Selasa, 04 Mei 2010

Do know evil

(Cross-posted on the Google Online Security Blog)

UPDATE July 13: We have changed the name of the codelab application to Gruyere. The codelab is now located at http://google-gruyere.appspot.com.

We want Googlers to have a firm understanding of the threats our services face, as well as how to help protect against those threats. We work toward these goals in a variety of ways, including security training for new engineers, technical presentations about security, and other types of documentation. We also use codelabs — interactive programming tutorials that walk participants through specific programming tasks.

One codelab in particular teaches developers about common types of web application vulnerabilities. In the spirit of the thinking that "it takes a hacker to catch a hacker," the codelab also demonstrates how an attacker could exploit such vulnerabilities.

We're releasing this codelab, entitled "Web Application Exploits and Defenses," today in coordination with Google Code University and Google Labs to help software developers better recognize, fix, and avoid similar flaws in their own applications. The codelab is built around Gruyere, a small yet full-featured microblogging application designed to contain lots of security bugs. The vulnerabilities covered by the lab include cross-site scripting (XSS), cross-site request forgery (XSRF) and cross-site script inclusion (XSSI), as well as client-state manipulation, path traversal and AJAX and configuration vulnerabilities. It also shows how simple bugs can lead to information disclosure, denial-of-service and remote code execution.

The maxim, "given enough eyeballs, all bugs are shallow" is only true if the eyeballs know what to look for. To that end, the security bugs in Gruyere are real bugs — just like those in many other applications. The Gruyere source code is published under a Creative Commons license and is available for use in whitebox hacking exercises or in computer science classes covering security, software engineering or general software development.

To get started, visit http://google-gruyere.appspot.com/. An instructor's guide for using the codelab is now available on Google Code University.

Senin, 03 Mei 2010

Google Ventures: Year one

When we launched Google Ventures last March, we wanted to honor Google's entrepreneurial roots while tapping into the wealth of human and technical resources available at Google Inc. to build a unique venture fund. Rather than looking for investments that would simply be strategically useful to Google, we aim to invest in best-of-breed ventures in a wide variety of fields. Our fund's calling is to generate a financial return while supporting entrepreneurs who are creating transformative ventures. In doing so, we try to bring to bear Google's resources to support them in that mission.

The job is fairly straightforward: we want to find outstanding entrepreneurs and start-ups, perform thorough and careful due diligence with the help of the combined experience of more than 20,000 Googlers, and then do everything we can to help those companies grow and succeed. To do so, we're building a team of seasoned entrepreneurs, subject-matter experts and investors committed to this goal — above all else, we want to provide more than dollars to our investees. From product launches to code reviews, from help with communications to UI design and beyond — there are a lot of areas where Google's collective experience might be helpful to a start-up.

We recently revamped our website, where you can find out more about the people that make up the growing Google Ventures team as well as information on the 10 currently announced portfolio companies.

Google Ventures is an expression of our optimism in the future and the belief that looking for, supporting and fostering innovation is worthwhile. We don't know where the next great idea will come from, but with the help of many Googlers, great co-investors and a growing team, we're going to keep looking while working to help entrepreneurs succeed.

URL removal explained, Part IV: Tracking your requests & what not to remove

Webmaster Level: All

In this final installation in our URL removal series, let's talk about following up on your removal requests, as well as when not to use Google's URL removal tool. If you haven't already, I recommend reading the previous posts in this series:
Part I: Removing URLs & directories
Part II: Removing & updating cached content
Part III: Removing content you don't own
Companion post: Managing what information is available about you online

Understanding the status of your requests

Once you've submitted a removal request, it will appear in your list of requests. You can check the status of your requests at any time to see whether the content has been removed, or whether the request is still or pending or was denied.

screenshot of removal requests and their status

If a request was denied, you should see a "Learn more" link next to it explaining why that particular request was denied. Since different types of removals have different requirements, the reason why a particular request was denied can vary. The "Learn more" link should help you figure out what you need to change in order to make your request successful. For example, you may need to change the URL in question so that it meets the requirements for the type of removal you requested; or, if you can't do that, you may need to request a different type of removal (one whose requirements your URL currently meets).

