It can be installed either locally or on your webserver.

The easiest place to install Skipfish is on Linux, so I’ll go over installing it on Ubuntu.

Requirements for Skipfish

You need the following software installed in order to install Skipfish:

• GNU C Compiler
• GNU Make
• GNU C Library (including development headers)
• zlib (including development headers)
• OpenSSL (including development headers)
• libidn (including development headers)

The first three are installed by default on Ubuntu. In case they’re not install them with this command in a terminal:

sudo apt-get install gcc make libc6 libc6-dev

To install the last three requirements, enter this command:

sudo apt-get install libssl-dev zlib1g-dev libidn11

Building Skipfish

Download Skipfish

Download the latest version of Skipfish from here:
http://code.google.com/p/skipfish/downloads/list

The current version (as of this writing) was 1.27b [LINK].

Save the file someplace, and then either right-click on it in the file manager and choose “Extract here“.

Or go to the directory where you saved it and enter this:

tar xzf skipfish-1.27b.tgz

Setting Paths

You may or may not need this step, but this will set the paths for header files and library files:

export CFLAGS="-I/usr/include/"
export LDFLAGS="-L/usr/lib/ssl/engines -L/usr/lib/ -L/usr/lib/ssl/"

Compiling Skipfish

Next, compile Skipfish. Enter the directory that was extracted earlier, and use “make” to start the build process:

cd skipfish
nice make

Note: nice prevents make from monopolizing your system’s CPU.

Here’s the result:

cc -L/usr/lib/ssl/engines -L/usr/lib/ -L/usr/lib/ssl/ -L/usr/local/lib/ -L/opt/local/lib skipfish.c -o skipfish -O3 -Wno-format -Wall -funsigned-char -g -ggdb -I/usr/local/include/ -I/opt/local/include/ -I/usr/include/ -D_FORTIFY_SOURCE=0 \
	      http_client.c database.c crawler.c analysis.c report.c -lcrypto -lssl -lidn -lz
 
See dictionaries/README-FIRST to pick a dictionary for the tool.
 
Having problems with your scans? Be sure to visit:
http://code.google.com/p/skipfish/wiki/KnownIssues

After you do this, there should be an executable file named “skipfish” in the current directory. If not, or if there was an error, you probably are missing a requirement or a path is incorrectly specified.

Using Skipfish

This is just a basic introduction.

In the “skipfish” directory, enter these commands:

touch dictionaries/empty.wl
ln -s dictionaries/empty.wl skipfish.wl
mkdir ../out
./skipfish -o ../out/ http://example.com

This creates a blank wordlist file, and an output directory, and then launches Skipfish to scan the specified webserver. (Replace example.com with your webserver address. Make sure you have permission to scan that address.)

Hit Ctrl+c to stop the scan.

Then view the result with Firefox (not Safari or Chrome):

firefox ../out/index.html

I’ll have a separate post on using Skipfish, along with screenshots.

Resources

Google Skipfish
Skipfish FAQ

Top Incoming Search Terms

Related posts:

1. Google Releases Skipfish Automatic Website Security Scanning Tool
2. How to Install Google Chromium on Ubuntu
3. How to Rename Files as Lowercase in Ubuntu Linux Recursively

About Skipfish

Skipfish is implemented as a program that you run locally (from your personal computer) or on the same server as a website or WordPress or other blog. It saves output in a directory you specify in HTML format (sample below).

If you’re wondering why Google would release a security scanner for free, Google has in interest in a secure and non-exploited Internet. If, every time you go online, your computer is hacked, you’re less likely to go online. The less you go online, the less Google searches you do, the less ads you click on, and the less money Google gets.

Skipfish is similar to other security scanning programs like Nikto and Nessus. But it also has some advantages such as:

• High Performance. You can run 500+ requests per second over the Internet, 2000+ requests over a LAN, and 7000+ requests on the same server as a website.
• Ease of Use. Skipfish is flexible and it handles weird URL schemes and even comes up with automatically generated password guesses based on site content.
• Fine security checks. Skipfish detects subtle problems like cross-site scripting, but it also identifies and avoids false positives.

Major security holes that Skipfish finds include

• Server-side SQL injection (including blind vectors, numerical parameters).
• Explicit SQL-like syntax in GET or POST parameters.
• Server-side shell command injection (including blind vectors).
• Server-side XML / XPath injection (including blind vectors).
• Format string vulnerabilities.
• Integer overflow vulnerabilities.

And there are other minor problems that it finds as well.

Running Skipfish

Skipfish is written in C, and you probably need to compile it before you run it. I’ll have another blog post later on preparing and running Skipfish.

