XSS in Youtube

XSS Vulnerability in Interactive YouTube API Demo Beta

There is a Critical Cross site XSS Vulnerability in Interactive YouTube API Demo Beta, Discovered by various sources. One of the White Hat Hacker "Vansh Sharma" Inform us about this XSS Vulnerability with proof of concept.
Proof Of Concept :

• Open http://gdata.youtube.com/
• Enter script <img src="<img src=search"/onerror=alert("xss")//"> in the keyword area.
• Press ADD

Some new google apps Google Apps

This is part of a regular series of Google Apps updates that we post every couple of weeks. Look for the label “Google Apps highlights" and subscribe to the series. - Ed.

In the spirit of helping people work better together, over the last few weeks we made big improvements to Google presentations, introduced a version of Google Docs optimized for Android tablets, and enabled more dynamic content in Google Sites. We also celebrated the fact that Silicon Valley has gone Google!

Google presentations reloaded
On Tuesday we launched a completely rebuilt version of our web-based presentations application, so you can build more beautiful presentations together with colleagues and classmates. Google presentations now lets you make great-looking slides with animated builds, advanced slide transitions and better support for drawings, tables and themes. Plus, we made it easier to create presentations with others, without the hassles of attachments. Your whole team can work together in the same version of a presentation at the same time, and you can see who’s doing what, chat with others, and see a full revision history at any moment in time.

Google Docs on Android tablets
We’ve made it faster and easier to work with Google Docs on Android tablets with a new version of the Android application that takes full advantage of larger screen real estate. The three-panel view lets you browse filters and collections, see your document list and view file thumbnails and details simultaneously. You can get the Google Docs Android app for free from the Android Market.

Charts in Google Sites
Charts are often created in spreadsheets, but sometimes you want charts to appear in other places, like your team or project sites. In Google Sites, now you can select “Chart” from the “Insert” menu, and navigate to the Google Spreadsheet where your chart or data is located. You can also choose to have your site’s chart update in real-time when someone updates the underlying spreadsheet.

New look for Google Docs and Sites
We started rolling out a new look in Google Docs a couple months ago, and now this new design is available throughout all our collaboration tools. In addition to a cleaner, simpler design, we’ve made it more clear when your files are being auto-saved and added new icons to help you see at-a-glance who your docs are shared with. You can also customize the overall “density” of screen information, a great feature if you want to fit more onto a smaller display.

Who’s gone Google?
Successful small businesses tend to stay laser-focused on improving their core businesses, without getting distracted by peripheral activities that don’t make them more competitive. For example, most small businesses don’t want to spend time or money developing in-house expertise to run email and other IT systems. Case in point: 97 percent of Business Insider’s “Silicon Valley Startups to Watch” use Google Apps.

More than 5,000 businesses and thousands of other organizations start using Google Apps every single day, and more of our customers have shared their stories recently so you can hear why. A warm welcome goes out to Philz Coffee, Mid-Atlantic Door Group, Bradford & Barthel, LLP and the City of Mesquite, Nevada.

I hope these product updates and customer stories help you and your organization get even more from Google Apps. For more details and the latest news, check out the Google Apps Blog.

Google announces Android 4.0 and its SDK tools

Android 4.0 builds on the things people love most about Android — efficient multitasking, rich notifications, customizable home screens, resizable widgets, and deep interactivity — and adds powerful new ways of communicating and sharing. It includes many great features for users, including social and sharing integration, network data usage control, innovative connectivity and camera options, and an updated set of standard apps.
For developers, Android 4.0 introduces many new capabilities and APIs. Here are some highlights:

Unified UI toolkit: A single set of UI components, styles, and capabilities for phones, tablets, and other devices.
Rich communication and sharing: New social and calendar APIs, Android Beam for NFC-based instant sharing, Wi-Fi Direct support, Bluetooth Health Device Profile support.
Deep interactivity and customization: Improved notifications, lockscreen with camera and music controls, and improved app management in the launcher.
New graphics, camera, and media capabilities: Image and video effects, precise camera metering and face detection, new media codecs and containers.
Interface and input: Hardware-accelerated 2D drawing, new grid-based layout, improved soft keyboard, spell-checker API, stylus input support, and better mouse support.
Improved accessibility: New accessibility APIs and text-to-speech APIs for writing new engines.
Enhancements for enterprise: Keychain and VPN APIs for managing credentials and connections, a new administrator policy for disabling the camera.

