post

Micro-chunking Software: Tibco and Zoho CEOs Sing the Same Song (Just from Different Notes)

puzzle This should probably be a Tweet, but I am not smart enough to squeeze it into 140 characters – perhaps Tumblr or Posterous notes?  Anyway, I am in a rambling mood – but I’ll keep it short, just pointing to stuff I read.  After all, there’s a reason why my personal blog has the tagline Connecting the dots. 🙂

The death knell is ringing for Customer Relationship Management (CRM) packages, according to Vivek Ranadivé, Tibco’s chairman and CEO.

“The enterprise 2.0 world we live in today is transaction based, but we are now entering an era where events will replace transactions. We will move from this world where we continually have to ask questions and seek information into one where the information will seek you.”

The technical enabler is the reduction of costs for solid-state memory and the arrival of larger multi-core processors – the result is software that reacts  to what we’re doing at any moment in time, instead of us pulling up big monolithic applications.

The other “dot” I’m connecting this to is a blog post by Zoho CEO Sridhar Vembu:

One of the architectural themes that is driving our evolution is the focus on the user’s context and workflow and avoiding the context switch as much as possible. Context switching is expensive. It destroys the flow and rhythm of a users, and is a real productivity killer,  as I discussed with Larry Dignan of ZDNet last week…

…the boundary between apps tends to dissolve, as data flows contextually across apps. Apps move to the background, data and context start to dominate. In the cloud world, data is not the slave of any particular application, but flows to whichever context that needs it.

My take: CRM?  I don’t even know what it means anymore… just ask Paul Greenberg about the ever expanding definition of Social CRM. It’s certainly not just one application.  Same for ERP.  Or Office, for that matter.

Applications will go away.  Instead, we’ll have functions.  Functions that sense what we are doing and offer up the right options – based on both data and perhaps our own activity profile (example: looking at a table – some might process it with a spreadsheet, others prefer a database or word processor).  Or just self-acting agents.  Micro-chunked functions served up software. I first discussed the concept two years ago.

Now, isn’t this in sharp contrast to what I said about Application Suites?  No: first of all, that was a market-reality based view vs. visioning here. Second, it’s Suites are not necessarily monolithic giants, it’s about the integration of apps, bringing the right micro-functions available to the user at the right time in the right context, no matter what the “App” is called, and doing it all in a unified UI environment.  Read more on the componentization of software here.

Wow.  This is definitely not Twitter-sized. 🙂

(Disclosure: Zoho is CloudAve’s exclusive Sponsor)

(Cross-posted @ CloudAve)

post

Does Sprint Limit Using Google Voice?

(See update @ the bottom)
Well, this did not take long. I’ve just speculated that Google & Sprint wanted testers before the commercial rollout of the Android-driven HTC EVO on June 4th – a few hours later I see that theory proven.  I ran into trouble setting up Google Voice, and called the special number given to Google I/O attendees.  Apparently it’s a “discovery period” customer support group, and the rep I talked to was very (unusually!) courteous and helpful – at least she tried to, within the limits of information available to her.  Unfortunately it wasn’t enough.  Here’s the skinny:

I’m in the somewhat rare situation of being able to compare the HTC Incredible on Verizon and the EVO on Sprint, released a month apart, with essentially the same setup, same software releases.  Here’s part of the Google Voice configuration screen on both:

Google Voice Verizon vs Sprint

And yes, the shocking discovery: it appears that Sprint limits using Google Voice to international calls only.  Let me rephrase that: other parts (e.g. voicemail, transcription..etc) of the Google Voice service will still work, but if you can’t initiate calls using your GV number, than guess what, the other party will see your Sprint mobile number, that’s where they will call you back…etc – in other words the key concept of “One number to show”, which is what Google Voice integration is all about, is dead.

The Sprint rep told me she hoped it was a software glitch that would soon be updated, but frankly, the different wording suggests otherwise.  I’m afraid it’s a business decision by Sprint, and one that should be made very, very public.  Full Google Voice integration happens to be a key decision-making factor when switching to Android, for yours truly, forTechCrunch’s Mike Arrington and likely many others.  Not having it could prove to be a show stopper.