If a request has been marked "Removed" but you still see that content in search results, check the following:
  • Is the URL that's appearing in search results the exact same URL that you submitted for removal? It's fairly common for the same, or similar, content to appear on multiple URLs on a site. You may have successfully removed one URL, but still see others containing that same content.
       Solution: Request removal of the other URL(s) in question. See this article for help.

  • Keep in mind that URLs are case sensitive, so requesting removal of http://www.example.com/embarrassingstuff.html is not the same as requesting removal of http://www.example.com/EmbarrassingStuff.html
       Solution: Request removal of the exact URL(s) that appear in search results, including the same capitalization. See this article for help.

  • When a request is marked "Removed," that can mean different things depending on what type of request you submitted. If you requested removal of an entire URL, then "Removed" should mean that that entire URL no longer appears in our search results. If you requested removal of the cached copy of a URL, "Removed" means that the cached copy has been removed and will no longer appear in search results; but the URL itself may still appear.
       Solution: Double-check what type of removal you requested by looking at the "Removal Type" column. If you requested a cache removal but you want the entire URL gone, make sure the URL meets the requirements for complete removal and then file a new request for complete removal of the URL.
When not to use the URL removal tool
  • To clean up cruft, like old pages that 404.
    The tool is intended for URLs that urgently need to be removed, such as confidential data that was accidentally exposed. If you recently made changes to your site and just have some outdated URLs in the index, Google's crawlers will see this as we recrawl your URLs, and those pages will naturally drop out of our search results over time. There's no need to request an urgent removal through this tool.

  • To remove crawl errors from your Webmaster Tools account.
    The removal tool removes URLs from Google's search results, not from your Webmaster Tools account. There's currently no way for you to manually remove URLs from this report; they will drop out naturally over time as we stop crawling URLs that repeatedly 404.

  • To "start from scratch" with your site.
    If you're worried that your site may have a penalty, or you want to "start from scratch" after purchasing a domain from someone else, we don't recommend trying to use the URL removal tool to remove your entire site and then "start over." Search engines gather a lot of information from other sites (such as who links to you, or what words they use to describe your site) and use this to help understand your site. Even if we could remove everything we currently know about your site, a lot of it would come back exactly the same once we'd recrawled all the other sites that help us understand your site and put it in context. If you're worried that your domain has some bad history, we recommend filing a reconsideration request letting us know what you're worried about and what has changed (such as that you've acquired the domain from someone else, or that you've changed certain aspects of your site).

  • To take your site "offline" after hacking.
    If your site was hacked and you want to get rid of bad URLs that got indexed, you can use the URL removal tool to remove any new URLs that the hacker created, e.g., http://www.example.com/buy-cheap-cialis-skq3w598.html. But we don't recommend removing your entire site, or removing URLs that you'll eventually want indexed; instead, simply clean up the hacking and let us recrawl your site so that we can reindex the new, cleaned-up content as soon as possible. This article contains more details on how to deal with hacking.

  • To get the right "version" of your site indexed.
    When a request to remove https://www.example.com/tattoo.html is accepted, http://www.example.com/tattoo.html is also removed. The same is true of the www and non-www versions of your URL or site. This is because the same content is often available at each of these URLs and we realize that most webmasters and searchers don't want these duplicates appearing in search results. In short, the URL removal tool should not be used as a canonicalization tool. It won't keep your favorite version, it'll remove all versions (http/https and www/non-www) of a URL.
We hope this series has answered your questions about removing content from Google's search results, and helped you troubleshoot any issues that may arise. Join us in our Help Forum if you still have questions.

Not merely tilting at windmills — investing in them too

On Friday we made our first direct investment in a utility-scale renewable energy project — two wind farms that generate 169.5 megawatts of power, enough to power more than 55,000 homes. These wind farms, developed by NextEra Energy Resources, harness power from one of the world’s richest wind resources in the North Dakota plains and use existing transmission capacity to deliver clean energy to the region, reducing the use of fossil fuels. Through this $38.8 million investment, we’re aiming to accelerate the deployment of renewable energy — in a way that makes good business sense, too.

To reach a clean energy future, we need three things: effective policy, innovative technology and smart capital. Through our philanthropic arm Google.org, we’ve been pushing for energy policies that strengthen the innovation pipeline, and we’ve been dedicating resources to developing new technologies, including making investments in early-stage renewable energy companies such as eSolar and AltaRock. Smart capital includes not only these early-stage company investments, but also dedicated funding for utility-scale projects. To tackle this need, we’ve been looking at investments in renewable energy projects, like the one we just signed, that can accelerate the deployment of the latest clean energy technology while providing attractive returns to Google and more capital for developers to build additional projects.

