How does it work?

We capture images of the articles on our partners’ websites and then display them in an easy-to-read way. The stories are grouped by categories, such as Entertainment, Business, Opinion, Politics and Most Viewed. Readers can flip through stories quickly by simply pressing the left- and right-arrow keys until they find one that catches their interest. Clicking on the story takes them directly to the publisher’s website.

How are the Topics selected? Can I choose my own?
The Topics are generated automatically by rising stories in the news. Users can also search for any subjects they want and basically create their own topics, almost like a custom magazine, on the fly.

How are stories recommended in the Recommended section?
The stories in this section are recommended by users of Google Fast Flip in direct and indirect ways. We take cues from how often they read stories, e-mail stories and register a public vote for stories by clicking on the “Like” button on each article.

Can I recommend stories that I like to other people?
Google Fast Flip allows readers to vote on an article to tell the world they liked it. Clicking on the “Like” button on a story page lodges a public vote for that story, which is one of the factors in whether Fast Flip includes stories the “Recommended” section. At the bottom of the home page, Fast Flip users who are signed in to their Google Account can see which stories friends in their Gmail contact list have “liked.”

How do you personalize results on Google Fast Flip?
We are able to take the cues you give us – such as the stories you read, recommend and e-mail – to present sections, news sources and specific authors tailored specifically to your interests. To enable personalization of the articles you see, you must sign in to your Google Account. You can easily create a Google Account on this page if you don’t already have one.

Is this available for all languages and editions of Google News?
At launch, Google Fast Flip is available on the Google Labs website with English-language content. International users should be able to see this feature in Google Labs.

Does Google Fast Flip work on mobile devices?
At launch, Google Fast Flip will work on iPhone and Android mobile devices. Going forward, we’ll explore rolling out support for other mobile platforms.

Where can I see a full list of the publishers included?
You can see a full list of the sources at http://fastflip.googlelabs.com/sources.

Google usage is more prevalent in certain global markets than others. Two particular markets stand apart from the rest in terms of their dependence on Google: Brazil and India. In July, 29.8 percent of total time spent online in Brazil was spent on Google Sites, with India only slightly lower at 28.9 percent. The next highest global market was Ireland at 15.9 percent.

“It’s interesting that the dynamics of Google usage would be so similar in Brazil and India given that the two markets are on opposite sides of the world and quite different culturally from one another,” said Alex Banks, managing director of comScore Latin America. “As it turns out, there are interesting similarities between Brazil and India as emerging Internet markets. Google’s prevalence in these markets can perhaps best be explained by the fact that the time at which these markets really began to develop and flourish was around the same time that Google was becoming a major player in the search landscape. As a result, Google became the dominant Internet brand in these markets and its success appears to have bled from search into other areas of the web like social networking.”

Google Dominance in Brazil and India

The Google brand has extended to success across most of the categories in which it plays in Brazil and India. In some categories, Google is the only player of consequence, commanding considerably high market shares. For example, in Brazil, Google Sites accounts for 89.5 percent of all searches conducted, while Google Orkut has a dominant position in social networking (96.0 percent of time spent), as does Google Maps in the maps category (70.9 percent of time spent) and Google-owned YouTube in the multimedia category (91.6 percent).

In India, Google Sites accounted for 88.4 percent of all searches conducted, and had commanding share of time spent in social networking with Orkut (68.2 percent), maps with Google Maps (63.9 percent), multimedia with YouTube (82.8 percent). It also commanded slightly less than half of all time spent in the blogs category with Blogger (47.6 percent) and email with Gmail (46.8 percent).

*Search category market share based on share of searches conducted, not share of time spent like the other categories

comScore, Inc. (NASDAQ: SCOR), a leader in measuring the digital world today released a study focusing on Google’s relative dominance in the two emerging Internet markets of India and Brazil. As background, Google Sites ranked as the most visited Internet property worldwide with 854 million unique visitors age 15 and older in July, an increase of 18-percent during the past year. Nearly 75 percent of all Internet users worldwide visited the Google Sites property, which accounted for 9.4 percent of all time spent online. Nearly one out of every ten minutes a person spends online around the world is spent on a Google site.