I hope it’s not final – Sprint, Google, HTC, whoever – please chime in here.  We need answers.

Update: The short answer, and it’s a good one, it’s not Sprint policy, just an installation glitch. Details:

All of a sudden I remembered that a few weeks ago when I set up Google Voice on the HTC Incredible with Verizon, it refused the accept my existing Google Voice number, so I tricked it: went ahead with the route of setting up a new number, but input y existing Google Voice number, then it worked.

I suppose something got fixed since then, as the Sprint EVO allowed me to link up with the existing GV account, albeit with the limitation shown above… so I started to wonder if I should try the same trick here.  I deleted the Sprint cell number from Google Voice, signed out on the EVO and even deleted the entire Google Voice app (probably an unnecessarily step, but who knows…).   Then I proceeded with the “new number” setup, but of course using the existing account information.  Got into a couple of loops with error messages, nevertheless following all prompts both on the mobile and the GV web side finally resulted in the perfect Google Voice installation, with identical results to the Incredible version (the phone shown on the left).  I’m a happy Google Voice user again.

(Cross-posted @ CloudAve)

post

Enterprise Software Strategy

(Cross-posted @ CloudAve)

post

NetSuite vs SAP … Round #n. A Game Changer?

elephant-flea In my recent Suites post I said there were exactly 1.5 (one and a half) integrated full business solutions (SaaS Suite, SaaS All-In-One, SaaS ERP, SaaS SMB ERP – take your pick or  create a new one) offered as a service.   The one in that equation was NetSuite, and the half is SAP’s Business ByDesign.

The half is getting close to becoming full, bringing the total number of solutions to two.   SAP’s ByD, originally launched in 2007 was a functionally rich solution already at launch – in fact I called it the most complete SaaS Suite not available customers. And therein lies the rub.  Functionally rich, but a phantom product that only a few selected early customers could get their hands on.  And it wasn’t simply a marketing / segmentation blunder as some analyst thought, it was all about architecture: SAP missed out on the economics of multi-tenancy, and realized they could not profitably operate and scale what they referred to as “mega-tenancy” – so they went back re-architecting ByDesign.

The lost 2 1/2 years were a gift to competitor NetSuite, and they milked it every possible way.  SAP announced entry to the SaaS SMB space validated their market, and their own delay was an open invitation to NetSuite. As CEO Zach Nelson said at their recent earnings conference:

I’d like to thank SAP for being our IBM.

NetSuite never shied away from aggressive marketing (I guess that’s the Oracle blood in their veins), starting from pranks like the SAP for the Rest of Us Party during SAPPHIRE 2006 to staging a shootout at the anti-SAP Conference or releasing edgy videos a’la Mac vs Windows.  But the biggest coup, one with definite gains was the Business ByNetsuite program which we covered here:

The aptly named Business ByNetsuite program guarantees at least 50% savings to current SAP R/3 customers relative to  – watch this! – the annual maintenance fees they are now paying to SAP.  Yes, it’s not a price-to-price comparison.  With the perpetual licence model customers pay upfront, but are still forced to pay annual maintenance fees – with SaaS there is only a subscription fee, and now NetSuite proves it can be half of only the maintenance component of traditional software’s TCO.

Yes, NetSuite took deals from SAP and of course amidst all the chest-thumping they did not particularly emphasize the fact that that these were often divisional deals:  smaller divisions of large companies, often replacing legacy systems as a result of an acquisition with the parent company running SAP.  NetSuite even developed  NetSuite-to-SAP connectors for enterprise reporting, fully recognizing they won’t be replacing SAP on the corporate level.

Now of course these were relatively easy wins when NetSuite was the only game in town – and that’s about to change, as SAP is getting ready for General Availability of a new Business ByDesign in July.  And SAP CEO Bill McDermott fired a few salvos over to NetSuite in his announcement, as quoted by Reuters:

McDermott said he believes Business by Design’s sales will be able to quickly surpass those of NetSuite, which last year posted $167 million in revenue.

“When Business by Design is coming at them like a 99-mile-an-hour fastball, let’s see how tough they are,” McDermott said of NetSuite.