A clear windy day at the Ashtabula II wind farm

We’re excited about this first project investment because it uses some of the latest wind turbine technology and control systems to provide one of the lowest-cost sources of renewable energy to the local grid. The turbines can continuously adjust the individual blade pitch angles to achieve optimal efficiency and use larger blades with 15 percent more swept area than earlier generations, allowing capture of even more wind energy for each turbine. The control systems for these wind farms are also advanced and dynamic, allowing for remote 24/7 monitoring and operation to ensure maximum turbine up-time and power production. A couple of us got a chance to climb 80 meters up one of the 113 turbines to see firsthand how the rotating blade motion goes through a gearbox to turn the generator that makes the electricity. The climb to the top also provided a great view of the entire wind farm (don’t worry — we all had harnesses and turned the turbine off!).

My colleague Matt takes a rest after the 80-meter climb

We look forward to finding more opportunities to invest in renewable energy projects that use the latest technologies to push the envelope for delivering low cost clean energy. We’ll let you know what we find.

Introducing Google’s 2010 Anita Borg Scholars & Finalists

The Anita Borg Memorial Scholarship, established by Google in 2004, honors Dr. Anita Borg, a computer science pioneer who dedicated her life to changing the way we think about diversity and technology. Now in its seventh year, her namesake scholarship continues to support under and post-graduate women completing degrees in computer science and related areas, recognizing and encouraging the next generation of technical leaders and role models.

This year, we're awarding 62 scholars and finalists in the U.S., 17 in Canada and 91 in Europe, the Middle East and North Africa. In addition to receiving academic scholarships, all of our winners will be invited to participate in all-expenses-paid networking retreats featuring workshops, speakers, panelists, breakout sessions and social activities at Google offices. See below for a full list of winners and the institution they currently attend.

In the coming months, we’ll be announcing winners for the Australia and New Zealand Scholarships. And we’ve introduced some other big changes for 2010: for the first time, we’re awarding Anita Borg Scholarships to students in Sub-Saharan Africa and to high school seniors in the U.S. Later this year, we plan to introduce the first-ever Anita Borg Scholarship in Asia.

For more information on the Anita Borg Memorial Scholarship and other Google scholarship opportunities, visit our scholarships page.

Congratulations, 2010 Scholars and Finalists!

U.S. Scholars

Aditi Goyal, Stanford University
Adrienne Felt, University of California-Berkeley
Angela Oguna, University of Kansas Main Campus
Anna Molosky, Carnegie Mellon University*
Bonnie Kirkpatrick, University of California-Berkeley
Boya Xie, East Carolina University
Carla Villoria, Texas A & M University
Carrine Johnson, Massachusetts Institute of Technology*
Daniela Rosner, University of California-Berkeley
Erika DeBenedictis, California Institute of Technology*
Fan Zhang, Massachusetts Institute of Technology
Floraine Grabler, University of California-Berkeley
Jill Woelfer, University of Washington
Karthika Periyathambi, Stanford University
Kristi Morton, University of Washington
Kyle Rector, Oregon State University
Lauren Stephens, Massachusetts Institute of Technology*
Lydia Chilton, University of Washington
Madeline Smith, Ithaca College
Maithilee Kunda, Georgia Institute of Technology
Micol Marchetti-Bowick, Stanford University
Moira Burke, Carnegie Mellon University
Nalini Vasudevan, Columbia University in the City of New York
Natasha Nesiba, New Mexico State University*
Samantha Ainsley, Columbia University in the City of New York
Sheri Williamson, George Mason University
Shilpa Nadimpalli, Tufts University
Sneha Popley, Texas Christian University
Svitlana Volkova, Kansas State University
Therese Avitabile, Brown University
Valeria Fedyk, Stanford University*
Victoria Nneji, Columbia University in the City of New York*

