First thing, download all the sources. You might also want to run yum update just to be safe. Since this was a brand new VM, this required about 300MB of updates.
Currently, the “full setup” lists the following:

• openvas-libraries 3.1.2
• openvas-scanner 3.1.0
• openvas-manager 1.0.1
• gsa 1.0.1
• openvas-cli 1.0.0
• openvas-administrator 0.9.0
• gsa-desktop 0.1.0

I downloaded and untar’d them all for later. From the limited documentation on the site, I deduced that openvas-libraries should be installed first. cd to that directory.

openvas-libraries

For the cheat codes, skip to the end.

To build and install from source, the usual process is ./configure; make; make install.

To isolate errors, you should run each individually, so ./configure first.

Alright, this has to be written down somewhere, let’s check the install_readme. Apparently we need:

• libglib >= 2.12
• libgnutls >= 2.0
• libpcap
• libgpgme >= 1.1.2
• gcc
• bison
• flex

To install all of these, run yum -y install glib2-devel gnutls-devel libpcap-devel gcc bison flex. The rest aren’t in the standard CentOS repo.

Now to try ./configure. We get configure: error: "gcrypt.h not found". Now you should be seeing a pattern. Let’s fix this by yum -y install libgcrypt-devel.

We are missing library gpgme. Yum comes up with no results for gpgme, but the script has a link to http://www.gnupg.org/gpgme.html. Download the source code, and extract it to a folder. We have to build and install this before we can get back to the main openvas-libraries installation.
Apparently you need GnuPG2, which can be installed by yum -y install gnupg2. This installs some dependencies, but g13 is still missing. You also need libassuan and libgpg-error, which can be downloaded from http://gnupg.org. Extract both, and ./configure; make; make install. Install libgpg-error first, as it is required for libassuan.

Apparently e2fsprogs-devel is required, but nothing will tell you that. Instead, the program complains about not having uuid and the development libraries. Of course, this took a little while to figure out, since uuid and uuid-devel aren’t in the standard CentOS repos. Instead, you need to install additional repos, and then find out that it still complains. Only after some clever Google searches did I find out about e2fsprogs. yum -y install e2fsprogs-devel.

To build openvas-libraries, you need cmake. Download and install cmake from http://cmake.org. To install cmake, you need to have gcc-c++, and use a different script. yum -y install gcc-c++ to get the c++ compiler. Instead of the usual ./configure; make; make install, you need to ./bootstrap; gmake; make install. Not sure if you really need to use gmake instead of make, but the output of ./bootstrap told me to.

Then, go back to openvas-libraries and make; make install

TL;DR:
Note: file versions may be out of date, please visit the homepages for these tools to get the latest versions.
# yum -y install glib2-devel gnutls-devel libpcap-devel gcc bison flex libgcrypt-devel gnupg2 e2fsprogs-devel gcc-c++
# wget http://wald.intevation.org/frs/download.php/767/openvas-libraries-3.1.2.tar.gz
# wget ftp://ftp.gnupg.org/gcrypt/gpgme/gpgme-1.3.0.tar.bz2
# wget ftp://ftp.gnupg.org/gcrypt/libassuan/libassuan-2.0.1.tar.bz2
# wget ftp://ftp.gnupg.org/gcrypt/libgpg-error/libgpg-error-1.9.tar.bz2
# wget http://www.cmake.org/files/v2.8/cmake-2.8.2.tar.gz
# tar xzf openvas-libraries-3.1.2.tar.gz
# tar xjf gpgme-1.3.0.tar.bz2
# tar xjf libassuan-2.0.1.tar.bz2
# tar xjf libgpg-error-1.9.tar.bz2
# tar xzf cmake-2.8.2.tar.gz
# cd libgpg-error-1.9
# ./configure; make; make install
# cd ../libassuan-2.0.1
# ./configure; make; make install
# cd ../gpgme-1.3.0
# ./configure; make; make install
# cd ../cmake-2.8.2
# ./bootstrap; gmake; make install
# cd ../openvas-libraries
# ./configure; make; make install

openvas-scanner

Next, to install openvas-scanner, extract the files, change to that directory, and
build it.

# wget http://wald.intevation.org/frs/download.php/754/openvas-scanner-3.1.0.tar.gz
# tar xzf openvas-scanner-3.1.0.tar.gz
# cd openvas-scanner-3.1.0
# ./configure; make; make install

Then, add /usr/local/sbin to your PATH variable by adding the following to /etc/profile, before the line that begins EXPORT PATH…
PATH=$PATH:/usr/local/sbin

openvas-manager

Next is the manager.

