Pattern Finder

Google Apps: The Latest, Latest Glitch

Image via CrunchBase

TechCrunch is pointing to a blog post by security consultant Ade Barkah, who is reporting that he's found some security issues with Google Docs:

1. No protection for embedded images: If you embed an image within a document that you shared with someone, if you later revoke their access to the document or even delete the document, they can still see the image.
2. All versions of diagrams are stored and remain accessible: If you've revised a document multiple times and consequently it includes multiple revisions of an embedded diagram, people with access to the document can still go back to previous versions of the diagram by altering the revision number in the URL.
3. Viewers whose access privileges have been revoked can still access documents in some cases: "Even if you unshare a document with a person, that person can in certain cases still access your document without your permission, a serious breach of privacy.  For now I’m withholding the mechanics of when/why/how this happens, pending further research and feedback from Google if any."

This is beginning to get tedious. A little over two weeks ago I had a post about another lapse in Google Docs security. Rather than tedious, Google's lack of response for five business days is alarming. Ade says,

These findings are based upon my investigations stemming from Issue #1 above.  I disclosed this particular issue to Google on March 18.  I tend to follow rfpuppy’s Full Disclosure Policy and so waited five business days for Google to comment.  I’ve yet received any response from Google other than the usual automated, canned reply (which I don’t consider a real response.)[Update 3/26: I'm now in contact with Google Security.]

Note that Google didn't reply until Ade went public.

This is yet another example of how Google--fundamentally--does not understand selling to the enterprise. First, during the entire two plus years of availability of Google Apps Premier Edition (GAPE), it looks like it never had a code walkthrough to ponder the possibility of this behavior. (Given Google's branding pitch of hiring only really really smart people, I find this hard to believe.) Or, if it did, it decided it wasn't a risk worth fixing. Second, rather than issuing a quick "Thank you, we're working on it" to Ade for doing their work for them, they ignored the issue until it started turning into a PR fiasco.

When I wrote my first 55-page report on GAPE back in August 2007, I was not kind to Google, saying GAPE was not ready for primetime in large enterprises. Although I didn't say so in the report, frankly, I was figuring Google would fix the issues over time (e.g., embedded e-mail distribution lists, administration by role) and by now it would have a competitive package. Now I'm inclined to think that's never going to happen. 

Stephen Elop Ruminating on Microsoft and Its Strategies

Image by

Microsoft

via CrunchBase

Knowledge@Wharton has an interesting interview with Stephen Elop, the President of Microsoft's Business Division (Office, SharePoint, unified communications, and Business Dynamics). He joined Microsoft in January 2008 after stints at Macromedia, Adobe, and Juniper Networks, so as a recent addition he's spent the past year ruminating on what makes Microsoft Microsoft. While you need to take it with a grain of salt (Knowledge@Wharton interviewed him after he gave a keynote at the Wharton Business Technology Conference pitching Microsoft as an innovative company), I think it does offer insights into Microsoft's psyche.

Some quotes:

• "UC is a multi-billion dollar business. SharePoint surpassed a billion dollars for the first time last year. Anywhere else on the planet, those smaller businesses would be entire companies all by themselves. Given the scope of Microsoft, they're part of a division."
• "This is a defining characteristic of Microsoft. Microsoft is very willing to be self critical, harshly self critical, willing to take a look at something we spent a bunch of money on and say, 'You know what, that was a mistake. We shouldn't have done that. Time to change plans. Time to move on.'"

He talks about six strategic imperatives within the Business Division:

1. Fully embrace software and services: "...don't hesitate, don't try and put a moat around the traditional [products]."
2. Extend our business value advantage for customers: making sure that Office, SharePoint, UC are not siloed but rather "a group of capabilities that interoperate well with ourselves and our competitors."
3. Delight our customers with unparalleled experiences: "Microsoft does this sometimes; other times it does not. I came from companies where the experience is fundamentally the differentiator."
4. Innovation: "Part of the reason we're here today [at the Wharton conference] is to stake out the position that we're driving innovation more aggressively than we've ever done in the past."
5. Epitomize operational excellence: "...quality in our engineering, customer satisfaction, hitting the numbers, driving revenue growth, driving margin growth. All the things you need to do to run a business."
6. Employee excellence: "At Microsoft, there is more time spent, more investment in ... communicating about individuals -- their performance, how to advance their career, how to help them develop as individuals. It really is remarkable."

He also points out that Microsoft is working to offer "contextual applications" (my words, not his): "They'll do simple editing, creation, viewing and so forth in the browser. But when they're polishing up the final version of their term paper, research document or a proposal for funding, they will likely take it into the rich client environment for the highest degree of capability."

Worth a read if you're trying to discern Microsoft's future direction.