*High school senior — planned matriculation at university listed

U.S. Finalists

Adriana Lopez, New York University
Anne Neilsen, University of Nebraska - Lincoln
Cassandra Helms, Colorado State University
Christina Brandt, Cornell University
Emily Shen, Massachusetts Institute of Technology
Esha Nerurkar, University of Minnesota-Twin Cities
Farzana Rahman, Marquette University
Jana Zujovic, Northwestern University
Jessie Li, Massachusetts Institute of Technology
Juliet Bernstein, University of Washington
Lirida Kercelli, Carnegie Mellon University
Marayam Ramezani, DePaul University
Maryam Aziz, Montclair State University
Michal Rabani, Massachusetts Institute of Technology
Michelle Burroughs, Carnegie Mellon University
Minlan Yu, Princeton University
Miray Kas, Carnegie Mellon University
Natalie Yudin, Rice University
Pallavi Yerramilli, University of Pennsylvania
Rachael Harding, Carnegie Mellon University
Rachelle Fuhrer, University of California, San Diego
Razieh Nokhbeh Zaeem, University of Texas at Austin
Riddhi Mittal, Stanford University
Sanjana Prasain, University of Washington
Sonia Haiduc, Wayne State University
Wei Chen, Carnegie Mellon University
Yang Shan, Carnegie Mellon University
Yi Gu, University of Memphis
Yinian Qi, Purdue University Main Campus
Zeinab Abbassi, Columbia University in the City of New York

Canada Scholars

Allaa Hilal, University Of Waterloo
Barbara Macdonald, University Of Waterloo
Dana Jansens, Carleton University
Ioana Burcea, University Of Toronto
Michelle Annett, University Of Alberta

Canada Finalists

Audrey Corbeil Therrien, University Of Sherbrooke
Constance Adsett, Dalhousie University
Inmar Givoni, University Of Toronto
Jasmina Vasiljevic, Ryerson University
Jennifer Woodcock, University Of Victoria
Jignasa Shah, Dalhousie University
Margareta Ackerman, University Of Waterloo
Nazish Bhatti, Concordia University
Phillipa Gill, University Of Toronto
Rachel Zhang, Queen's University
Veronica Irvine, University Of Victoria
Yanyan Zhuang, University Of Victoria

Europe, Middle East and Africa Scholars

Adi Shklarsh, Tel Aviv University, Israel
Alexandra Jimborean, Université Louis Pasteur Strasbourg, France
Andrea Francke, Swiss Federal Institute of Technology Zurich, Switzerland
Arlette van Wissen, Vrije Universiteit Amsterdam, The Netherlands
Birgit Schmidt, Graz University of Technology, Austria
Christina Pöpper, Swiss Federal Institute of Technology Zurich, Switzerland
Christine Zarges, Technische Universität Dortmund, Germany
Ekaterina Shutova, University of Cambridge, United Kingdom
Elena Tretyak, Lomonosov Moscow State University, Russia
Estrella Eisenberg, Bar-Ilan University, Israel
Hilary Finucane, Weizmann Institute of Science, Israel
Hind Saddiki, Al Akhawayn University, Morocco
Irina Makhalova, Moscow Institute of Electronic Technology, Russia
Katayoun Farrahi, Ecole Polytechnique Fédérale de Lausanne, Switzerland
Lavinia Basaraba, Politehnica University of Timisoara, Romania
Limor Leibovich, Technion - Israel Institute of Technology, Israel
Maria Francesca O' Connor, Trinity College Dublin, Ireland
Maria-Camilla Fiazza, University of Verona, Italy
Melanie Ganz, University of Copenhagen, Denmark
Monika Schubert, Graz University of Technology, Austria
Nina Kargapolova, Novosibirsk State University, Russia
Ntombikayise Banda, University of Cambridge, United Kingdom
Nuzhah Gooda Sahib, Queen Mary, University of London, United Kingdom
Oana Tifrea, Free University of Bozen · Bolzano, Italy
Pinar Yanardag, Bogazici University, Turkey
Ruzica Piskac, Ecole Polytechnique Fédérale de Lausanne, Switzerland
Samreen Anjum, Carnegie Mellon University in Qatar, Qatar
Silvian Gitau, University of Cape Town, South Africa
Sinini Ncube, Rhodes University, South Africa
Sus Lundgren, Chalmers University of Technology, Sweden
Susanne Pfeifer, University of Oxford, United Kingdom
Tatiana Starikovskaya, Lomonosov Moscow State University, Russia
Yael Amsterdamer, Tel Aviv University, Israel