The manager requires sqlite and doxygen, so

# yum -y install sqlite-devel doxygen
Then # cmake .; make; make install

openvas-cli

OpenVAS-Administrator seems to still be in beta, so let’s skip that and go to the CLI.

# cmake .; make; make install

Configuring

First step is to generate a certificate. If you’re like me, you didn’t add /usr/local/sbin to your PATH, so you have to type it manually for this part.

# /sbin/ldconfig /usr/local/lib
# /usr/local/sbin/openvas-mkcert

Follow the instructions and generate your certificates.

Next, run # /usr/local/sbin/openvas-adduser to add a new user. http://www.openvas.org/compendium/adding-new-users.html has details on this. To create an admin user, give the rule default accept.

Run the NVT sync to grab the latest tests:
# /usr/local/sbin/openvas-nvt-sync

openvas-client

Guess what, you need gnutls for this. What’s that you say, you already have gnutls? Nope, apparently the CentOS repo has a version too old for the client.

Get a new version from ftp://ftp.gnu.org/pub/gnu/gnutls/ and install it.

When installing, use ./configure --prefix=/usr/ to specify the location of the installed files.

To be continued…

gsa-desktop

To be continued…

(03:43:47 PM) friend of mine: i hate web 2.0 or whatever
(03:43:51 PM) friend of mine: social media is the downfall of our society
(03:43:52 PM) friend of mine: mark my words

I was reading this post by Modern Nerd, a piece that aims to ground the grandiose visions of many self-proclaimed “support ninjas, web rock stars, and sandwich artists.” While it is true that there are many web designers calling themselves rockstars, ninjas, or even rockstar ninjas, over the past couple years the number of “social media gurus” has increased exponentially.

Enhance the customer experience by facilitating authentic conversations
–http://whatthefuckismysocialmediastrategy.com/

One of my favorite websites, The Oatmeal concisely describes some of the problems with these trends.

The Onion, another favorite read, has been publishing strikingly relevent articles recently. The best part of that article isn’t necessarily the content, but the way in which the content is wrapped by buttons for Digg, Buzz, Facebook, Twitter, and Reddit. There’s even a Twitter feed on the side, which for some reason is right below another box highlighting recent and popular posts. However, seeing as I have my own twitter feed highlighted on every page of my own site, I can hardly point a finger. Instead, I’ll just follow with a link to the New York Times article on Foursquare, which also has buttons for social networking, albeit only Facebook and Twitter. In satirizing the newspaper’s coverage of tech news, The Onion seems to have either forgotten or ignored the fact that the point of all writing is to be read, and what better way than by writing about current trends (as in the NYT) or by providing efficient mediums for promoting that writing (as done by The Onion).

Maximise buzz by driving word of mouth from relevant influencers
–http://whatthefuckismysocialmediastrategy.com/

For some (see top quote), social media represents a collapse of civilization. It used to take a phone call or letter to contact someone. The phone improved on the letter by allowing longer conversations in a more convenient time frame. Voicemail improved on that, with the ability to leave the equivalent of an auditory letter. The receiver could listen at their will, and reply when they had time. Email came along and reverted some of the face-to-face aspects of phone conversations, but bringing with it the ability to write longer messages. Instant messaging followed up email, improving the response time and face-to-face abilities of email, and dramatically reducing the level of effort required. Typical instant messages are less than 10 words, and frequently contain abbreviations and acronyms. Instant messaging was then finally displaced by wall posts and tweets. Text messaging was in there somewhere, but that’s a whole other ballgame, and I don’t even really like baseball.

Harness social currency to drive buzz
–http://whatthefuckismysocialmediastrategy.com/

Tweets started out, as email did, as a way to communicate more effectively with people not in your immediate vicinity. However, more and more both technologies have been abused to an outrageous point. The scourge of spam seems to be a never-ending battle, and Twitter is plagued by its own success. While Twitter was an essential part of highlighting the Iran voting story a while back, it is also essential to highlighting some of the more inane and pointless.

Twitter satisfies the third and fourth levels of Maslow’s Hierarchy of Needs, which comprise the struggle to belong and feel significant. From every angle, Twitter seems designed to exploit these two levels. Let’s start with the basics. Twitter exists primarily for users to post snippets of 140 characters or less. These snippets can be directed to the public at large, sent to a specific user (either publicly or privately), or tagged with a “hash tag.”

