“There was a vulnerability with RubyGems.org, which allowed someone to execute code on the server,” a Ruby programmer I talked to said. “RubyGems is a big target, because if you could break in and change a Rails gem, you could gain access to a lot of servers.”

Popular sites such as Twitter, Groupon, Airbnb, and Hulu are built using Ruby on Rails, a framework built in the Ruby programming language. Ruby gems are packages of code that allow developers to distribute programs or libraries, and RubyGems.org is the central means the Ruby community has to publish and distribute those gems. Essentially, if a black hat hacker can corrupt those gems, he or she could potentially gain control of thousands, if not millions of sites around the world that run Ruby on Rails.

Source: https://gist.github.com/3e4829f79dbd1be11295

The exploit itself

“RubyGems is a critical part of the Ruby infrastructure,” the programmer said. “Everything depends on RubyGems.”

RubyGems explained the situation this way in a Google doc that site administrators set up for status updates:

A user uploaded a malicious gem that contained a malicious gem manifest (YAML file). The manifest contained embedded Ruby with this payload. This is the only known incident involving this vulnerability, but the vulnerability involved is a remote code execution exploit, so the usual rules apply.

The Ruby programmer I talked to, who did not want to be identified since he works with some of the key engineers at RubyGems and Heroku, said that the infected gem was executed by the server and then “emailed the database configuration details, including passwords, to a paste-it note on Pastie.org.”

As soon as Heroku became aware of the issue this morning, site administrators disabled access to site update and publishing services:

Ruby deploys have been temporarily disabled to protect our users from malicious gems. We will have more information available shortly, including a workaround for those who wish to deploy anyway.

Based on the information currently available, it doesn’t appear to have been an especially malicious attack, but rather a fairly strenuous way of informing the RubyGems organization that they had a vulnerability. The infected gem was called “exploit,” a pretty clear signal that the author or authors were not trying to slip something in unnoticed, and “they could have done more,” my source said.

Currently, RubyGems is verifying all files by comparing them for differences with older version before re-enabling all access to  functionality. The last update as of 7:30 PM PST is that the service’s classic API is up, as well as its V1 API, but its web application and Dependency API are still down.

photo credit: Andrew* via photopin cc

The social media marketing platform that competes with the likes of Wildfire, Sprinklr, and Involver grew 440 percent last year, went global, and added companies like Coca-Cola, Amazon, and L’Oreal — you may have heard of them once or twice – to its now 8,000-strong client list.

How? Through the back door.

“We’ve basically built our company around the notion of a self-service platform,” chief executive Wendell Landsford told me from New York today. “People try for free, and if they see value, they keep using the product.”

That started with perhaps humble beginnings with small companies as social marketers created Facebook photo contests and Twitter retweet offers. But it led to massive opportunities at some of the largest corporations in the world.

“As we got success on the self-service product, we started to be adopted bottom-up in enterprise organizations,” Wendell said. “In companies like Unilever, Viacom, or Pepsi, some marketer might try OfferPop. Then we’d reach out, establish a relationship, and get more exposure in these companies, which broadened our footprint.”

Initial success led to Offerpop codifying these opportunities into a sales process, and the company now has a specific division of its sales force dedicated to key enterprise accounts. It’s the new enterprise sales model, Wendell says, with Salesforce.com as its “poster child.”

The model works for upstart young startups. But it also has significant benefits for enterprise companies. As Wendell says, one massive bonus to this model is that a product “has to prove its worth … companies don’t end up with shelfware.”

Offerpop, which closed a $5.7 million series B founding round in December, is now expanding internationally, opening an office in the U.K. and one other to-be-determined location. That’s a direct result of having internationalized the product, translating it to 17 different languages in early 2012. (Which, by the way, is also helpful for major brands, who typically do business internationally.)

Perhaps the most interesting news, however, is the new product suite that Offerpop will be announcing in February. While the company wouldn’t release full details yet, Wendell did give me a sneak peek: “big data.”

“As companies use Offerpop and expand to 350 campaigns or more, there’s a ton of data that gets built up and captured,” he said. “Historically, that’s been kept in individual campaign reports, but it doesn’t provide cohesive, actionable insight.”

So Offerpop is pulling out all the data from all of a company’s campaigns, enriching it with everything that it knows about the company’s fans and customers — including the content they tend to respond to — and making is useable for better marketing on social media, as well as multichannel marketing via email, online marketing, and more.

It’s probably not a coincidence that this product sounds perfect for enterprise as well.

photo credit: Dunechaser via photopin cc

Sept. 9 - 10, 2013 San Francisco, CA

Early Bird Tickets on Sale

Blue Jeans Network, the company that offers super-simple video conferences in the browser, is announcing the first-ever videoconferencing integration with Salesforce.com.

The company, which we covered back in June, was also the first to allow videoconference participants to join conferences originating on legacy videoconferencing equipment simply from a common web browser. Now Salesforce.com clients will be able to initiate or join video conferences without leaving their SalesForce application.