Winning against SAP when they had no relevant SaaS offering was one thing, going up against a functionally strong product will be another.  NetSuite is changing tone, comparing the two offerings, as show by this slide I received from NetSuite:

NetSuite SAP

This must be the first time SAP finds themselves on the wrong side of the David vs. Goliath equation (or is it the elephant vs flea?  – but who is the elephant and who is the flea in the long run?).   I have an issue specifically re. the functional shootout, which was rigged at best.

As for the rest of the comparisons, a fair summary is that neither side is a newcomer.   SAP is the granddaddy of business processes with 30 years of experience, but they are new to operating / scaling a cloud environment – something NetSuite has a head start on them.

I have reasons to believe (more on that in another post) ByD will not be a failure this time around, and NetSuite will have to adopt to competing with a real product vs. a phantom.  It will be a healthy change, with customers now having a choice of (at least) two well integrated SaaS offerings.  In the end, customers win.

(Keep an eye open for the next post on ByD and beyond…)

(Cross-posted @ CloudAve)

post

Facebook Big Mac Attack – Not For Me, Thanks. Top 10 Reasons to …

Burger Fat Kid Oh, just what the Doctor has ordered: more junk food coming your way, left and right, from the social network that’s taking over the Internet: Facebook.  McDonald’s will be the first advertiser taking advantage of Facebook’s soon-t0-be-releasing location feature.

The first reaction from most is this will kill leading location-based services: Hey Foursquare, Time To Close That Round Of Funding Before Facebook Chops Off Your Head.  Yes, probably true, but now I am more worried about Facebook users – all of us – then businesses, and not just as a defender of healthier diets.  Greasy or not, it’s not the ads that worry my, it’s yet another level of thoughtless surrender we’ll soon be committing: broadcasting our location every step of the way.

Yes, I realize there may be social benefits from bumping into friends via Foursquare Facebook, but have you really considered the danger of letting the world know where you are every step of the way?   While you think about it, also consider just whose hands you leave all that data in: not exactly the champions of privacy.

The Relationship Between Facebook and Privacy: It’s Really Complicated says Mathew Ingram @ GigaOM this morning, and I strongly disagree.  There is nothing complicated about it.  Facebook does not give a *** about privacy: it’s a concept CEO Mark Zuckerberg finds obsolete, simply does not believe in at all. Now, in reality, even Facebook caves in  to demands of privacy, but they are either careless or incompetent, or both, plugging one security hole after another.

Three strikes and you’re out – I guess Facebook is exempt from that law, now that they are becoming the New Internet.

But people are actually worried about privacy implications to consider quitting Facebook entirely: 10 Reasons To Delete Your Facebook Account.  It’s a post worth reading in full, here are just the headings:

10. Facebook’s Terms Of Service are completely one-sided

9. Facebook’s CEO has a documented history of unethical behavior

8. Facebook has flat out declared war on privacy.

7. Facebook is pulling a classic bait-and-switch

6. Facebook is a bully

5. Even your private data is shared with applications (you are no longer trusting Facebook, but the Facebook ecosystem).

4. Facebook is not technically competent enough to be trusted.

3. Facebook makes it incredibly difficult to truly delete your account.

2. Facebook doesn’t (really) support the Open Web.

1. The Facebook application itself sucks.

facebook internet 2040I must admit for all my grumpiness I have not deleted my account, and I likely will not (not that it would be easy ).  I resisted joining Facebook in the first place, was probably a year or so late, and even when I joined, I created a separate email account just for FB, and disallowed saving any Facebook cookies (remember Beacon? ). But resistance became just too inconvenient… so now I am in. That said I am not particularly active on Facebook, hardly maintain my profile and generally my presence there is a mess (this is where my marketing friends can jump in chastizing me for the lost opportunity).  I’m only sticking around because Facebook has proven to be too pervasive, it is everywhere and (almost) everyone is on it.  So yes, it is great to find long-lost friends and even discover some new ones.  But that’s all for me, and I seriously suggest you all reconsider the level of your presence.