The mere act of posting a tweet fulfills certain needs.  This is further enhanced by the number of followers one has.  With less than 40 followers, someone is usually just tweeting to close friends and acquaintances.  However, once a twitterer gets above a certain point, followers start to change.  They start to transform from individual people into statistics.  At 1000 followers, you are no longer sending a personal message to your friends.  You are now broadcasting ideas and opinions to strangers at a level once only achievable by professionals.  This changes the entire dynamic of tweeting.  For a brief period, I was mirroring my tweets as Facebook status updates.  When I was doing this, the actual content and direction of my tweets was much different.  Instead of posting personal updates to my Facebook and interesting tidbits to my Twitter, I now had to find a common ground between the two.  I didn’t want my mom (an avid Twitter follower) to read my Facebook updates, and I certainly didn’t think my Facebook friends would find my thoughts on web user interfaces at all interesting.  For some strange reason, just changing the audience of who I was posting to changed how I felt about what I posted.

The ability to respond to others’ tweets also fulfills the esteem level of the pyramid. Unlike emails or even Facebook wall posts, twitter replies are by default public on the sender’s page, and neither has to even be a follower of the other. In this way, the sender can make himself feel significant without actually being significant.

The hash tags are one of the most brilliant parts of Twitter. When enough people put the tag in a tweet, the tag becomes a “trending topic,” visible on the home page. This advertises to all of Twitter that this topic is important, thereby causing more people to tweet about the topic, raising it even further. By participating in this global exchange, individual users can feel a part of something bigger than themselves, especially if a celebrity decides to respond.

These topics are elaborated on in The Psychology of Social Currency, a great post that tries to further explain why social media is so addicting and necessary for some. Essentially, it all boils down to a perceived benefit to posting on Twitter and sites like it. While there is no physical incentive, the fact that you can reach an audience of over a thousand people while wearing boxers is truly either a sign of the downfall of society, or the next great leap.

Ideally, copyright could work both ways, ensuring that creators receive fair compensation for their ideas, while not restricting benefits to society.

The internet has turned the standard business model on its head. In the past, creators would produce something, either a literary article, piece of software, or album, and sell it to consumers, usually through a distributor. However, the internet has introduced new avenues for consumption that have had catastrophically good and bad results on this model.

With the advent of online distribution, content producers can be their own distributors, offering goods online for direct purchase by consumers. However, the internet has also brought peer-to-peer filesharing along with it. As easy as it is to obtain something legally, it can sometimes be even easier to obtain it illegally.

DRM, or Digital Rights Management, has been applied to try to combat this problem. By controlling the usage of digital content, providers hope to discourage the illegal sharing of that content. However, this has been seen to backfire on many producers. Video game publishers who impose draconian copy protection measures on their consumers actually push people towards illegal downloads. When DRM malfunctions, an occurrence that happens far too often, legitimate consumers can actually be locked out of software they purchased legally. To avoid these headaches, many turn to filesharing networks, where video games and movies can be downloaded with their content protection already disabled. In many cases, even with the risks of downloading copyrighted materials, preference is shown to the pre-cracked files due to the superior consumption experience. Compare the following processes for watching the latest HD movie on your TV:

Blu-ray

1. Drive to BlockBuster or BestBuy, or wait three days for Netflix
2. Put the disc in your player, pray that it isn’t scratched from more than one use
3. Wait for Sony’s advertisement to play
4. Wait for the first warning to go away – “FBI Warning”
5. Wait for the second warning to go away
6. Watch a painful clip warning you of the dangers of “stealing” movies
7. Watch an unskippable trailer for a movie that’s either come out already, or you would never want to watch anyways
8. Watch another unskippable trailer
9. Finally get to the main menu, hit play
10. Send movie back if you rented it, or put in your comically oversized DVD storage unit

Filesharing

1. Find the movie online, click download
2. Wait an hour for the movie to download (or less if you have a fast connection)
3. Connect computer to TV. Hit play. Movie starts.

With these stark differences, it isn’t hard to see why some prefer downloading movies versus purchasing them. The most absurd part of this is that since move movies downloaded illegally have already had their ads stripped away, only the legitimate purchasers must sit through warning after warning and then watch ads that can’t be skipped. What industry is there where producers can hold users captive like this? In a supermarket, if I don’t need any milk, I can skip that aisle and go straight to the cereal. When I buy a TV, I don’t have to sit through 10 minutes of advertisements for “other great Samsung products” every time I turn it on.