Europe, Middle East and Africa Finalists

Afsaneh Asaei, Ecole Polytechnique Fédérale de Lausanne, Switzerland
Aia Hassouneh, Birzeit University, Palestinian Territories
Alissa Cooper, University of Oxford, United Kingdom
Anastasia Tkach, Bauman Moscow State Technical University, Russia
Anastasia Shakhshneyder, Technische Universität München, Germany
Anna Astrakova, Novosibirsk State University, Russia
Anna Dehof, Saarland University, Germany
Anna Zych, Swiss Federal Institute of Technology Zurich, Switzerland
Annemarie Friedrich, Saarland University, Germany
Archana Nottamkandath, Vrije Universiteit Amsterdam, The Netherlands
Charlotte Ipema, Delft University of Technology, The Netherlands
Ching-Yun Chang, University of Cambridge, United Kingdom
Claudia Rosas Mendoza, Universitat Autònoma de Barcelona, Spain
Claudia Schon, University of Koblenz-Landau, Germany
Efrat Mashiach, Tel Aviv University, Israel
Elzbieta Dlutowska, University of Wrocław, Poland
Eman AbdelSalam, Alexandria University, Egypt
Eva Darulova, Ecole Polytechnique Fédérale de Lausanne, Switzerland
Floor Sietsma, University of Amsterdam, The Netherlands
Grace Mbipom, University of Manchester, United Kingdom
Hildegard Kuehne, Karlsruhe Institute of Technology, Germany
Ifeanyichukwu Ekeruche, Kwame Nkrumah University of Science and Technology, Ghana
Ioana Verebi, Politehnica University of Timisoara, Romania
Ivonne Thomas, Hasso Plattner Institute, Germany
Janneke van der Zwaan, Delft University of Technology, The Netherlands
Julia Preusse, University of Magdeburg, Germany
Julie Rico, University of Glasgow, United Kingdom
Karolina Soltys, University of Warsaw, Poland
Laura Zilles, Technische Universität Kaiserslautern, Germany
Lene Mejlby, Aarhus University, Denmark
Lina AL Kanj, American University of Beirut, Lebanon
Lucy Gunawan, Delft University of Technology, The Netherlands
Maria Mateescu, Ecole Polytechnique Fédérale de Lausanne, Switzerland
Maria Karoliina Lehtinen, University of Cambridge, United Kingdom
Marije de Heus, University of Twente, The Netherlands
Marleine Daoud, University of Stuttgart, Germany
Mary Baraza, Busoga University, Uganda
Maysa Nouh, Birzeit University, Palestinian Territories
Meyyar Palaniappan, Technische Universität München, Germany
Min Bao, Linköping University, Sweden
Mounira Bachir, Université de Versailles Saint-Quentin-en-Yvelines, France
Naama Tepper, Technion - Israel Institute of Technology, Israel
Nga Nguyen, University of Amsterdam, The Netherlands
Nino Shervashidze, Max Planck Institute for Biological Cybernetics, Germany
Olga Streibel, Free University of Berlin, Germany
Reem Mostafa, Alexandria University, Egypt
Rehab Alnemr, Hasso Plattner Institute, Germany
Rikke Bendlin, Aarhus University, Denmark
Ruth Rinott, Hebrew University of Jerusalem, Israel
Sarah Greenfield, De Montfort University, United Kingdom
Sarah Niebe, University of Copenhagen, Denmark
Saskia Groenewegen, Utrecht University, The Netherlands
Sophia Wadie, American University in Cairo, Egypt
Svetlana Olonetsky, Tel Aviv University, Israel
Sylvia Grüener, Technische Universität Darmstadt, Germany
Tamar Aizikowitz, Technion - Israel Institute of Technology, Israel
Viviana Petrescu, Swiss Federal Institute of Technology Zurich, Switzerland
Zsuzsanna Püspöki, Budapest University of Technology and Economics, Hungary

Minggu, 02 Mei 2010

You and site performance, sitting in a tree...

Webmaster Level: Beginner to Intermediate

...k, i, s, s, i, n, g! Perhaps you heard our announcement that speed is a signal in rankings, but didn’t know where to start. We’d like to help foster a lasting relationship between you and a responsive experience for your users. Last week I filmed my updated presentation from "The Need For Speed: Google Says It Matters" which includes three first steps to understanding site performance. So grab headphones and some popcorn, then verify ownership of your website and download a plugin, and we’ll all be comfy with site performance in no time.