And even if you are very disciplined in your Facebook usage (are you?) read #5 above again.  Just yesterday I was setting up my shiny new Android phone: I decided to enable location information, for the benefit of Google Maps and other really useful services.  But… but..but … I am also tweeting and communicating in a zillion other ways from that same device, and although I will try to be careful about reviewing the permissions of every single app, it’s likely I will slip sooner or later.

So think about this: in this API-driven intertwined ecosystem of mobile and web services, just how certain can you be that Facebook (and others) won’t get information you never intend to give them in the first place, no matter how careful (you think) you are?

Updates:

(Cross-posted @ CloudAve)

post

FUD in the House of SaaS – More on Suites

Recently I wrote about the evergreen Best-of-breed vs. Integrated All-in-One Suite debate again, arguing:

Call me “old school”, but I also believe in the value of having one tightly integrated system for most business needs, and I believe it’s true not only for large corporations but much smaller businesses.  I don’t have CIO’s to back it up, but that’s exactly the point: I am talking about small businesses that don’t have CIO’s at all – in fact they  likely don’t even have full time IT stuff ( a good reason for SaaS in the first place), so they clearly lack the bandwidth to deal with integration issues and multiple system providers.

It wasn’t just hypothetical speculation, what really prompted my post ( and hence the reference to CIOs) was a study conducted by Brian Sommer who contacted several large corporate CIOs about SaaS implementations, and found that despite improvements in technology, and easy integration by firms like Boomi, Pervasive ..etc, CIOs still prefer to buy an integrated suite of applications and deal with one vendor for most of their needs.   It’s not what we think, it’s what they do – and they are the customers.  Says Brian:

But, customers will do what customers want to do.

Amen. But my post attracted a detailed comment from a PR professional (a fact that took a little digging to discover):

… the Suite approach requires the business to make compromises in areas of the business, and only works if you can run your whole business on that one suite – as soon as you need some other specialist system, or acquire another operation that you need to integrate, you’re in trouble because Suites, by definition, are not designed to make integration easy…

…Force.com essentially brings cloud apps together as a Suite by offering exactly the combination of tight integration, common interface and flexibility. Many businesses can already find everything they need on the platform, even the last critical element required for a serious business system: enterprise-class finance 😉 Many companies, especially smaller ones, don’t need a full ERP suite. They need a handful of critical applications that can grow with them.

Wow… where do I even start?   Perhaps by the only statement I can agree with:

Many companies, especially smaller ones, don’t need a full ERP suite. They need a handful of critical applications that can grow with them.

Yes, of course I agree.  In fact I am a small business myself, and guess what, not only I don’t need ERP, I don’t even need or use a CRM system, or one for business accounting.  The only lightweight business system I use is invoicing (happens to be Zoho Invoice), but frankly, I could get away without it.  Yes, some small businesses will want Accounting, and Accounting only, others will need CRM and nothing else – there are many good choices for them. And yes, FinancialForce.com (which the commenter represents) is great, and we’ve given it ample coverage @ CloudAve.

But that’s where reality ends, and plain old FUD begins. There’s nothing inherent in the “Suite approach” that would prevent customization, integration with additional systems, extension by third party apps.  In fact the key difference between an integrated Suite or discrete  point applications is just how much of the core business they cover natively before  add-ons are required.

And here’s the ultimate irony: I was reading these “ex-cathedra” statements (that’s nicer words for BS) while sitting at NetSuite’s SuiteCloud conference, that was all about working with development partners, releasing a new version of SuiteCloud, the app development and integration platform along with SuiteFlow, a graphical modeling and customization tool, and a bunch of other  announcements all geared to making and maintaining a thriving partner ecosystem, that builds on the core NetSuite functionality and delivers additional value to customers.

In fact the evening before the conference, CEO Zach Nelson spent an hour busting industry myths.  Now look at the slide above: he did not talk about NetSuite specifically, he was advocating Cloud Computing / SaaS in general.  That’s the somewhat usual formula:  myth spread by defenders of the “old model” busted by the innovators – who would have expected the old-time FUD served up by a PR flak for another SaaS provider… 🙁

At the conference itself I saw several customers presentations, like that of Campus Villages which replaced 38 instances of MYOB + Intuit MRI with NetSuite OneWorld, including extensions like Nolan Fixed Assets and Electronic Payments, Celigo Smartclient, and are currently evaluating Adaptive Planning.   Those are functions not provided by NetSuite, so guess what – they add third party apps, just like they would to Coda or any other system.