For a complete overview of what’s new for users and developers, please read the Android 4.0 Platform Highlights.
Alongside the new Android platform, we are releasing new versions of the SDK Tools (r14) and ADT Plugin (14.0) for Eclipse. Among the highlights are:

• Improved build performance in Ant and Eclipse
• Improved layout and XML editors

To get started developing on Android 4.0, visit the Android Developers site for information about the Android 4.0 platform, the SDK Tools, and the ADT Plugin.
If you have already developed and published apps, we encourage you to download the Android 4.0 platform now, to begin testing your app before devices arrive in stores.

Check out the video below for a closer look at Android 4.0 in action.

All about Ice Cream Sandwich(Android 4.0)

Google dropped some interesting information about Ice Cream Sandwich, the next version of Android - Android 4.0 at its Google I/O conference back n May.
We now know that Android 4.0 Ice Cream Sandwich will be announced at a Google event on 19 October.
A video of an Ice Cream Sandwich sculpture at Google's HQ confirms the 19 October launch for the new OS.
The Android 4.0 launch takes place at 10AM Hong Kong time (3AM UK time), and was posted on Google's brand new @Android Twitter account.
The Samsung-built 4.7-inch, 1.5GHz dual-core Nexus Prime is the likely partner handset, but we don't know a Nexus Prime UK release date as yet.

As we reported from Google's keynote at Mobile World Congress in February, Google's mantra for the Android 4.0 OS is "one OS everywhere" – it will be a single 4.0 version of Android running across phones and tablets, unlike Android 3.0 Honeycomb that only runs on tablets.
That's why it's a Sandwich y'see.
Android 4.0 Ice Cream Sandwich interface
Ice Cream Sandwich will bring all the interface loveliness of Android 3.0 Honeycombto Android smartphones. Android phone users will get the updated app launcher, holographic user interface, interactive and new homescreen widgets plus the multi-tasking panel.

ANDROID 3.0: This interface magic will be coming to Android Ice Cream Sandwich
On 12 August we saw a batch of leaked screenshots of Ice Cream Sandwich.
Android Police and Roots Wiki seem to have come up with an odd cross-site team up to leak four pretty plausible screengrabs of the latest version of Google's mobile OS, which will likely be Android 4.0.
Android 4.0 Ice Cream Sandwich features
Google says Ice Cream Sandwich is its "most ambitious release to date" and will incorporate all the best bits of Honeycomb, the Android tablet OS, and make them useable on smartphones too.
But Ice Cream Sandwich is about more than just the user interface and it will bring all the new Android 3.1 features to phones. This new update means Android tablets will also be able to act as a USB hub and you'll be to hook up devices such as mice and keyboards and game controllers to tablets and smartphones.
On 10 October, TI refused to confirm or denyFudzilla reportsthat it was the reference design for Android 4.0 would be based on their hardware.
Google is also intending to make life easier for developers by releasing a new set of APIs that will help them to scale their apps across the various sizes of Android devices - Google acknowledges that it's important for developers to be able to design apps that will work across 3.5-inch smartphones up to 10.1-inch tablets.
During the Google Google I/O keynote those on stage also showed off 3D headtracking using the front-mounted camera so you can figure out who is speaking and focus on them while on a video call. Face detection will be a key feature in the OS and we hear that you can even unlock your handset using it.
Android 4.0 Ice Cream Sandwich apps
Many popular apps will get an update in time for the new OS - with a new interface expected to debut too. Interestingly, the screenshots shown here appear to have been taken on a new Samsung-built Nexus Prime.
A new Google Music app has also leaked which, although it works with earlier Android versions, is designed for Ice Cream Sandwich.
There will also be a new browser available - Google Chrome will debut on Android.
Android 4.0 Ice Cream Sandwich specification
Google's Mike Claren said, "we want one OS that runs everywhere."
Smartphone users will also get an expanded multitasking tool, including a system manager that handles your open resources for you so you won't run out of memory or be prompted to quit an application on the tablet.
Android 3.1 also means you can expand the size of a scrollable home screen widget, while existing scrollable widgets can also be upgraded by devs with a couple of lines of code.



