Security Blog
The latest news and insights from Google on security and safety on the Internet
Extending SSL to Google search
21 мая 2010 г.
Posted by Murali Viswanathan, Product Manager
Google understands the potential risks of browsing the web on an unsecured network, particularly when information is sent over the wire unencrypted — as it is for most major websites today. That’s why we offered SSL support for Gmail back when we launched the product in 2004. Most other webmail providers don’t provide this feature even today. We’ve since added SSL support for Calendar, Docs, Sites, and several other products. Additionally, early this year we made SSL the
default setting
for all Gmail users.
As we work to provide more support for SSL across our products, today we’re introducing the ability to search with Google over SSL. We still have some testing to do, but you can try out the new encrypted version of Google search at
https://www.google.com
and read more about it on the
Official Google Blog
.
Do Know Evil: web application vulnerabilities
4 мая 2010 г.
Posted by Bruce Leban, Software Engineer
UPDATE July 13: We have changed the name of the codelab application to Gruyere. The codelab is now located at
http://google-gruyere.appspot.com
.
We want Google employees to have a firm understanding of the threats our services face, as well as how to help protect against those threats. We work toward these goals in a variety of ways, including security training for new engineers, technical presentations about security, and other types of documentation. We also use codelabs — interactive programming tutorials that walk participants through specific programming tasks.
One codelab in particular teaches developers about common types of web application vulnerabilities. In the spirit of the thinking that "it takes a hacker to catch a hacker," the codelab also demonstrates how an attacker could exploit such vulnerabilities.
We're releasing this codelab, entitled "Web Application Exploits and Defenses," today in coordination with
Google Code University
and
Google Labs
to help software developers better recognize, fix, and avoid similar flaws in their own applications. The codelab is built around Gruyere, a small yet full-featured microblogging application designed to contain lots of security bugs. The vulnerabilities covered by the lab include cross-site scripting (XSS), cross-site request forgery (XSRF) and cross-site script inclusion (XSSI), as well as client-state manipulation, path traversal and AJAX and configuration vulnerabilities. It also shows how simple bugs can lead to information disclosure, denial-of-service and remote code execution.
The maxim, "given enough eyeballs, all bugs are shallow" is only true if the eyeballs know what to look for. To that end, the security bugs in Gruyere are real bugs — just like those in many other applications. The Gruyere source code is published under a Creative Commons license and is available for use in whitebox hacking exercises or in computer science classes covering security, software engineering or general software development.
To get started, visit
http://google-gruyere.appspot.com
. An instructor's guide for using the codelab is now available on
Google Code University
.
Ярлыки
#sharethemicincyber
#supplychain #security #opensource
android
android security
android tr
app security
big data
biometrics
blackhat
C++
chrome
chrome enterprise
chrome security
connected devices
CTF
diversity
encryption
federated learning
fuzzing
Gboard
google play
google play protect
hacking
interoperability
iot security
kubernetes
linux kernel
memory safety
Open Source
pha family highlights
pixel
privacy
private compute core
Rowhammer
rust
Security
security rewards program
sigstore
spyware
supply chain
targeted spyware
tensor
Titan M2
VDP
vulnerabilities
workshop
Archive
2025
янв.
2024
дек.
нояб.
окт.
сент.
авг.
июл.
июн.
мая
апр.
мар.
февр.
янв.
2023
дек.
нояб.
окт.
сент.
авг.
июл.
июн.
мая
апр.
мар.
февр.
янв.
2022
дек.
нояб.
окт.
сент.
авг.
июл.
июн.
мая
апр.
мар.
февр.
янв.
2021
дек.
нояб.
окт.
сент.
авг.
июл.
июн.
мая
апр.
мар.
февр.
янв.
2020
дек.
нояб.
окт.
сент.
авг.
июл.
июн.
мая
апр.
мар.
февр.
янв.
2019
дек.
нояб.
окт.
сент.
авг.
июл.
июн.
мая
апр.
мар.
февр.
янв.
2018
дек.
нояб.
окт.
сент.
авг.
июл.
июн.
мая
апр.
мар.
февр.
янв.
2017
дек.
нояб.
окт.
сент.
июл.
июн.
мая
апр.
мар.
февр.
янв.
2016
дек.
нояб.
окт.
сент.
авг.
июл.
июн.
мая
апр.
мар.
февр.
янв.
2015
дек.
нояб.
окт.
сент.
авг.
июл.
июн.
мая
апр.
мар.
февр.
янв.
2014
дек.
нояб.
окт.
сент.
авг.
июл.
июн.
апр.
мар.
февр.
янв.
2013
дек.
нояб.
окт.
авг.
июн.
мая
апр.
мар.
февр.
янв.
2012
дек.
сент.
авг.
июн.
мая
апр.
мар.
февр.
янв.
2011
дек.
нояб.
окт.
сент.
авг.
июл.
июн.
мая
апр.
мар.
февр.
2010
нояб.
окт.
сент.
авг.
июл.
мая
апр.
мар.
2009
нояб.
окт.
авг.
июл.
июн.
мар.
2008
дек.
нояб.
окт.
авг.
июл.
мая
февр.
2007
нояб.
окт.
сент.
июл.
июн.
мая
Feed
Follow @google
Follow
Give us feedback in our
Product Forums
.
Follow