The key criteria for any software company trying to penetrate the SMB market will be vertical industry epxerience, and NetSuite has clearly stated their industry experience is Software and Services – everything else is open to the ecosystem.  Case in point is manufacturing:

NetSuite RootStock MRP

Suites are not customizable?  Just look at  Rootstock, a third-party developer house that created an entire MRP system on the  SuiteCloud platform.  If that’s not living proof of the system’s expandability, then I don’t know what is…

A key difference between the Force.com / Appexchange and NetSuite / SuiteCloud approach is that the former facilitates the creation of any product / utility that you can pick up from a marketplace, while programs developed on SuiteCloude all tie into the NetSuite system very closely – not only on the data but also on the UI level – i.e. the additional business functionality becomes available within the NetSuite UI. In other words they run so smoothly, the fact that parts of the system were written by a 3rd party is hardly transparent to the end user – which is just the way it should be.

So in the end, there is no hard rule that says Suites are inflexible, non-expandable: there only well-written and poorly written Suites, just like well-written and poorly-written point applications.  There will be businesses who only need a few point apps, and should not think of a Suite, and others who will benefit from the All-in-One approach.  It’s their choice.  What they need is honest information, not FUD.

(Cross-posted @ CloudAve)

post

Podcast: Chat With NetSuite CEO Zach Nelson

zach nelson I attended NetSuite’s SuiteCloud Partner Conference last week (see NetSuite coverage @ CloudAve) and had a chance to meet CEO Zach Nelson several times: on-stage, at dinner, and a cozy small-group chat that included several Enterprise Irregulars.  Michael Krigsman of the IT Project Failures fame  recorded the entire conversation, and although it’s an hour long, I recommend listening to it.  It’s a no-nonsense, to-the-point conversation, not a PR message.

This may just be a good time for a little backgrounder on the Enterprise Irregulars, a group I often refer to.  From Michael’s post @ ZDNet:

The Enterprise Irregulars is an invitation only group comprised of top-tier enterprise analysts, observers, industry veterans, and executives. The group consists of a loose affiliation of members who make decisions entirely on a consensus basis, without formal leadership or management.

Despite the highly informal organization structure, the Enterprise Irregulars maintains an active private discussion community and members meet periodically for briefings with vendors.

I’m a proud member of the EI, in fact I am the Editor of the Enterprise Irregulars Blog, an aggregation of (selected) member posts.  Publication of the EI Blog and my other gig,  CloudAve are sponsored by Zoho.

Now, back to the conversation – participants were  Zach Nelson, Jeff Nolan, Michael Krigsman, Ben Kepes and yours truly.  I suggest you head over to ZDNet and listen to it – well worth the time.

(Disclosure: analyst / press / blogger travel and hotel expenses were covered by NetSuite)

(Cross-posted @ CloudAve)

post

Are Suites Really Sour? The Best of Breed vs. Integrated Suite Debate.

The evergreen Best-of-breed vs. Integrated All-in-One Suite debate is back again. This will be a somewhat long post, so let’s sit back and start with some entertainment first.

Episode 2, “Suites Are Sour”  is from the mini-series SuiteMates, which I admit I find hilariously entertaining, albeit rather pointless.  Why?  It’s run by supply chain solution provider Kinaxis, but I don’t see much direct benefit to them. I’m reminded the Bill Gates – Seinfeld commercials: what’s the point?  But hey, we’re being entertained:-)

Now, back to those Suites.. are all Suites really Sour?  Fellow Enterprise Irregular Brian Summer clearly does not think so, his money is on the Suites, here’s why:

One of the biggest value drivers behind a customer’s move to SaaS is the reduced internal IT support cost a company has when using SaaS products. In the SaaS world, the vendor maintains the application not the customer. But, in a best of breed SaaS world, the customer is back to maintaining interfaces and integration aspects across a number of (SaaS) applications.