Just curious about the Q&A? No problem! Here you go:

Is it possible to check my server response time from different areas around the world?
Yes. WebPagetest.org can test performance from the United States (both East and West Coast—go West Coast! :), United Kingdom, China, and New Zealand.
What's a good response time to aim for?
First, if your competition is fast, they may provide a better user experience than your site for your same audience. In that case, you may want to make your site better, stronger, faster...

Otherwise, studies by Akamai claim 2 seconds as the threshold for ecommerce site "acceptability." Just as an FYI, at Google we aim for under a half-second.
Does progressive rendering help users?
Definitely! Progressive rendering is when a browser can display content as it’s available incrementally rather than waiting for all the content to display at once. This provides users faster visual feedback and helps them feel more in control. Bing experimented with progressive rendering by sending users their visual header (like the logo and searchbox) quickly, then the results/ads once they were available. Bing found a 0.7% increase in satisfaction with progressive rendering. They commented that this improvement compared with full feature rollout.

How can you implement progressive rendering techniques on your site? Put stylesheets at the top of the page. This allows a browser to start displaying content ASAP.

Page speed plugin, videos, articles, and help forum are all found at code.google.com/speed/.

Sabtu, 01 Mei 2010

This week in search 5/1/10

This is one of a regular series of posts on search experience updates. Look for the label This week in search and subscribe to the series. - Ed.

This week we announced a number of new search enhancements:

Brand refinements in search results
Sometimes when searching for product information on Google, you may not know some of the brand names relevant to your particular search. For example, if you're taking on a new river-rafting hobby, it's quite likely you don't have a clue about kayak manufacturers just yet. So, we wanted to make it easier for you to find the brands other people consider useful for popular product searches. So this week we launched a search refinement that calls out brand names related to your query in a single line above the rest of the results. Determined algorithmically, these highlighted brand names may help you find what you're looking for faster, and make your research and shopping experience all the more enjoyable.

Example searches: [wedding dress], [digital camera] and [stroller]

Virtual keyboards in Google search
Typing a search query on a keyboard that is not designed for your language can be a challenging (if not impossible) process. To help overcome any difficulty you might face when using Google search in another language, starting this week you'll see a small keyboard icon next to the search field on both the Google homepage and on the search results page when using Google in one of 35 foreign languages. Check out our announcement, which includes all of the languages currently supported. We hope that this new feature will make your search experience much better!

Example keyboard search in Greek: [flowers]

"Similar" pages on results page
Here's a new feature that makes it easier to discover the variety of choices available on the web. We've offered the "Similar" link on search results for a while now as a way to find new websites similar to ones you already use and like, but it hasn't been too visible. Now, for queries where we think sites similar to the first search result might be helpful, a small block of similar sites will appear at the bottom of the results page. Clicking on the "Pages similar to" link at the start of the block will take you to the full list of similar pages.


More example searches: [american lung association], [tobacco-free kids], [earthquake info center]

New Image Search for iPhone and Android devices
When searching for images on your mobile device, speed and quantity of the images are important parts of a good experience. So we've introduced a redesigned Google Image Search for mobile, based on iPhone 3.0+ and Android 2.1 devices that makes it easier for you to see as many images as possible when searching on your mobile phone. Now, the thumbnails are square to maximize the number of images you see on the screen. In addition, you can swipe to see the next or previous page of results. And for when you want to see a larger version of an image, we've introduced a special image viewing page with black background that both emphasizes the image and includes fading buttons. We hope you enjoy!

Visit google.com on your iPhone or Android device and tap on "Images" for these examples: [mount rushmore] or [lady gaga]

Mobile Place Pages
We launched Place Pages last fall to help provide relevant and informative information about places on Google Maps. We've now optimized that same experience for Android-powered devices and iPhones in the U.S., so when you're on the go, you'll be able to quickly view location information, customer ratings, hours of operation and summarized restaurant reviews. You can also get full-screen, dynamic maps to quickly help you see where the restaurant is within the neighborhood you're in.

Stay tuned for next week's post on the latest releases, enhancements and news about search.