Ernie Roberts--A Blogger Before There Were Blogs

Cover via Amazon

An uncle of mine, Ernie Roberts, died on Monday. It's not a name that means much to most people--unless you're a sports aficionado in the Boston area. Then it means a lot. He worked at The Boston Globe newspaper from 1947 until 1983, working his way up in the Sports department hierarchy--from evening sports editor to sports editor to executive sports editor. He was instrumental in making The Boston Globe's Sports section the powerhouse that it was in the 1970's and 1980's. The story in the Globe notes, "He's probably more responsible for making the Globe sports section great than any other individual," said Globe sports columnist Dan Shaughnessy.

Most readers of the Globe didn't know him as an architect of the Sports section's writing dynasty. Instead, to them he was just another Globe columnist--but with a gimmick. Because Ernie always started his column talking about breakfast--what he had that morning, or what some sport celebrity's favorite breakfast was. After I moved to the Boston area in 1975 I'd read his column from time to time and I can still remember being struck at how casual it all was. He'd start with the breakfast thing, and then talk about this, and then talk about that. It was very casual and conversational--back in a more formal time when most business people wore suits and ties to work and the term "business casual" hadn't been invented.

Now that I think back on it, Ernie was ahead of his time--he was writing a blog before blogs were invented. He instinctively realized that people hungered for a quick, casual conversation--even while he labored at a newspaper, the classic broadcast medium--and he gave it to them. In other words, Ernie and others popularized a writing style that finally found an outlet when blogs came along--a quirky, quick commentary on events of the day.

I'll close with an Ernie story that's probably more of a commentary on me, rather than my uncle. Ernie called me one afternoon in 1978 when I was working at John Hancock in Boston. Excitement was high at the time because the Red Sox were in a tight race with the New York Yankees for the American League East. Ernie had some extra tickets for a Boston/New York game at Fenway and had called to ask if I wanted them. (At the time I lived in Salem, MA and took the commuter rail back and forth to work.) I did a quick calculation, figured that the game would get out late and that I'd be taking a midnight train back to Salem, and declined them. When I casually mentioned to my underwriting colleagues that the Executive Sports Editor of The Boston Globe had offered me free tickets on the third base line to a Red Sox/NY Yankees game--and that I'd declined them--I was almost lynched on the spot.

Interesting Interviews with Engineers

The Crazy Engineers web site has a section entitled "Small Talk," where they post interviews with engineers of all flavors: software engineers, structural engineers, car designers, aircraft designers, etc.

Here are some interesting talks with software engineers:

• Paul Buchheit, who worked on Gmail, Adsense, FriendFeed, and invented Google's "Don't be evil" motto
• Mahesh Murthy, who dropped out of engineering school and did early site design work for Yahoo! and Amazon.com
• Clayton Stark, VP of Engineering at Flock, a company building a "social web browser."
• Florian von Kurnatowski, Director of Product Management at Scalix, an e-mail/calendar app based on HP's old OpenMail product.
• Bjarne Stroustrup, the inventor of C++

What I Think the Next Version of SharePoint Will Look Like

Microsoft SharePoint is a very popular topic with our clients: what it's useful for, how they should govern it, what its gotchas are, and so on. Needless to say, a common question is, "What do you think is coming in the next version of SharePoint?"

My typical response is to chuckle and say, "Beats me. Microsoft hasn't told me." (Which they haven't. I got their vision view 18 months ago, but nothing specific recently. That will probably change in the next several months as the next version of SharePoint rolls into beta.) However, after saying that, I then go on to say, "But that doesn't mean I don't have an opinion. Here's an educated guess at what I think will be in the next version. This takes into account how Microsoft thinks about the world, current product holes that need to be fixed, and weaving together disconnected comments made by Microsoft."

So when clients ask, "What's in the next version of SharePoint?" here's what I've been telling them.

The Vision is Moving to Ubiqitous Information
SharePoint 2007 and Office 2007 were about binding the two products together: Office was the runway into SharePoint, and SharePoint is the portal for information workers. When fending off productivity suites such as OpenOffice.org and IBM Lotus Symphony, Microsoft counterpunches with, "Why do that? You lose the synergy with SharePoint." When you add Microsoft's cloud initiative (Azure) to the mix, SharePoint 14 will be all about gathering the information that information workers need no matter where the information resides or where the worker resides. Office and SharePoint integration will probably become tighter, but the integration points will become broader as well: the cloud, mobile workers and devices, business intelligence, etc.

Consolidated Administration of Multiple Server Farms
In terms of administration, SharePoint 2007 still shows its departmental portal heritage: the server farm is the highest point of integration. Enterprises fielding multiple server farms have to manage them with separate consoles. Third parties have rushed in to fill this void, and at the moment Microsoft points to them when customers bring up the issue. While that's not a bad bridge strategy for several years, at this point Microsoft needs to step up and offer uber administration capabilities if it wants to continue to fuel SharePoint growth. This should include not only general administration capabilities, but also the unifying of taxonomies (a la SchemaLogic) and site design.

The Line Between In-House SharePoint and Hosted SharePoint Will Blur
Microsoft offers both software and SaaS (SharePoint Online) versions of SharePoint. In fact, it recently announced that SharePoint Online was now available outside the U.S. At the moment, the two offerings are somewhat different--for example, enterprises can customize the version they're running in-house more than the online version. However, over time those differences will diminish, to where an enterprise will be able to sign up for a SharePoint license and be able to move the systems around with relative ease (60% in-house/40% in the cloud today; 50% in-house/50% in the cloud two months from now).

