible. I'm security conscious and want to use MFA everywhere. Pick one.

Partway through the day, I got this internal error:

I was happily browsing the web with no connectivity issues. So I'm not sure what caused that.

It's annoying that Graphene doesn't support LineageOS's bottom-button changes. I have a decade of muscle-memory saying back is on the right. There's no way to change it, so I've swapped to gesture navigation.

The icon size on the stock launcher are far too small. On a massive screen like the 8 Pro they are tiny. So I've installed NeoLauncher which is a lot more customisable.

The only other (non-essential) thing missing is the ability to use Cast to screen share a device. There's a button in the UI, but it does nothing.

Setting up a work-profile required a little bit of a work-around, but seems to have worked. Hurrah for forum threads detailing the various tricks you need.

A software update allowed DisplayPort via USB-C. I plugged the 8 Pro into my USB-C hub, it detected the ethernet, keyboard, mouse, and display - graphics came through fine. Although there's no way to rotate an external screen - so you're stuck with landscape orientation. My HDMI adapters showed as detected via a little icon - but no video came out.

The Graphene camera's interface isn't as good as GCam and it is missing a bunch of options. Installing the stock Pixel camera worked - and there are lots of hacky derivatives.

Other than that, it has been pretty good so far. My banking apps work, call recording works, 5G and Bluetooth works, eSIM and regular SIM works. There have been a few odd things where apps have complained that they can't work and then suddenly sprang to life - but that might just be Android.

The only big thing Graphene is missing is Google Pay / Wallet. It is so convenient using tap to pay - but getting rid of the rest of the incessant Google bloat is worth the sacrifice.

Overall, I'm happy with the decision to nuke the original Google software. I know they say they'll support the device for 7 years - but I literally have no reason to trust them. Maybe I'm being naïve trusting a group of random hackers to produce a more secure OS - but I'd rather that than further entanglement with an organisation which has repeatedly shown contempt for its customers and users.

When I search for my name in Google Books, it returns books I have reviewed. These aren't books that I've written. They don't mention, quote, or cite me. My reviews don't appear on the dust-jacket. Google has got confused.

Here's an example.

Go to the Google Books Advanced Search Page - marvel at how it retain the old Google logo and looks like it hasn't been updated since the early 2000s!

When I do a search for "Terence Eden" - these are the results.

I have reviewed both Terry Pratchett's Discworld Imaginarium (excellent) and Good Data by Sam Gilbert (terrible) - but that's my only connection to them. If you go into the results in Google Books, you won't find my name at all. It's not like Google adds my reviews into its service either.

This has been a problem for at least four years.

As I scroll through the results, there are several books which do mention me (thanks authors!) but loads which are just picking up my review.

To get an idea of the scale of the problem, here's a search for my name in books published during the last few years. Nearly every result is a book I have reviewed. None of those books contain my name.

Now, earlier I said it is impossible to report bugs to Google Books. That's not quite true. Last year I contacted them on Twitter. They said:

Google Books

@googlebooks

Replying to @edent@edent Hi, thank you for your feedback. I've passed it along to our engineering team. -Cait

---

*sigh*

Perhaps their pivot to AI will fix their towering pile of bugs?

Jessica Rose

@jesslynnrose

The function of a system is its output.

If you have dog grooming machine that sometimes smashes puppies and you keep running it, you're in the dog smashing business.

If you work for a mass surveillance company that keeps enabling genocide and undermining democracy...

---

The whole thread is worth reading. One thing she doesn't cover is how you should respond when someone proposes to implement a puppy-smashing machine.

If you don't agree with puppy-smashing (and there are two sides to every argument) then it's very important to be polite and civil while discussing the issue - because puppy-smashers are real people with valid feelings.

For example, you could say to them:

• I'm not so sure that's a great idea. Please would you reconsider?
• Hey, just so you know, not everyone is down for puppy smashing. Any thoughts on addressing that?
• Interesting. But have you read Smith et al's work on differential smashing of pets?
• You're the good guys! Is there any way you can exclude my puppy from being smashed? He's a service dog.
• Perhaps you could only smash puppies 10% of the time? No worries if not!!!

And so on. That way you get to have a calm and respectful decision about the the hard work people are doing. Even if someone is threatening to smash your puppy, you need to keep a cool head and make sure you don't raise your voice.

Right?

No.

The correct response is "What the actual juddering fuck is wrong with you? Don't be such an absolute thundercunt! I'm going to call the authorities right now, you literal scumbag!"