This type of mistake has been repeated in many other industries struggling to comprehend just how significantly the internet has changed their business model. The London Times lost 90% of its online readership after instituting a paywall. Still, there are no plans to go back to an ad-supported version.

While iTunes has simultaneously created and captured the digital music market, the restrictions placed on downloads from the iTunes Music Store only recently became unencumbered by DRM. Previously, songs you purchased would only be playable on an Apple device. By moving with the market instead of against it, Apple has shown common sense that seems to be lacking in many segments.

Part of the problem seems to be a holdover from a time before the internet, where publishing a book required the coordinated efforts of many parties. With the advent of shared hosting for $5 a month, anyone can now publish their thoughts online for basically peanuts. (This is the part of the movie where the actor looks at the camera and says the title of the movie).

With always declining prices on digital music equipment and computers, anyone can be their own producer, distributing on iTunes or Amazon. No longer are teams of marketers needed to promote a new artist’s single, since a top result on Hype Machine can rocket you to the top.

The fact is, no DRM is perfect. There will always be the Analog Hole, and history has shown how quickly even the toughest encryption on digital media has been broken. Not until media is distributed by encrypting it with someone’s public key will we be able to eliminate digital copies. Once a single copy is made, it doesn’t matter how strong the DRM originally was.

Note: In this post I will use “Google” to represent all search engines. It’s the only one that really matters, right?

With a fairly uncommon last name, you’d think that getting to the top result wouldn’t be much of a challenge. However, just a couple weeks ago I was on the second page of results for “Oldak.” It was at that point that I decided to take matters into my own hands and see just how high I could go. For many web designers, SEO is a snake oil business which profits off the egos of others. However, there is some truth to the industry, and in this post I aim to highlight a couple of the ideas I tried that have definitely paid off. In a very short time period, I was able to get to the #4 spot, and will continue to try for the top result.

Low-hanging fruit:

The easiest steps to getting noticed by Google should be common sense.  Google employs “robots” to scour the web for content, so if the robot can’t read your site, it will ignore it.  Plain text, clear content areas, and proper headings all contribute to this.  Presenting content in a standardized way may seem boring, but Google loves it.  In my previous site, all my content was in my Flash .swf file.  At the time (I think this has now been fixed),  Google could not read Flash text, and thus my entire site was represented in Google by one result with the words “This site requires Flash.”  Not the best first impression.  With a mostly text layout, Google can quickly grab all your content and index it for potential visitors.

With a WordPress site, several other tricks were available.  A simple plugin enabled me to generate dynamic sitemaps, which told Google exactly where everything is on the site.  Additionally, the plugin notifies Google whenever I make an update.  This allowed me to quickly get my results into Google in an organized fashion.

Slightly more difficult:

After I had the initial site set up, I was still disappointed by my progress. For one thing, old results from my previous site were still coming up.  Plus, I had no actual knowledge of how people were seeing my site in search results.  Enter Google Webmaster Tools.  This free product allows you to do many tasks relating to the relationship between your site and Google.  I used it primarily to check my robots.txt file and remove old results from their index.  Webmaster Tools actually allows you to submit requests for the removal of specific search results.  In my case, my robots file was excluding them, but Google simply hadn’t checked it in a while.  I was able to get them off the results in less than a week.

Notes:

SEO is not a magic pill or golden gun.  It will not allow you to get your lemonade stand to the top result for “drinks.”  However, it will usually help you get to at least the front page for relevant searches.  Also, through the process of optimizing my site, I feel that I made it better for my visitors as well, which is the whole idea anyway.  Clear navigation helps visitors navigate your site more easily, and clear headings tell them what to read.  Most importantly, the old tricks of SEO do not work anymore.  Putting links to your site on every forum or adding 200 invisible keywords on your homepage might have worked in the past, but search engines have learned to ignore those in most cases.  The best way to get more visitors to stay longer and return is to have good content, updated frequently.  If someone’s already seen your site, what will make them come back?  And will they want to if they can’t figure out the navigation or find the content useful?

I can’t spend too much time poking around right now, but should be able to spend some time reviewing the new features pretty soon.

Comments are welcome, please feel free to contact me.