Google usage is more prevalent in certain global markets than others. Two particular markets stand apart from the rest in terms of their dependence on Google: Brazil and India. In July, 29.8 percent of total time spent online in Brazil was spent on Google Sites, with India only slightly lower at 28.9 percent. The next highest global market was Ireland at 15.9 percent.

“It’s interesting that the dynamics of Google usage would be so similar in Brazil and India given that the two markets are on opposite sides of the world and quite different culturally from one another,” said Alex Banks, managing director of comScore Latin America. “As it turns out, there are interesting similarities between Brazil and India as emerging Internet markets. Google’s prevalence in these markets can perhaps best be explained by the fact that the time at which these markets really began to develop and flourish was around the same time that Google was becoming a major player in the search landscape. As a result, Google became the dominant Internet brand in these markets and its success appears to have bled from search into other areas of the web like social networking.”

Google Dominance in Brazil and India

The Google brand has extended to success across most of the categories in which it plays in Brazil and India. In some categories, Google is the only player of consequence, commanding considerably high market shares. For example, in Brazil, Google Sites accounts for 89.5 percent of all searches conducted, while Google Orkut has a dominant position in social networking (96.0 percent of time spent), as does Google Maps in the maps category (70.9 percent of time spent) and Google-owned YouTube in the multimedia category (91.6 percent).

In India, Google Sites accounted for 88.4 percent of all searches conducted, and had commanding share of time spent in social networking with Orkut (68.2 percent), maps with Google Maps (63.9 percent), multimedia with YouTube (82.8 percent). It also commanded slightly less than half of all time spent in the blogs category with Blogger (47.6 percent) and email with Gmail (46.8 percent).

*Search category market share based on share of searches conducted, not share of time spent like the other categories

lThere are more addresses than there are people on Earth. The current global population stands at more than 6.7 billion.
lThere are about 150 web addresses per person in the world.
lIf you spent just one minute reading every website in existence, you’d be kept busy for 31,000 years. Without any sleep

One of the post by John ,

” We’ve made a few changes to the way Digg links to external sites that may impact some folks in the SEO community. These changes reduce the incentive to post spammy content (or link spam) to Digg, while still flowing ’search engine juice’ freely to quality content. We’ve added rel=”nofollow”to any external link that we’re not sure we can vouch for. This includes all external links from comments, user profiles and story pages below a certain threshold of popularity.

This work was done in consultation with leading experts from the SEO/SEM and link spam fields, in an effort to lookout for the interests of content providers and the Digg community. As always, we will closely monitor these changes in the wild and iterate based on feedback “

internet company.

Google said the problems started early in the morning and were not resolved until approximately 2330 GMT.

The problem prevented users from accessing Google email and stymied customers who use the popular software to sync their information with the Microsoft Outlook email programme.

In Google’s Gmail forum, users claiming to be in Italy, Germany, France and Taiwan, along with users from various states in the US, reported being unable to access Gmail.

The snafu increased concerns about the safety and integrity of online data as more computer users migrate to using popular internet services offered by the likes of Google, Facebook and Microsoft.

Google is the third-most popular online email service in the US after Yahoo and Microsoft’s Hotmail. The service suffered outages in February and previously in April, August and October 2008.

Europe Accounts for Most Searches, but Latin America Highest in Searches per Searcher

The dynamics of search behavior vary considerably across different parts of the world. Among the five global regions, Europe accounted for the highest share of searches at 32.1 percent, followed by Asia Pacific (30.8 percent) and North America (22.1 percent). Notably, Latin America exhibited the heaviest search behavior per person with an average of 13 search usage days in July and 130 searches per searcher. Europe had the second highest overall search volume per person (117 searches per searcher) while North America exhibited the second heaviest frequency (12.5 search usage days per searcher).

Coming to the point now…

The web has become one of the primary ways people interact with their computers, connecting people with a diverse landscape of content, services, and applications. users can find new and interesting content on the Web easily, but this presents a security challenge: malicious Web site operators can attack users through their Web browsers. Browsers face the challenge of keeping their users safe while providing a rich platform for Web applications.