It was Robert Jones, Jr. who said: "We can disagree and still love each other. Unless your disagreement is rooted in my oppression, your denial of my humanity, my right to exist."⁰

I don't think you need to be civil to those people who are deliberately trying to harm you. Sure, you might get a more positive reaction if you gently cajole them or politely help them see the error of their ways. But sometimes it is important to let people know vociferously just how much their plans will hurt you and your puppies.

(It's the latter, obviously.)

We'll never know exactly whether users want this because Google is pathologically adverse to performing or publishing user research.

Anyway, I have a solution to all of Google's problems. Forget this notion of untrusted "user agents" executing code on untrustworthy computers. I have a foolproof way of getting pixel-perfect rendering on every device. It also stops scraping. And, as a little side effect, completely defeats ad blocking.

It's VNC.

This takes "Server Side Rendering" to the extreme. Render exactly how you want the page to look and then stream it over a remote framebuffer protocol. Users get to see exactly what you want them to see - ads included!

Just imagine the possibilities. No more worrying about which browser is being used - render everything through Chrome and stream to everyone!

Users simply can't alter the content they see - which keeps them safe from hackers, and protects your advertising revenue.

Low bandwidth? VNC will simply degrade the quality of what you see. Look, do you really want poor people viewing your expensive website?

Those naughty hackers won't be able to copy and paste your content - the trusted VNC viewer simply won't let them.

Want to track users across multiple sites? Might be tricky. Just route all your content through Google's AMP VNC service!

...ugh... I've reinvented Opera Mini and given myself a sad.

There are so many decent people working at Google. And all the good they're trying to do is being drowned out by mediocre and mendacious crap like this. Google desperately needs to be broken up. It's simply untenable to have the largest browser in the hands of the largest web advertising firm. Android isn't safe with a firm which priorities their advertisers' needs over their customers' needs.

The thing is, this is coming. There is literally nothing you can do to stop it. Your protests are meaningless next to the desire for some people at Google to sanitise the web.

Google do this sometimes. They once proclaimed that Argleton was a real place - despite its non-existence.

While I was looking for something to do in London recently, I came across this curious entry.

Why does Google think there is an "Ancient Metal Vault" in Mayfair?

There's nothing similar on OpenStreetMap. Similarly Bing and Ordnance Survey show nothing there.

I thought it might be a historic place - but there are no search results for it.

What does Google Maps say about the place?

Nothing. Except a UK mobile phone number. When I called, I got an American "This number is not in service" message.

If it were a dozen years ago, I'd've thought this was the start of some augmented reality game. But, instead, I think it's most likely an artefact from some old mapping data they've imported.

Either that, or it is time to go digging up some London streets in the dead of night for an exciting caper!

We've started re-doing our garden recently. The hideous decking was quickly rotting away and needed removing. But what would we find under there?

Google's StreetView for the web lets you take a short trip back in time - if you're lucky, you might catch a glimpse of what your garden looked like over the year. (That's a random house I found, not mine!)

But what about satellite images? Both Bing and Google provide an overhead view of your property. But they only show the most recent images.

There is a way to see previous satellite imagery though! Using the (appallingly named) Google Earth Pro Desktop app. It's available for Linux, Mac, and Windows. Hidden away at the top is a magic little icon:

Drag it around and you can go back in time - up to the 1940s in some cases.

Now, the fidelity of the images isn't always brilliant but it's often enough to get a sense about what your area was like long ago.

And that's how we found out that the decking was covering a rather fine ornamental pond!

So I've spend the last few weekends excavating it. And cursing the previous owners for filling it with their concrete rubble, sweet wrappers, and broken bricks!

You see computers try to be helpful. They see you wrote "visit example.com" and autolink the thing which looks like a domain name. That's handy - especially as most people don't have the time or skill to write HTML.

So what happens when things which are not domain names look like they are domain names? I've been worrying about this for a few years:

Terence Eden is on Mastodon

@edent

Grrr... Because .zip is a valid TLD, it's impossible to know whether example.zip should be a URL or a filename.

---

Right now there is an old tweet, blog, email, or instant message from an authority figure which points to a non-existent .zip domain.

Is that domain available to buy? Well, let's look at Google's Domain Availability site

(No, I don't know where the missing "T" is either.)

Yup! OK, premium domains like photos.zip appear to be about £1,000 - which should put off some scammers. But the price for non-premium .zips is between £10-£30.

Look, I doubt a former president ever Tweeted "Hey, anyone know how I extract files from something called blah.zip on a Mac?" but I'll bet you that something, somewhere, is going to be abused with this new TLD.