Source: Blue Jeans Network

Blue Jeans’ video conferencing in a browser

Video conferencing is a hot and rapidly-evolving space. Vidyo, the company that supplies the technology for Google+ Hangouts, recently revealed VidyoWay, its solution for seamlessly connecting multiple video endpoints, each with potentially different video conferencing solutions. And industry heavyweights such as Polycom are releasing new products and services to compete with the startups.

Blue Jeans has pinned its competitive differentiation on dead-simple implementation, integration, and use. If you have a web browser, you can use Blue Jeans. That simplicity overlays significant technical complexity, as chief executive Krish Ramakrishnan alluded to in a statement:

“We are the first and only company in the world today that can conduct a single video meeting using endpoints as disparate as Cisco, Polycom, LifeSize, Skype, Microsoft Lync, Google, and even a browser.”

Blue Jeans said it will demonstrate the new technology at DreamForce 2012, the annual Salesforce.com conference.

photo credit: FaceMePLS via photo pin cc

July 9-10, 2013
San Francisco, CA

Tickets On Sale Now

As a software securities analyst for investment banking firm Canaccord Genuity, Richard Davis spends 200 days a year on the road visiting companies. He goes to public companies such as Oracle and Salesforce.com, but he also visits up-and-coming software companies he thinks will go public in the near future. In his new column, Davis talks about some candidates he thinks may be ripe for the IPO class of 2012 or 2013.

Xactly Corporation: Compensation management

I hadn’t met with Xactly CEO Chris Cabrera for more than a year, so it was good to catch up. Customer demand for the firm’s SaaS compensation management suite has apparently reached a tipping point. The firm focuses direct sales on six-figure deals with larger enterprises. This business, based in San Jose, CA, has a solid double digit growth trajectory. In addition, Xactly wrote a small- and mid-sized business version of its platform on Force.com. As part of that eco-system, Xactly is able to use Salesforce’s sales team, which means access to CRM’s 100,000-plus customer base.

Of course, having target customers is nice, but the key to Xactly’s elbow in growth has been the inexorable logic of automating and optimizing compensation structures for commissioned sales reps. In this respect, Xactly has benefitted from the market development buzz created by adjacent HR firms like SuccessFactors, Taleo, SilkRoad and Workday, and the recognition that HR is in desperate need of an upgrade. In Xactly’s corner of that world — compensation management — the firm often replaces Excel spreadsheets.

Xactly is entering that period of time when the years of hard work are beginning to pay off; this is when firms win the occasional “blue bird” deal, results come in above expectations, and board and operating committee meetings are something you look forward to.

Estimated revenue range, 2011: $30-50 million.

Implications for public company investors: Demand for HR upgrades remains strong.

ON24, Inc: Webcasting and virtual events

In this follow-up meeting, we drilled down to discuss how San Francisco-based On24 views itself. Specifically, we talked about On24’s delivery of live, streaming virtual events and whether this was a revenue generator or cost savings play. The reality is that the firm does both. Virtual events, like online tradeshows, generate new leads and sales for the presenting firms. For example, Autodesk, Oracle, Astra Zeneca and CA have deployed On24 for both tradeshows and training events.

Interestingly, some of the attendees to these virtual events spent upwards of five hours online. A viewer/user saves money for travel and can attend specific events of interest. Sometimes new customers come into the On24 ecosystem when a firm wants to host an internal Town Hall meeting. On24 makes the process of assembling the audio-visual and broadcast systems easy for these customers. More often than not, a new user recognizes that the process is painless and cost effective, and this leads to future orders. On24 sells live virtual access on a per user basis or in five, 10 or larger subscription packs that are valid for a year.

Competition is primarily “do nothing” or get on an airplane. Cisco’s Webex is a fine solution, but its focus is fewer users. Citrix has a competitive product in GoToMeeting, while Microsoft is apparently asking users to move off of Live Meeting and onto a collaborative Office 365. We do not view non-live streaming firms like BrightCove as a viable competitor to On24.

Estimated revenue range, 2011: $50-100 million.

Marketo: Sales and marketing management

I met with Marketo‘s “new” CFO of six-months, Fred Ball. We compared our views on the competitive environment. San Mateo-based Marketo has been one of the pioneers in B2B marketing automation; specifically it helps companies convert leads to revenues. In a world in which most companies have cut costs just about to the bone, growing revenues is something that we believe will become much more important. Business-wise, Marketo has been gaining customer count share since the firm introduced its highly functional, reasonably priced Revenue Performance Management suite.

Companies like Marketo are what make this job fun. I met this company when it was barely a dozen people making a few hundred thousand in revenues. I always respected CEO Phil Fernandez back from when he was at Epiphany and Red Brick Systems. Marketo’s primary competition is cobbled together legacy systems and Microsoft email. Other firms include Genius.com and Eloqua. We were impressed with Genius.com and that firm’s vision, and Eloqua has a solid reputation as one of the pioneers in this space.

Estimated revenue range, 2011: $20-50 million.

Richard Davis is managing director of enterprise software for the brokerage firm Canaccord Genuity. Before joinging Canaccord, he spent 10 years as a senior analyst at Needham & Company. Previously, Davis was at Tucker Anthony, where he was a managing director and launched the firm’s Internet and enterprise software coverage.