Skipfish is hosted at Google Code here: http://code.google.com/p/skipfish/

Top Incoming Search Terms

Related posts:

1. How to Install Google Skipfish on Ubuntu Linux
2. Google Buys Picnik, a Free Online Photo Editing Website
3. Google Releases Its Nexus One Phone, But It’s Not an iPhone Killer

Hitwise blogged that the weekly market share of visits was 7.07% for Facebook and 7.03% for Google in the week ending March 13.

A loss for the open Internet

My opinion is that this represents a loss for the open Internet.

Although there are legitimate concerns about data privacy and some other concerns in regards to Google, in comparison to Facebook, Google looks like an angel.

Origins

Origins are important because the founders set the tone for the entire rest of the company as they hire people and pass on a corporate culture.

Compare the origin stories for the two Web giants: Google was born as a kind of cool and nerdy experiment. Larry Page and Sergey Brin started Google as part of a Ph.D. research project. For the longest time, there were no ads at all on Google.

Facebook, on the other hand, was conceived in sin. I blogged before on Facebook’s dubious origins. It’s alleged that Mark Zuckerberg stole the idea for Facebook while he was contracted by another group of Harvard students to create a Facebook-like site, all the while stringing the other group along making them believe progress was being made on their site. Money was foremost on Zuckerberg’s mind while he allegedly went to the extent of hacking competitors’ site to enhance his own.

The World Wide Web

Google is all about the World Wide Web, created in the early 1990s by Tim Berners-Lee as a connected group of hyperlinked pages and sites. The main focus of Google has always been to give you a search result for a web page and send you on your way to exploring the Web, hopping from one link to another.

Facebook, though, is a walled garden. Once you get on the site, you’re supposed stay on it. Even to get in, you need a login. Every page you view, every action you take is logged by the same, single site, instead of multiple sites across the Web.

JavaScript and cookies

You can use much of Google without logging in, including the main focus (searching). You can’t do the first thing on Facebook without logging in. Same for JavaScript, cookies, and so on.

Ads

Google’s the progenitor of nice, reasonable text-mode ads. Although Google has some other kinds of ads as well now, Facebook ads are the definition of obnoxious, and possibly scammy.

What do you think?

Top Incoming Search Terms

Related posts:

1. The Origins of Facebook, Hacked E-mails, and Privacy
2. How to Install Google Skipfish on Ubuntu Linux
3. Google Releases Skipfish Automatic Website Security Scanning Tool

Here’s how to install it on Ubuntu. This works for Karmic Koala 9.10.

The short way with the command line

In the file /etc/apt/sources.list add the following line:

deb http://ppa.launchpad.net/chromium-daily/ppa/ubuntu karmic main

In a terminal, get a key and refresh the repository index:

sudo apt-key adv --recv-keys --keyserver keyserver.ubuntu.com 4E5E17B5
apt-get update

And install Chromium:

apt-get install chromium-browser

Installing Chromium: a walkthrough

Here’s the long version.

Normally, packages in Ubuntu are installed from the main Ubuntu repositories. But there’s also the concept of “Personal Package Archives” for experimental software. To use these, you have to specify PPA information to Ubuntu.

In a terminal, add the keys for the Chromium PPA:

sudo apt-key adv --recv-keys --keyserver keyserver.ubuntu.com 4E5E17B5

Here’s the output:

Open up System > Administration > Synaptic Package Manager. Then, in Synaptic, choose Settings > Repositories.

Click on the “Other Software” tab and then click “Add”:

Enter the following into the dialog:

deb http://ppa.launchpad.net/chromium-daily/ppa/ubuntu karmic main

When you click on “Add Source”, a new repository is added which will pull in Chromium updates:

Synaptic will tell you you need to reload package information:

Click on the Reload button in the upper left-hand corner of Synaptic. Synaptic will reload package information:

After that’s done, enter “chromium” in the Quick Search box, right-click on Chromium Browser, and and select “Mark for Installation”:

Synaptic prompts you to mark additional required packages for installation. Choose Apply:

Note: don’t choose the “chromium” package. That’s actually an old Linux-based game:

Click on Apply in the toolbar in Synaptic. Verify your choice in the Summary dialog:

Synaptic downloads the package files:

And installs them:

The changes are applied:

To run Chromium, choose “Chromium Web Browser” from the Internet menu in Applications:

These instructions are for adding the daily builds PPA for Chromium, meaning that you’ll get updates for it every day if you want. For me, the version I’m running is fine, so I don’t click on the Update button when Update Manager shows up.

Top Incoming Search Terms

Related posts:

1. How to Install Google Skipfish on Ubuntu Linux
2. Creating a Database in MySQL with MySQL Query Browser on Ubuntu Linux
3. Google Releases Skipfish Automatic Website Security Scanning Tool

Picnik has grown to become one of the most popular web-based photo editing sites.