I feel like a curmudgeonly old fart. Don't we have enough TLDs? What's the limit? There are very few meaningful controls on who can register all but the most retrictive TLDs (looking at you, .int!) So at what point do we just give up and same everyone can have their own Top Level?

Anyway, have fun determining if the link you see was ever intended to link to a website!

Buried in amongst all the hullabaloo from whinging ungrateful brats thoughtful comments from people with justifiable concerns, was this snippet from a Reddit employee:

An Improved Web Experience - Reddit

Long time readers will remember that I resigned from the Google AMP Advisory Committee having been a long time critic of the project.

AMP was an interesting idea (what if we made HTML fast again?!) and brought forth some interesting technologies (like Signed Exchanges) - but it ended up being a re-invented WAP⁰ which routed everything through a single point of failure.

I genuinely hate to see projects fail - but I can't help but hope this is the start of more people realising that giving unfettered control to an abusive monopoly like Google isn't a good decision.

While yak-shaving for my MSc, I found an interesting looking research paper authored by one JC Shakespeare.

As you can probably tell from that snippet, there is something a bit hinkey going on here. Here's the page that Google Scholar has scraped:

It's pretty easy to see what has happened here. The algorithm (whether via simple AI or complex regular expression) "knows" that a typical surname followed by a comma followed by a typical given name is almost certainly a reference.

And so "JC Shakespeare" becomes the author of a delightfully diverse set of papers.

Of course, Julius Caesar isn't the only play which gets picked up in this way:

Remember, AI is a great tool. It can be remarkably quick at drawing nearly correct conclusions from a diverse data set. When talking about AI, we usually discuss false positives and false negatives. But we also need to ask "is this the sort of mistake a human would make?"

As it happens, Google has been making this class of mistakes for a few years:

Alex Klotz

@AlexanderRKlotz

Google Scholar has parsed this cafeteria lunch menu as an author list, and it's delightful pic.x.com/jobE6Z7bpI

---

Sadly, that's not always enough.

Two years ago today, I wrote what I thought was a pretty comprehensive bug report for Android OS.

I included links to public forums where other people were experiencing the issue. I even posted some code which was designed to fix the issue.

Like most public Android bugs, it was assigned to some anonymous drone within the Googleplex - whereupon it was promptly ignored, never to be fixed.

The bug itself is quite minor. But it shows up in all sorts of places, and probably causes people around the world daily annoyance. I don't think it is a security bug - although I'd love to be proved wrong - so there's not much incentive for Google to fix things.

I get that Google receives thousands of bug reports. And I know that triaging them must be a time-consuming problem.

Open Source maintainers don't have to take orders from their users, nor do they have to prioritise trivial complaints. But it is just so frustrating to be unable to make even the merest dent in a bug.

"hasMenuItem":{
  "@type":"MenuItem",
   "name":"Dodo In A Bun",
   "description":"The legendary extinct bird cooked in tomato sauce, served in a gluten-free bun.",
     "offers":{
       "@type":"Offer",
       "price":"7.99",
       "priceCurrency":"GBP"
     },

But, for now, they don't. So Google uses MACHINE LEARNING and DEEP AI to scrape the menus out of PDFs and photos submitted by patrons. It works about as well as you'd expect.

Examples

Here's a bunch of screenshots from Google Maps. Would a human have made these mistakes? (No they'd make much more interesting mistakes!)

Are those realistic prices for burgers? Would a place that sells a gold-covered burger also sell second-hand chicken? Is it usual that UK menus offer items in different currencies? What about this:

Is that a likely name for a side dish? You wouldn't find that even in trendy Shoreditch. And, again with the weird pricing. Side dishes rarely cost that much. Still, it could be worse…

I guarantee you the little curry shop I was looking at didn't have anything on the menu that pricey!

Other times, it seems to just pick random words in a vague attempt to be "useful".

Perhaps my favourite is this British restaurant which offers spam, spam, and more spam:

There were dozens (dozens!) of examples I found within a few minutes of looking for somewhere nearby to grab a cheap lunch. To be fair, when the website has supplied data in an appropriate format, Google is good at displaying it. But when Google tries to be clever... ah.

There is, of course, no way for a user to contact Google and say "I dunno, man. This looks kinda off."

Whose Fault Is It Anyway?

Obviously, restaurateurs should provide machine-readable descriptions of their menus. That way search engines, smart speakers, and all sorts of funky computers will be able to parse the food available.

But they don't. Because they're busy cooking.

Google has discovered that it takes 90% of the effort to get 90% of the way there - but the last 10% takes the next 90% of the effort.

As ever, a feature has launched and it is of dubious value to business owners and customers - but I'm sure a product manager at Google got their wings.