Arrow image via Shutterstock

Nitro integrates with Force.com and is scalable and customizable. Nitro has more than 100 customers with millions of users, but the Salesforce.com integration is a coup because it is a high-profile cloud-based enterprise service with more than 105,000 customers. Nitro for Salesforce.com will be available on the Salesforce AppExchange.

The San Jose, Calif.-based company is also launching Nitro Elements, a stripped-down version of Nitro that allows site owners to post simple games such as poker through widgets. Web site owners embed the widgets in their web pages and let users play games with site-oriented goals as the rewards. You can, for instance, play online poker directly on the site. If you want to get more poker chips, you have to perform an act that the site owner wants, such as watching a video.

With these simple point solutions, companies can experiment with game mechanics that can be deployed quickly and inexpensively, said Rajat Paharia, founder and chief product officer at Bunchball. Bunchball has a number of games from the days when it was a social game company. It is taking titles from that library of 30 or so games and is making them available to customers.

“We learned that some people want some deep gamification and some want it light,” Paharia said in an interview. “We took some best practices and offered a slice of the overall platform with Nitro Elements.”

Nitro Elements has two different apps available. One is called FanBox, which lets companies reward users for completing actions like tweeting, watching a video or sharing content on Facebook. The app can be deployed in a matter of minutes with little or no technical expertise. FanBox is priced on a usage basis, so marketers only pay when users take actions.

Also, part of Nitro Elements is GameBox. The app is designed to help companies increase daily visits, lengthen time spent on the site and improve monetization via simple online social games like poker. Users receive a daily allotment of chips for visiting the site and can buy additional chips with real money.

“Clearly, social networking has exploded,” Paharia said. “We can take it to everyone.”

Bunchball’s customers include Warner Bros., Comcast, USA Network, LiveOps and Hasbro. The company was founded in 2005, and its investors include Granite Ventures, Triangle Peak Partners, Northport Investments, Correlation Ventures, and Adobe Systems. Bunchball has 40 employees. Rivals include Badgeville and Big Door.

ContestSpigit is a $5,000 a month software-as-a-service offering for businesses that want to interact with an external audience of customers, partners or the community at large, said Richard Tso, head of marketing for the Pleasanton, Calif.-based firm. “It’s like the next generation of crowdsourcing, if you will.”

The three year old company has raised $14 million in venture capital, most recently a $10 million round from Warburg Pincus in October 2009. It’s also undertaken efforts to fold itself into the Microsoft SharePoint collaboration platform.

Spigit’s existing platform, EnterpriseSpigit, lets companies solicit feedback from its employees on how to solve a problem. Pharmaceuticals giant Pfizer, for example, used EnterpriseSpigit to get suggestions from employees on how to lower costs, create new products and pursue innovation.

ContestSpigit is a platform for creating contests designed to invite people to interact with a company. Cisco Systems already uses ContestSpigit for its iPrize initiative, a competition to help create Cisco’s next $1 billion business.

Pepsi and Chase bank use social networking to guide their charitable giving, although not on Spigit.

ContestSpigit gives companies four basic models for holding contests, said Hutch Carpenter, the company’s vice president of products:

* The “You Vote, We Decide” model invites participants to vote on an idea and provide feedback, but the ultimate decision rests with the company. A public company like Cisco or Pfizer would have to consider shareholder issues, for instance, not just the consensus of the crowd.

* The “Crowd Decision” gives all authority to the crowd. The highest vote getter wins. This model is not likely to be used for strategic decisions, Carpenter said, “but this concept is great for engaging your audience … and for letting them communicate to you what they think is the meaning of your brand.”

* The “Expert Decision” model is reserved for highly specialized or technical decisions made by a smaller crowd of experts. Netflix, not a Spigit customer, used this model to conduct a contest that awarded $1 million to the first person to improve the accuracy of its movie recommendations for subscribers by at least 10 percent.

* The fourth model is the “We Vote, You Decide” model, which Carpenter also affectionately calls the “American Idol” model. In this case, the company solicits all sorts of suggestions, but narrows down the choices over time, just as Simon, Randy, Ellen and Kara do on the reality TV show, then turn the process over to the fans to pick the winner via phone call or text message. “The experts make a selection and kind of filter out the worst of the crop … guiding the process toward a certain area,” said Carpenter.

Spigit compares its service to Salesforce.com’s Salesforce Chatter offering, which was released in beta form Feb. 17. Chatter is described as a “real-time enterprise collaboration application and platform” that also includes some of the features of consumer social networking apps such as Facebook, Twitter and Google Buzz.

But Spigit goes Chatter and the others one better with what Tso calls “idea trading,” in which one person’s idea is commented on by others and builds support among members of the crowd.

“You can buy and sell the idea on an open market within the organization … based on the likely outcome that it will be adopted by the organization,” Tso said. “We aren’t just a ‘post and vote’ type of platform. Our algorithms surface the best ideas.”

Spigit’s next effort is to deliver ContestSpigit on mobile devices from Apple and RIM. Salesforce Chatter is already available on mobile devices.