It had a few hundred thousand visitors in January of 2007, and it grew to six million in January 2009.

Google announced that no changes will be made to Picnik for the time being, but the Picnik blog announced that they look forward to the next stage of enhancements to the service. Interestingly, Piknik is the default tool used for editing photos to be uploaded to Flickr (owned by Yahoo). Google says Yahoo (and other sites) can continue to integrate with Picknic.

My Comments

Google has taken some acquisitions (like Writely) and incorporated them into Google Docs. Others like Jaiku have festered. Only time will tell if Google is going to let Picnik wither or if it’ll be merged with Picassa.

Top Incoming Search Terms

Related posts:

1. Google Releases Skipfish Automatic Website Security Scanning Tool
2. How to Install Google Skipfish on Ubuntu Linux
3. OpenOffice extension offers PDF editing

Extensions

You can now install any of the Google Chrome extensions. One that I find handy is FlashBlock.

Bookmark sync

You can synchronize your browser bookmarks among the different computers you use. This works with Google Chrome for Mac, Linux, and Windows.

Task Manager

Sometimes certain web pages make your browser hang. In Google Chrome, that only affects a single tab. You can use the Task Manager to kill specific tabs that are hanging.

Download Google Chrome

Download Chrome for the Mac here.

Top Incoming Search Terms

Related posts:

1. How to Install Google Skipfish on Ubuntu Linux
2. Google Chrome Browser Third Place Behind Internet Explorer and Firefox
3. Firefox and Chrome Complicate Mozilla and Google Ties

They’re going to price their broadband service competitively to what other companies are charging.

I say it’s about time.

Google is launching the service to jumpstart new, high-speed Internet technologies. They’ll share what they learn in these trials with other companies to help increase Internet speeds generally.

It hasn’t decided where the service will be launched.

• The networks will be open access, meaning the network infrastructure will be shared with other access providers.
• They’ll provide service to anywhere from 50,000 to a half-million subscribers.
• The trials will occur in one or more US municipalities which Google determines would be a good fit.

How fast is 1Gbps?

1 Gigabyte per second is:

• 134,217,728 bytes per second
• 131,072 MB per second
• 7.86 GB per minute

Obviously, this is fast enough to download a high-definition movie in minutes, or a standard-definition movie in seconds. There are a lot of videoconferencing, medical, gaming, educational, and other applications you could imagine being made possible with this speed.

Request for information

Google has a web page that describes what they are doing.

It’s requesting information from cities, counties, military bases, etc., which would be interested in participating in the program.

Even if your city doesn’t send an application in, you can nominate your locality as an individual.

My comments

Although it’s hard to believe that a corporation would be doing something like this out of the goodness of their own hearts, Google actually has an interest in high-speed Internet:

• The faster the Internet experience is, the more compelling it is.
• The more compelling the Internet is, the more time people spend online.
• The more time people spend online, the more time they are likely to be on Google, or on a site that has Google ads.
• Hence, the more money Google makes.

Textual vs. audiovisual Internet

A lower speed Internet lends itself to a textual world-wide web. When speeds increased, the use of images on the web increased. When we moved to DSL and broadband, in came videos. Even higher speeds (1 gigabit per second) would mean the possibility of an even more multimedia-based Internet.

But how can this be good for Google, which has traditionally leveraged its parsing of web page text in order to be able to serve ads?

I think the answer is in some key audio-to-text technologies which Google has recently rolled out:

• Automatic subtitles for YouTube
• Textual voicemail for Google Nexus and Android cell phones

Since Google now has the ability to parse spoken words, it’s not afraid of audiovisual elements in the web for serving relevant advertisements. In fact a really cool thing that they could do is show different ads as a speaker changes subjects.

Network neutrality

There’s also the factor that Google’s been fighting ISPs who are content producers (Time/AOL) or are otherwise jerks (AT&T) which are limiting the already pathetic speeds that they deign to give to American Internet consumers. AT&T’s head actually said he’d like Google to pay for the access that he gives Google to consumers.

This represents a sort of end-run around those ISPs. Google will make its own Internet.

Here’s a case where Google’s interests align with common man’s. Hooray for Google in this instance.

Resources

Google Fiber for Communities

Ars Technica article

Slashdot discussion

Top Incoming Search Terms

Related posts:

1. How to Install Google Skipfish on Ubuntu Linux
2. Google Releases Skipfish Automatic Website Security Scanning Tool
3. Obama Proposes $44 Billion Universal Broadband Plan

Videos that will be filtered in the new Safety Mode include:

• Videos with a sexual theme meant for mature viewers
• News videos featuring violence

Turning on Safety Mode

There’s a link to turn on Safety Mode at the bottom of every YouTube page.

You can lock Safety Mode on by logging in, and then turning Safety Mode on (which, again, is at the bottom of every page).