SharePoint Search Will Be Bolstered
On this point, Microsoft has been more forthcoming. The company has been working at folding some of FAST's search technology into SharePoint and is now talking about two forthcoming products: FAST Search for SharePoint (search behind the firewall) and FAST Search for Internet Business (search within a company's web site). The Microsoft press release is here; Larry Cannell's blog post about FAST Search for SharePoint is here. The UI within SharePoint Search will probably improve (a la third parties such as Coveo) and people search will probably improve as well.

Hopefully, Social Software Will Improve
The blogs and wikis that ship with SharePoint 2007 have all the earmarks of a last-minute addition: enough to be hawk the features on the datasheet, but not much else. Because of that, SharePoint customers have been doing one of three things in this area: (1) making do (usually enterprises that have never used a blog or wiki before), (2) using a third-party vendor that integrates with SharePoint (e.g., Atlassian or Socialtext), or (3) going for a social software platform, such as Jive. In short, Microsoft is losing business here, and it will improve its social software offering to fix that problem (I hope).

Those are my thoughts; it will be interesting to see how closely they map to reality a year from now.

Google Apps: The Latest Glitch--Marking Private Documents Public

Image via Wikipedia

It recently came to light that a small percentage of the documents stored in Google Apps were available when they should have been locked down. Apparently, if a document owner or collaborator with sharing rights had previously shared a document and then altered its sharing rights by altering the sharing rights of multiple documents at once, then those documents were still accessible. This issue applied to word processing documents and presentations; it did not affect spreadsheets. Google discussed this issue in the Docs Help forum; other stories are here: CNet, PCWorld, TechCrunch).

Google, of course, is soft-pedaling the issue, estimating that it affected less that 0.05% of the documents stored in Google Apps. However, if you do the math, the number of affected documents runs into the hundreds of thousands. As of September 2008, Google was saying 500,000 companies were using Google Apps, with 3,000 companies signing up per day. That comes out to roughly 800,000 companies now (500,000 + 300,000 [3,000 x 20 business days in a month, times five months (October-February)]. Assuming each company has 50 documents stored (a conservative number), that comes out to 40 million documents. 0.05% of that number is 200,000 documents: not a small number. In addition, I would argue the scenario Google describes is the one you would take with laid off employees--as employees, they would have had access to the documents; after you laid them off, you would have stopped their access to the whole set of documents in a library. So while the percentage of affected documents is low, the scenario is one that could do you damage.

This is not to say the same problem doesn't happen with software-based systems: companies forget to remove logins for laid-off employees and former partners; employees load up their portable USB keys with confidential documents all the time. But it does show that SaaS-based solutions are not heralding in a new era of pristine perfection, as the feel-good presentations from companies like Google and Salesforce.com often imply. Once again, enterprises pondering a move to the cloud need to think through the perils of entrusting their information to a third party.

Saving Money in IT: Granularity Is Key

Saving money in IT is certainly on everyone's mind these days, and one of the keys to doing so is using "granularity."

Huh? The idea is that for a long time, IT has not been very granular in its approach to things. Purchasing over capacity has been a way of life. The mainframe is a perfect example of this: this was a huge box, much of which sat idle until the enterprise had written a bunch of programs for it. Things got a bit better once minicomputers and PCs came along: you could size the box to its tasks. But even that wasn't quite right: if you bought a new application, it usually required a new server. So you had a bunch of computers, all of which had some excess capacity within them. If you could add all of that excess capacity together--and use it--then you probably could coast for a couple of years without having to buy a new computer.

The thing that has added granularity to hardware is virtualization. Now you can split a physical server into multiple virtual machines--and expand or contract the size of those machines as needs dictate. This ability to make a machine just the right size helps explain virtualization's current popularity. It comes down to granularity.

When it comes to software, we've once again typically taken the "big box" approach--or, to be more accurate, the "big list of features" approach. Somebody needs a productivity suite? Give them Microsoft Office. It does everything and then some. In many cases, it does more than the employee needs; but there's no easy way to get Microsoft Office lite from Microsoft. Some enterprises fix that by not buying Microsoft Office for casual users.

However, that is starting to change. Google, OpenOffice.org, IBM Lotus, Sun, and others are offering productivity suites with less functionality than Office--but also making the argument that that's OK because they cost less. Their wins are typically not in displacing Office--but rather in giving productivity suites to users who had none. Once again, it comes down to granularity.

And that makes sense--one of the ways you save money is by buying exactly what you need and nothing more. In the past, due to technology constraints, IT has had to overbuy--but those days are waning. State-of-the-art IT shops are focusing on granularity--whether it's in the form of virtualization or segmenting their employees--and are saving money while at the same time supporting the business.

Note: cross-posted in the Burton Group CCS blog