Browsers are an appealing target for attackers because they have a large and complex trusted computing base with a wide network-visible interface. Historically, every browser at some point has contained a bug that let a malicious Web site operator circumvent the browser’s security policy and compromise the user’s computer. Even after these vulnerabilities are patched, many users continue to run older, vulnerable versions.5 When these users visit malicious Web sites, they run the risk of having their computers compromised.

Generally speaking, the danger posed to users comes from three factors, and browser vendors can help keep their users safe by addressing each of these factors:

* The severity of vulnerabilities. By sandboxing their rendering engine, browsers can reduce the severity of vulnerabilities. Sandboxes limit the damage that can be caused by an attacker who exploits a vulnerability in the rendering engine.
* The window of vulnerability. Browsers can reduce this window by improving the user experience for installing browser updates, thus minimizing the number of users running old versions that lack security patches.
* The frequency of exposure. By warning users before they visit known malicious sites, browsers can reduce the frequency with which users interact with malicious content.

Each of these mitigations, on its own, improves security. Taken together, the benefits multiply and help keep users safe on today’s Web.

In this article, we discuss how our team used these techniques to improve security in Google Chrome. We hope our firsthand experience will shed light on key security issues relevant to all browser developers.

Reducing Vulnerability Severity

In an ideal world, all software, including browsers, would be bug-free and lack exploitable vulnerabilities. Unfortunately, every large piece of software contains bugs. Given this reality, we can hope to reduce the severity of vulnerabilities by isolating a browser’s complex components and reducing their privileges.

Google Chrome incorporates several layers of defenses to protect the user from bugs, as shown in Figure 1. Web content itself is run within a JavaScript virtual machine, which acts as one form of a sandbox and protects different Web sites from each other. We use exploit barriers, such as address-space layout randomization, to make it more difficult to exploit vulnerabilities in the JavaScript sandbox. We then use a sandbox at the operating-system level to limit the process itself from causing damage, even if exploits escape the earlier security mechanisms. Here, we discuss in more detail how these layers of defense are used.

Security Architecture. Google Chrome uses a modular architecture that places the complex rendering engine in a low-privilege sandbox, which we discuss in depth in a separate report.1 Google Chrome has two major components that run in different operating-system processes: a high-privilege browser kernel and a low-privilege rendering engine. The browser kernel acts with the user’s authority and is responsible for drawing the user interface, storing the cookie and history databases, and providing network access. The rendering engine acts on behalf of the Web principal and is not trusted to interact with the user’s file system. The rendering engine parses HTML, executes JavaScript, decodes images, paints to an off-screen buffer, and performs other tasks necessary for rendering Web pages.

To mitigate vulnerabilities in the rendering engine, Google Chrome runs rendering-engine processes inside a restrictive operating-system-level sandbox (see Figure 1). The sandbox aims to prevent the rendering engine from interacting with other processes and the user’s operating system, except by exchanging messages with the browser kernel via an IPC channel. All HTTP traffic, rendered pages, and user input events are exchanged via such messages.

To prevent the rendering engine from interacting with the operating system directly, our Windows implementation of the sandbox runs with a restricted Windows security token, a separate and invisible Windows desktop, and a restricted Windows job object.12 These security mechanisms block access to any files, devices, and other resources on the user’s computer. Even if an attacker is able to exploit a vulnerability and run arbitrary code in the rendering engine, the sandbox will frustrate the attacker’s attempts to install malware on the user’s computer or to read sensitive files from the user’s hard drive. The attacker’s code could send messages to the browser kernel via the IPC channel, but we aim to keep this interface simple and restricted.

Getting existing code bases such as rendering engines to work fully within this type of sandbox sometimes presents engineering challenges. For example, the rendering engine typically loads font files directly from the system’s font directory, but our sandbox does not allow such file access. Fortunately, Windows maintains a system-wide memory cache of loaded fonts. We can thus load any desired fonts in the browser-kernel process, outside the sandbox, and the rendering-engine process is then able to access them from the cache.