The setting is browser-specific, and also profile-specific. So if you (or other users) use multiple browsers, you have to set Safety Mode to “on” in every browser. It doesn’t matter if the person using the browser is logged in or not; Safety Mode will stay on until you log in with your password and turn it off.

Using Safety Mode

If you have Safety Mode on,

• Search results won’t feature objectionable content, though the fact that results were filtered will be noted.
• Comments aren’t shown by default.
• If you show comments, objectionable words are replaced with asterisks.
• You won’t be able to see filtered videos a friend sends you until Safety Mode is turned off.

My comments

Google’s recently been increasing the amount of advertising on YouTube. It looks like Google is creating a safe for work atmosphere which is also a safe for advertising environment.

Resources

Google announcement of Safety Mode
Google Help on YouTube Safety Mode
http://digital.venturebeat.com/
http://financegeek.com/
http://techcrunch.com/
http://googland.blogspot.com/

Top Incoming Search Terms

Related posts:

1. How to Install Google Skipfish on Ubuntu Linux
2. Google Releases Skipfish Automatic Website Security Scanning Tool
3. Google Adds Favicons to Google Webmaster Tools

Not anymore.

Google announced in a blog post that new software update for the Nexus One will include multi-touch.

What Is Multi-Touch?

Just a short reminder for people who don’t have iPhones or other devices with multi-touch: A touchscreen is a screen you touch to operate it. Multi-touch extends the concept by operating in a different manner if you touch the screen again when you already have your finger down in another part of the screen. For example, to zoom in on an iPhone, you use a pinching movement with your finger and thumb, bringing them closer together.

Without multi-touch, Nexus One users would double-tap to zoom in. Double-tap is fine, but it doesn’t give you control over the amount of zoom, like a mouse scroll wheel would.

Multi-touch on Android

Google says multi-touch is part of Android 2.0, and it’s up to carriers or manufacturers to update their users’ phones.

Nexus One users will receive an automatic over-the-air (OTA) update which will give them multi-touch as well as the following other features:

Google Goggles: Search for stuff close to where you are by sending Google a picture of your whereabouts.
Google Maps: Night mode for easier viewing, among other changes.
3G: Fixes 3G connectivity problems.

Google, Apple, and multi-touch

Multi-touch has been touted as one of the hallmark features of the iPhone.

Now that Google NexusOne and Android have it as well, is there anything the iPhone has that Android doesn’t?

And what will Apple do about it?

It’s rumoured that, up until now, Google hadn’t implemented multi-touch simply because it had a cordial relationship with Apple. But with the two companies coming to virtual blows over their business ventures, it seems Google doesn’t really have any reason to stay on Apple’s good side.

Also, the Palm Pre and Microsoft’s new Zune are using multi-touch so either we’re going to see the end of Apple’s multi-touch exclusivity or a lot of lawsuits.

So, is multitouch on Android enough to tip the balance against the iPhone for your next phone purchase?

Resources

Google blog post on multi-touch
http://www.techcrunch.com/2010/02/02/nexus-one-multi-touch
http://www.techcrunch.com/2010/02/02/apple-google-multi-touch-android

Top Incoming Search Terms

Related posts:

1. Google Releases Its Nexus One Phone, But It’s Not an iPhone Killer
2. How to Install Google Skipfish on Ubuntu Linux
3. Google Releases Skipfish Automatic Website Security Scanning Tool

A number of blogs are reporting on pictures of Google’s tablet (still under development) posted at the Chromium dev site.

One big difference between the Apple iPad (and iPhone) and Google’s Android and Tablet is that with Google, you can run multiple programs at once. So you need a UI to switch programs, and Google came up with dragging windows:

Google is said to be working with HTC, who made Google’s Nexus One cell phone, to create the Google Tablet.

Google Tablet: Full Keyboard

Google Tablet: Split Keyboard

Google Tablet: Keyboard Anchored to Side

Google Tablet: Context Menu

Google Tablet: Switching Programs

Google Tablet: Dragging WIndows

Resources

Google Tablet: Google and HTC To Launch Apple iSlate Rival [RUMOR]
A First Taste Of What The Google Tablet’s Interface Will Look Like
Google Shows Off its Tablet Concept
Chromium tablet concepts
Google Tablet YouTube
NeoWin: Google’s tablet UI concept pictures
Smarthouse: HTC To Launch Apple iSlate Competitor
Register: Google chisels Chrome OS tablet, rumors say
Washington post article

Top Incoming Search Terms

Related posts:

1. Apple Reveals the iPad Tablet: A Coverage Roundup
2. How to Install Google Skipfish on Ubuntu Linux
3. Google Releases Skipfish Automatic Website Security Scanning Tool