Android 4.0 Ice Cream Sandwich requirements
There's no word yet on minimum hardware requirements, though this will certainly have implications for upgrading existing handsets to the new OS. Speaking of which…
Android 4.0 Ice Cream Sandwich upgrades
Google is introducing new guidelines in which it promises OS updates for the first 18 months for existing handsets. So Ice Cream will be coming to some of the more powerful handsets released during 2011.
"Together we'll create guidelines for how quickly devices will get updated after new android platforms and for how long they'll continue to get updated.," said Google's Vic Gundotra at Google I/O.
"New devices from these partners will receive the latest Android updates for 18 months after first launch, if the hardware allows it. We think this is really great news for users, we think it's excellent for developers and really great for the entire industry."
The move is in response to accusations that Android is becoming too fragmented and it has announced an alliance of (US-only for now) networks and manufacturers who have vowed to provide more timely updates. No longer will you get left behind.
Samsung UK has also told TechRadar that it is working to bring faster updates to users.
"We saw a lot of comments saying 'I want my upgrade, when do I get my upgrade?'," says Hiroshi Lockheimer, director of engineering at Google.
"There's no common expectation set of how this would work, so we can at least establish some form of expectation for the whole community - users and developers.
"We certainly want this to be an international, global thing. We announced Vodafone;you can expect another wave of announcements around that."
Android 4.0 Ice Cream Sandwich is open source
We also know that Google is intending to make Ice Cream Sandwich fully open source. It didn't do this with Android 3.0 Honeycomb in an attempt to make things more consistent.
"It's more manageable to start small and get bigger," says Andy Rubin, senior vice president of Mobile at Google.
"It's an open invitation; there's no reason not to have everybody in [The Open Handset Alliance] - but I want to hit the ground running, I don't want to take a lot of time on building a list of names."

Google command line (GoogleCL)

Google command(GoogleCL) line allows you to use command line for the basic features: 

GoogleCL brings Google services to the command line.

We currently support the following Google services:

• Blogger

$ google blogger post --title "foo" "command line posting"

• Calendar

$ google calendar add "Lunch with Jim at noon tomorrow"

• Contacts

$ google contacts list Bob name,email > the_bobs.csv

• Docs

$ google docs edit "Shopping list"

• Finance

$ google finance create-txn "Savings Portfolio" NASDAQ:GOOG Buy

• Picasa

$ google picasa create "Cat Photos" ~/photos/cats/*.jpg

• Youtube

$ google youtube post --category Education killer_robots.avi

Google shutting down some products

We aspire to build great products that really change people’s lives, products they use two or three times a day. To succeed you need real focus and thought—thought about what you work on and, just as important, what you don’t work on. It’s why we recently decided to shut down some products, and turn others into features of existing products.

Here’s the latest update on what’s happening:

• Code Search, which was designed to help people search for open source code all over the web, will be shut down along with the Code Search API on January 15, 2012.
• In a few weeks we’ll shut down Google Buzz and the Buzz API, and focus instead on Google+. While people obviously won't be able to create new posts after that, they will be able to view their existing content on their Google Profile, and download it using Google Takeout.
• Jaiku, a product we acquired in 2007 that let users send updates to friends, will shut down on January 15, 2012. We’ll be working to enable users to export their data from Jaiku.
• Several years ago, we gave people the ability to interact socially on iGoogle. With our new focus on Google+, we will remove iGoogle's social features on January 15, 2012. iGoogle itself, and non-social iGoogle applications, will stay as they are.
• The University Research Program for Google Search, which provides API access to our search results for a small number of approved academic researchers, will close on January 15, 2012.

In addition, later today the Google Labs site will shut down, and as previously announced, Boutiques.com and the former Like.com websites will be replaced by Google Product Search.

Changing the world takes focus on the future, and honesty about the past. We learned a lot from products like Buzz, and are putting that learning to work every day in our vision for products like Google+. Our users expect great things from us; today’s announcements let us focus even more on giving them something truly awesome.