There are a number of other techniques for sandboxing operating-system processes that we could have used in place of our current sandbox. For example, Internet Explorer 7 uses a “low rights” mode that aims to block unwanted writes to the file system.4 Other techniques include system-call interposition (as seen recently in Xax2) or binary rewriting (as seen in Native Client14). Mac OS X has an operating system-provided sandbox, and Linux processes can be sandboxed using AppArmor and other techniques. For Windows, we chose our current sandbox because it is a mature technology that aims to provide both confidentiality and integrity for the user’s resources. As we port Google Chrome to other platforms such as Mac and Linux, we expect to use a number of different sandboxing techniques but keep the same security architecture.

Exploit Mitigation. Google Chrome also makes vulnerabilities more difficult to exploit by using several barriers recommended for Windows programs.8 These include DEP (data execution prevention), ASLR (address space layout randomization), SafeSEH (safe exception handlers), heap corruption detection, and stack overrun detection (GS). These are available in recent versions of Windows, and several browsers have adopted them to thwart exploits.

These barriers make it more difficult for attackers to jump to their desired malicious code when trying to exploit a vulnerability. For example, DEP uses hardware and operating-system support to mark memory pages as NX (non-executable). The CPU enforces this on each instruction that it fetches, generating a trap if the instruction belongs to an NX page. Stack pages can be marked as NX, which can prevent stack overflow attacks from running malicious instructions placed in the compromised stack region. DEP can be used for other areas such as heaps and the environment block as well.

GS is a compiler option that inserts a special canary value into each stack call between the current top of the stack and the last return address. Before each return instruction, the compiler inserts a check for the correct canary value. Since many stack-overflow attacks attempt to overwrite the return address, they also likely overwrite the canary value. The attacker cannot easily guess the canary value, so the inserted check will usually catch the attack and terminate the process.

Sophisticated attacks may try to bypass DEP and GS barriers using known values at predictable addresses in the memory space of all processes. ASLR, which is available in Windows Vista and Windows 7, combats this by randomizing the location of key system components that are mapped into nearly every process.

When used properly, these mechanisms can help prevent attackers from running arbitrary code, even if they can exploit vulnerabilities. We recommend that all browsers (and, in fact, all programs) adopt these mitigations because they can be applied without major architectural changes.

Compatibility Challenges. One of the major challenges for implementing a security architecture with defense in-depth is maintaining compatibility with existing Web content. People are unlikely to use a browser that is incompatible with their favorite Web sites, negating whatever security benefit might have been obtained by breaking compatibility. For example, Google Chrome must support plug-ins such as Flash Player and Silverlight so users can visit popular Web sites such as YouTube. These plug-ins are not designed to run in a sandbox, however, and they expect direct access to the underlying operating system. This allows them to implement features such as full-screen video chat with access to the entire screen, the user’s Web cam, and microphone. Google Chrome does not currently run these plug-ins in a sandbox, instead relying on their respective vendors to maintain their own security.

Every large piece of software contains bugs. Given this reality, we can hope to reduce the severity of vulnerabilities by isolating a browser’s complex components and reducing their privileges.

Compatibility challenges also exist for using the browser’s architecture to enforce the same-origin policy, which isolates Web sites from each other. Google Chrome generally places pages from different Web sites into different rendering-engine processes,11 but it can be difficult to do this in all cases, as is necessary for security. For example, some frames may need to be rendered in different processes from their parent page, and some JavaScript calls need to be made between pages from different origins. For now, Google Chrome sometimes places pages from different origins in the same process. Also, each rendering-engine process has access to all of the user’s cookies, because a page from one origin can request images, scripts, and other objects from different origins, each of which may have associated cookies. As a result, we do not yet rely on Google Chrome’s architecture to enforce the same-origin policy.

Recently, some researchers have experimented with browsers (such as OP7 and Gazelle13) that do attempt to enforce the same-origin policy by separating different origins into different processes and mediating their interaction. This is an exciting area of research, but challenges remain that need to be overcome before these designs are sufficiently compatible with the Web. For example, supporting existing plug-ins and communication between pages is not always straightforward in these proposals. As these isolation techniques improve, all browsers will benefit.

