Using Google Groups to Restrict Access to Waves

Free and slightly enhanced translation from Groups: The Google Groups Solution (Elliot Cable et al)

It is still not mentioned anywhere in public waves or documents, and probably it's time to mark this moment. Especially given the vulnerability of public waves.

The Google Wave Server has support for groups and minimal means of restricting access based on them. They just forgot to tell us about it.

This is implemented using an existing service - Google Groups.

In the future, the waves will have their own access controls, but for now this is the only available temporary solution.

main idea

• create a google group, if you don’t have one yet;
• invite members to this group (who already have wave accounts)
• Add contact groups@googlegroups.com to your contacts (just like public@a.gwave.com, the client will say that this user does not have a wave account, but this can (usually) be ignored and press Enter. the address will remain in the contact list as at least until the next client restart)
• add this contact to the wave.
• All Wave users will be able to find a wave by group: imyagrupy@googlegroups.com

Users who are not members of your group will not be able to add messages to this wave, unless they join the Googlegroup.

There is no way to remove a group from a wave, just like with a public one.

Details

• The group must be initially created as fully open, otherwise the search group: and groups@googlegroups.com will not produce results, and the interface will display a list of all the waves in which you participate.
• Selecting “All messages are viewed by the presenters” in the access settings will lead to “turbulences” in the waves to which you will try to add this group.
• If you select “Only members can view group content”, attempts to open a wave will be blocked with the message “You are still a wave header (and the beginning of the start blip) will still be available in the search results.
  • and it seems that this is a permanent effect. Elliot tried to enable and disable this setting, but non-members of the group remained without access to the content.
  • users with the ability to view, but without the ability to post can not create new messages in the wave, but they can create new wavelets (waveforms), although neither add messages to these waves, nor the participants they will fail.
  • Using this, you can completely spoil the waves, so this mode leaves waves vulnerable to attack. Moreover, the removal of subwaves is not provided.
  • clumsy bug: if you add a wave to this method, in the wave to which there is write access, then this write access will remain forever. ie, when a participant is removed from a wave, read access is retained and he will be able to view new messages as if he were a wave participant, while new waves in the group will no longer be available.
• Since it is impossible to add a group from a wave, you need to use the GoogleGroup web interface, and all access settings for adding / inviting work there as intended ( “Who can join?” And “Who can invite new members?” Settings)
• No other GoogleGroup settings have any effect on the waves (at least Elliot did not find it)

Comments

[4 Oct 09] Lars Rasmussen:

You can find a group in the list of contacts, click on the avatar, and then click on the “recent waves” button and get a list of all the waves of this group.

Then, of course, we will do other elements of working with groups.