When a hacker deletes all your mails

 Many people are concerned about hacked e-mail accounts (even celebrities), but what about when several years worth of your digital file cabinet are deleted, say, by a malicious intruder?
That happened to Deb Fallows six months ago, and her husband, author James Fallows, wrote a riveting account of their ordeal for The Atlantic that makes for fascinating reading.
His words of advice are: use strong, unique passwords on important important online accounts; take advantage of Google's two-step verification service; and back up our cloud-based data on our own. Oh, and act fast. Deleted messages are purged from the Trash folder after about a month.

In a nutshell, someone somehow got a hold of his wife's Gmail password and sent scary "Mugged in Madrid" messages to her contacts (including ex-Google CEO Eric Schmidt, who sent a "terse" e-mail to the author with the subject line of "Deb's e-mail has been hacked"), diverted her incoming messages to an outside account and pretended to be her in e-mail exchanges with concerned and or dubious friends and family. The hacker then deleted six years worth of correspondence. Poof!
Google initially was only able to retrieve a fraction of the deleted data and said the rest were not recoverable and that Google "will not be able to respond to any further e-mails on this case." That's when being a prominent writer with the likes of Schmidt in your address book comes in handy.
Fallows dashed off an e-mail to a top Google engineer to the effect of: "You (Google) cannot be serious about this. You cannot entice people into relying on your services, and be so cavalier about the risks they are exposed to. Can you?"
Suffice it to say his connections and persistence pay off. But his resulting crisis of faith in cloud computing drives him on a journey into the bowels of the Googleplex where he seeks reassurance that we're not fated for digital disaster.
"How could big tech companies offer cloud services to hundreds of millions of people without better guarding their data against catastrophic loss?"

Google+ real-time search

 Google has built real-time search results into Google+, giving people the ability to watch a live feed of Google+ activity about a given subject.
In addition, the company wired real-time search up to the idea of hashtags, popularized on Twitter by the company's own Chris Messina as a way to flag particular themes. He called for Google+ hashtag support in July, and now when people add the hash symbol in front of a term--"#ios5," for example--it links to search results for that term.
The new features are gradually being enabled for Google+ users now, said Vic Gundotra, the Google senior vice president in charge of Google+, in a Google+ post today.
Real-time search works as an extra step after a regular Google+ search performed with the "search Google+" box in the service's upper-right corner. After you search for a term, you'll see results, but if new results arrive, a "most recent" link will appear. Clicking that link will add a stream of new Google+ posts matching the search term.
Though search is of course Google's core business, Google+ launched without it. Google added search abilities to Google+ in September, when it opened the social-network service up to the public.
Here's Gundotra's video explaining the features via a YouTube video:

Adsense with Google+ to rate your ads

Here are a few ways these new ad formats are helping people find valuable information faster:

Visual. Not only can you find theater times for a new movie, you can watch the trailer directly in the ad. Media ads put the sight, sound and motion of video into search ads. With Product Ads, people can see an image, price and merchant name, providing a more visual shopping experience. Because this format is often so useful, people are twice as likely to click on a Product Ad as they are to click on a standard text ad in the same location, and today, hundreds of millions of products are available through Product Ads.

Local. More than 20 percent of desktop searches on Google are related to location. On mobile, this climbs to 40 percent. Location-aware search ads can help you find what you’re looking for more easily by putting thousands of local businesses on the map—literally. More than 270,000 of our advertisers use Location Extensions to attach a business address on at least one ad campaign, connecting more than 1.4 million locations in the U.S. via ads. And, with our mobile ad formats, not only can you call a restaurant directly from the ad, you can also find out how far away the restaurant is located and view a map with directions.

Social. With the +1 button people are able to find and recommend businesses with their friends. Since introducing the +1 button earlier this year, we now have more than 5 billion impressions on publisher sites a day. If you’re a business owner, the +1 button enables your customers to share your products and special offers easily with their network of friends, amplifying your existing marketing campaigns.

We're continuing to experiment with search ads to help businesses like CafePress grow by connecting with the right customers. Starting today, you can drop by our site to check out what’s new with search ads and learn about all the improvements we’ve been working on recently.