Reducing the Window of Vulnerability

Even after we have reduced the severity of vulnerabilities, an exploit can still cause users harm. For example, a bug might let a malicious Web-site operator circumvent the same-origin policy and read information from other Web sites (such as email). To reduce the danger to users, Google Chrome aims to minimize the length of time that users run unpatched versions of the browser. We pursue this goal by automating our quality assurance process and updating users with minimal disruption to their experience.

Automated Testing. After a vulnerability is discovered, the Google Chrome team goes through a three-step process before shipping a security patch to users:

1. The on-duty security sheriff triages the severity of the vulnerability and assigns an engineer to resolve the issue.
2. The engineer diagnoses the root-cause of the vulnerability and writes a patch to fix the bug. Often security patches are as simple as adding a missing bounds check, but other patches can require more extensive surgery.
3. The patched binary goes through a quality assurance process to ensure that the issue is actually fixed; and the patch has not broken other functionality.

For a software system as complex as a Web browser, step 3 is often a bottleneck in responding to security issues, because testing for regressions requires ensuring that every browser feature is functioning properly.

The Google Chrome team has put significant effort into automating step 3 as much as possible. The team has inherited more than 10,000 tests from the WebKit project that ensure the Web platform features are working properly. These tests, along with thousands of other tests for browser-level features, are run after every change to the browser’s source code.

In addition to these regression tests, browser builds are tested on one million Web sites in a virtual-machine farm called ChromeBot. ChromeBot monitors the rendering of these sites for memory errors, crashes, and hangs. Running a browser build through ChromeBot often exposes subtle race conditions and other low-probability events before shipping the build to users.

Security Updates. Once a build has been qualified for shipping to users, the team is still faced with the challenge of updating users of older versions. In addition to the technical challenge of shipping updated bits to every user, the major challenge in an effective update process is the end-user experience. If the update process is too disruptive, users will defer installing updates and continue to use insecure versions.5

Google Chrome uses a recently open-sourced system called Omaha to distribute updates.6 Omaha automatically checks for software updates every five hours. When a new update is available, a fraction of clients are told about it, based on a probability set by the team. This probability lets the team verify the quality of the release before informing all clients. When a client is informed of an update, it downloads and installs the updated binary in a parallel directory to the current binary. The next time the user runs the browser, the older version defers to the newer version.

This update process is similar to that for Web applications. The user’s experience is never disrupted, and the user never has to wait for a progress bar before using the browser. In practice, this approach has proven effective for keeping users up to date. A recent study of HTTP User-Agent headers in Google’s anonymized logs reveals how quickly users adopt patched versions of various browsers.3 We reproduce their results in Figure 2. In these measurements, Google Chrome’s auto-update mechanism updates the vast majority of its users in the shortest amount of time, as compared with other browsers. (Internet Explorer is not included in these results because its minor version numbers are not reported in the User-Agent header.)

Reducing Frequency of Exposure

Even with a hardened security architecture and a small window of vulnerability, users face risks from malicious Web site operators. In some cases, the browser discourages users from visiting known malicious Web sites by warning users before rendering malicious content. Google Chrome and other browsers have taken this approach, displaying warning pages if a user tries to visit content that has been reported to contain malware or phishing attempts. Google works with Stop-Badware.org to maintain an up-to-date database of such sites, which can be used by all browsers.

One challenge with using such a database is protecting privacy. Users do not want every URL they visit reported to a centralized service. Instead, the browser periodically downloads an efficient list of URL hashes without querying the service directly. To reduce the space required, only 32-bit prefixes of the 256-bit URL hashes are downloaded. This list is compared against a list of malicious sites. If a match is found for a prefix, the browser queries the service for the full 256-bit hashes for that prefix to perform a full comparison.

Another challenge is minimizing false positives. Google and StopBadware.org External Link have tools to help publishers remove their pages from the database if they have been cleaned after hosting malware. It is also possible for human errors to flag sites incorrectly, as in an incident in January 2009 that flagged all URLs as dangerous.9 Such errors are typically fixed quickly, though, and safeguards can be added to prevent them from recurring.

These services also have false negatives, because not every malicious page on the Web can be cataloged at every point in time. Although Google and StopBadware.org External Link attempt to identify as many malicious pages as possible,10 it is unlikely to be a complete list. Still, these blacklists help protect users from attack.

