The story, in a nutshell, is that we found a security flaw in Google's Desktop search tool. We told Google a few weeks ago and they've already pushed out a fix. Still, it's a good story. An article about this should be running in tomorrow's New York Times and the inevitable Slashdot hoardes will descent on my site like vultures. We've got the site, all to itself, on a Mac Xserve G4 (dual proc, 4GB of memory) with Apache. Hopefully, it won't get crushed.

Thanks also to Cybjorg for his help with the CSS style sheets, and check out the cool logo that my sister put together. I now owe her a favor.

http://seclab.cs.rice.edu

P.S. Please, if any of you guys want to post something to Slashdot or whatever, wait until the story hits the New York Times tomorrow. I offered them an "exclusive" on the story, so hopefully they'll tell the story correctly. There's nothing worse than a story getting butchered by a bad reporter.

If you want to achieve your objective, my feelings won't be hurt if you delete your post.

I am now going top place a wager with myself.

Please note that this response is 100 percent content-free.

edit: spelling

Call me naive, but I assume this board is a community of people who like to know about things first and know how to keep things under their hat (which is often a condition of knowing about things first).

Great stuff, Dan. Good to see hard work pay off, and especially good to see that it was handled the right way with all parties involved. Best of luck to your poor server!

Woohoo! Now I'll know what a "composition flaw" is when I start my new job at the CERT in a couple weeks!

Congrats, Dan! I find especially impressive the fact that this work was a part of a student project. You certainly seem to be teaching them well down there in Texas! (But what else to expect from someone with results like yours )

I also like the web page about the discovery - clear, complete, slightly understated. No symptoms of slashdotting yet, BTW.

Heck, even NYT almost got it right (first paragraphs are a bit off ("which could permit an attacker to secretly search the contents of a personal computer via the Internet"), but they cleared it up later in the text).

Impressive, all together!

http://www.pcworld.com/news/article/0,aid,118999,pg,1,RSS,RSS,00.asp

PC World article posted, mentions your website, but does not provide a link.

HardOCP mentioned it also they linked to cnet news.com

And here they come! At least they were kind enough to just post the NY Times link in the story... Maybe that'll save the server.

So far, the load on the server has been relatively light - a couple hundred hits.

All said and done, we're currently at 924 visitors to the home page and 1144 downloads of the tech report. Slashdot never linked to us from their home page; those downloads are from newspaper articles or from Slashdot readers. Eventually, I'll do a more detailed breakdown on the referrer logs, but this hardly even counts as a Slashdotting.

Woo, a mention on The Register too, top story this morning:

http://www.theregister.co.uk/2004/12/20/google_desktop_flaw/

Still no link though!

Gareth

Dan - you know no real Slashdotter actually reads the article!

-Zeke

Or, 1000 out of, what, hundreds of thousands, actually decided to dig deeper. Now I just have to get the class grades done. They're due today...

I'm pretty sure you made the SF bay area news last night as well. I saw a preview mentioning a Google bug and a screenshot that looked an awful lot like your web page. Unfortunately, I missed the actual report and I'm not sure which network it was.

-Mike

Hey! You even made News8Austin !!

You have been for over a day one of "top seven but not top two" Google news stories (those in right top corner), and still only a thousand hits? People seem to have very short attention span these days...

The latest stats:
- 3647 hits for the CSS style sheet (which says something about unique visitors)
- 4687 hits for the PDF tech report (several news reports linked directly to the PDF)

Not bad, I suppose...