We’re developing ads that provide richer information to you because we believe that search ads should be both beautiful and informative, and as useful to you as an answer. 

Using Google+ API's

The Google+ project brings the nuance and richness of real-life sharing to software. The Google+ platform brings that nuance and richness to all of the web. We started with Google’s own products, added the +1 button for site owners and content publishers, and introduced games from a handful of partners. That’s just the beginning though — we want every one of you who builds applications to be able to include rich sharing, identity, and conversations in your app. Today, we’re taking the next step on that journey by launching the first of the Google+ APIs.

Let's Go Public

Google+ gives users full control over their information, supporting everything from intimate conversations with family to public showcases and debates. This initial API release is focused on public data only — it lets you read information that people have shared publicly on Google+. For example, if you want to get my profile information, you can use the people.get method by sending the following HTTP request:

GET https://www.googleapis.com/plus/v1/people/108189587050871927619?key=yourAPIKey

which returns the following JSON encoded output (excerpted for brevity):

{
 "kind": "plus#person",
 "id": "108189587050871927619",
 "displayName": "Chris Chabot",
 "image": {
  "url": "https://lh5.googleusercontent.com/-cQNLOQzkGpE/AAAAAAAAAAI/AAAAAAAAEjo/M9_pXL-ra4Q/photo.jpg"
 },
 "organizations": [
  {
   "name": "Google+ Developer Relations",
   "title": "Developer Advocate & Manager",
   "type": "work"
  }
 ]
}

Similarly, you can get a list of my most recent public posts by using the activities.list method:

GET https://www.googleapis.com/plus/v1/people/108189587050871927619/activities/public?key=yourAPIKey

Because we’re starting with public data only, you simply need to register your app before making requests. And if you aren't yet sure which Google+ user is running your app (for example, because they're installing it for the first time), then you can use the new plus.me OAuth2 scope to ask the user who they are.

After your application has requested this scope, you can use the special “me” identifier rather than the long numeric identifier:

GET https://www.googleapis.com/plus/v1/people/me

On The Shoulders of Giants

We love the way the programmable web has evolved, so we’re using existing standards and best practices wherever we can:

• Our API methods are RESTful HTTP requests which return JSON responses.
• Our payload formats use standard syntax (e.g. PoCo for people info, ActivityStrea.ms for activities).
• We use OAuth 2 for secure trusted access to user data.

In addition, since most of us no longer write raw HTTP requests these days, we provide libraries for your favorite language: Java, GWT, Python, Ruby, PHP, Objective-C, and .NET. These libraries are all open source, so we’d love to have your feedback and help with them.

developers.google.com

You can find more information about the Google+ platform, including today’s new APIs to public data, at developers.google.com/+ on our new Google Developers site. This site will be the place to go for access to documentation, terms and policies, discussions with other developers, tools that make development on the +Platform easier and more fun and, of course, the place where announcements concerning new releases will be made.

Included in our policies are three simple guidelines that we aspire to in our own products, and that we’d like all applications built on the Google+ platform to follow also: put the user first, be transparent, and respect user data. The goal behind these guidelines, as with all of the features and fine print, is to work together to build products that our users will love.

And now …

For all of you developers who have been asking for a Google+ API, this is the start. Experiment with it. Build apps on it. Give us your feedback and ideas. This is just the beginning; the Google+ platform will grow and we value your input as we move Google+ forward.

Follow the conversation on Google+.

Integrate Google Reader with GMail - Freshblog

Philipp at Google Blogoscoped points out a nifty Greasemonkey script that will integrate Google Reader capabilities into GMail, which comes to us courtesy of Mihai Parprita of Persistent.info.

The script will add star, share, e-mail, mark as read, & tag management tabs to feed-sourced entries that appear in the message list in G-Mail, & make it that much easier to view your e-mail feed subs in a full-fledged RSS reader, as we've recently discussed in relation to R-Mail. A great way to consolidate two major streams of incoming information, & perhaps to save a bit of time? Philipp and Garett at ZD.Net's Googling Google speculate as to the eventual integration of the two products. Sounds good to me!