There is no silver bullet for providing a perfectly secure browser, but there are several techniques that browser developers can use to help protect users.

Conclusion

There is no silver bullet for providing a perfectly secure browser, but there are several techniques that browser developers can use to help protect users. Each of these techniques has its own set of challenges.

In particular, browsers should minimize the danger that users face using three techniques:

* Reduce attack severity by applying the principle of least privilege in the browser architecture. This technique limits the damage caused when an attacker exploits a vulnerability.
* Reduce the window of vulnerability by ensuring updates are developed and deployed as quickly as possible. This technique minimizes the number of vulnerable browsers an attacker can target.
* Reduce how often users are exposed to attacks by filtering out known malicious content. This technique protects users during vulnerable time windows.

The Google Chrome team has focused on each of these factors to help provide a secure browser while preserving compatibility with existing Web content. To make Google Chrome even more secure, we are investigating further improvements to the browser’s security architecture, such as mitigating the damage that plug-in exploits can cause and more thoroughly isolating different Web sites using separate sandboxed processes. Ultimately, our goal is to raise the bar high enough to deter attackers from targeting the browser.

July 2009 U.S. Core Search Rankings

Google Sites led the U.S. core search market in June with 64.7 percent of the searches conducted, followed by Yahoo! Sites (19.3 percent), and Microsoft Sites (8.9 percent). Ask Network captured 3.9 percent of the search market, followed by AOL LLC with 3.1 percent.

* Based on the five major search engines including partner searches and cross-channel searches. Searches for mapping, local directory, and user-generated video sites that are not on the core domain of the five search engines are not included in the core search numbers.

Americans conducted 13.6 billion searches in July, down slightly for the third consecutive month as the summer months tend to see lighter overall search volume with people spending more time outdoors and on vacation. Google Sites accounted for 8.9 billion searches, followed by Yahoo! Sites (2.6 billion), Microsoft Sites (1.2 billion), Ask Network (536 million) and AOL LLC (424 million).

* Based on the five major search engines including partner searches and cross-channel searches. Searches for mapping, local directory, and user-generated video sites that are not on the core domain of the five search engines are not included in the core search numbers.

July 2009 U.S. Expanded Search Rankings

In the July 2009 analysis of the top properties where search activity is observed, Google Sites led the search market with 12.9 billion searches, followed by Yahoo! Sites with 2.8 billion. Microsoft Sites ranked third with 1.3 billion searches, up 3 percent from May, followed by eBay with 709 million. Facebook.com experienced the highest growth of the top ten expanded search properties with a 35-percent increase.

Google has unveiled a new test version of their search engine, which is being called “Caffeine”. This is being touted as the “next generation of search”.

Google says…

To build a great web search engine, you need to:

1. Crawl a large chunk of the web.
2. Index the resulting pages and compute how reputable those pages are.
3. Rank and return the most relevant pages for users’ queries as quickly as possible.

For the last several months, a large team of Googlers has been working on a secret project: a next-generation architecture for Google’s web search. It’s the first step in a process that will let us push the envelope on size, indexing speed, accuracy, comprehensiveness and other dimensions. The new infrastructure sits “under the hood” of Google’s search engine, which means that most users won’t notice a difference in search results. But web developers and power searchers might notice a few differences, so we’re opening up a web developer preview to collect feedback.

Some parts of this system aren’t completely finished yet, so we’d welcome feedback on any issues you see. We invite you to visit the web developer preview of Google’s new infrastructure at http://www2.sandbox.google.com/ and try searches there.

Right now, we only want feedback on the differences between Google’s current search results and our new system. We’re also interested in higher-level feedback (”These types of sites seem to rank better or worse in the new system”) in addition to “This specific site should or shouldn’t rank for this query.” Engineers will be reading the feedback, but we won’t have the cycles to send replies.

Here’s how to give us feedback: Do a search at http://www2.sandbox.google.com/ and look on the search results page for a link at the bottom of the page that says “Dissatisfied? Help us improve.” Click on that link, type your feedback in the text box and then include the word caffeine somewhere in the text box. Thanks in advance for your feedback!