If the argument sounds familiar, it is – it was the same in the good old on-premise world, but much of it holds true in the Cloud, too.  Besides, this isn’t simply Brian’s own opinion, he has conducted a poll of large corporate CIO’s and most expressed strong preference for integrated business solutions, a.k.a.  “one throat to choke” (well, not exactly with those words…).

Call me “old school”, but I also believe in the value of having one tightly integrated system for most business needs, and I believe it’s true not only for large corporations but much smaller businesses.  I don’t have CIO’s to back it up, but that’s exactly the point: I am talking about small businesses that don’t have CIO’s at all – in fact they  likely don’t even have full time IT stuff ( a good reason for SaaS in the first place), so they clearly lack the bandwidth to deal with integration issues and multiple system providers.

This is not a popular view, after all the Millenial World View is all about open standards and APIs where best-of-breed cloud services that can seamlessly integrate and work together well.  I’m all for innovation, and hope we will get there one day – but for now the existing examples are all one-off, individual integrations between specific systems, or at best, ecosystem “satellites” centered around force.com, the Google Apps Marketplace and the like.  These are great solutions, but not enough to run a complete business on them.  In the meantime businesses are looking for available (Cloud-based) solutions NOW.  So yes,  I admit, my view is less visionary, more constrained by market realities today.

Brian cites WorkDay as a potential SaaS Suite provider: they have the right DNA, coming from the Founder who built once-successful PeopleSoft, and they are building truly Millenial Software from the grounds up as Phil Wainwright eloquently points out – but for now they still have a Human Resources / Finance focus only.  Far from a complete solution, just like the other successful SaaS players in the Enterprise arena, like SuccessFactors, RightNow, ServiceNow, and the like.

Yes, I hear you… I missed a big name: Salesforce.com, the GrandDaddy of SaaS or the Cloud or whatever the next fashionable name will be.  An amazingly successful company, and true innovators – having started as CRM company, moving on to as Platform provider, and who knows, tomorrow it may be a Media company? 🙂  As long as the keep on moving to hot new areas, always picking the low-hanging fruit, the company and it’s stock price will remain hot.  Again, a great company from an Investor’s point of view.  Just not a Complete Business Solution.

One and a half SaaS Suite players

I can count the number of SaaS Business Suites that actually reached significant traction on one hand.  In fact the exact number is 1.5.  Yes, one and a half – and for now they mostly cater for the SMB segment, with undeniable ambitions to “grow up”.

netsuite The “One” in  that 1.5 is NetSuite.  Having started as NetLedger, the company has developed an integrated All-in-One solution, encompassing ERP, CRM, e-Commerce .. you name it.  Those acronyms are becoming quite useless – in that respect I agree with Dennis Howlett who says we should “dump the  disciplines formerly known as CRM/SCRM/SCM/ERP/3PL/HR/HCM/E2.0….etc” – hence I stick to the term All-in-One. Or Business Suite:-)  It’s been a long (and winding?) road for NetSuite: developing a full suite of apps you can run a business on is by far more complex than throwing out point applications.

The company also learned the hard way that with business complexity (please note, I am not talking about Software, but Business complexity) comes a more difficult, stretched out sales process.  The fact is, as much as I am a fan of the click-to-try-click-to-buy pull model, the more business areas (and stakeholders) are involved, the less feasible the fully pull model becomes.  A Business Suite is not something you simply pick up from an App Store:-)
So NetSuite experimented with more direct sales model first, gradually building towards a more channel-based model, to the recently announced SP100 program in which partner VARs get the entire first year subscription revenue.  Along the way they grew functional richness as well as market penetration, to the point that they often compete with Enterprise giant SAP directly.  Now, let’s quickly qualify that: NetSuite is not comparable to the SAP Business Suite, but it is often an ideal satellite solution for smaller divisions of large companies, many of which just got acquired and are facing the choice of a long SAP implementation vs. a SaaS solution from NetSuite (see Ray Wang’s post on two-tier ERP strategy)

I should probably mention that way back, before their IPO and the fame that came with it (from the times of NetWho?) I was an early NetSuite customer, picking it over the market leading CRM (and I mean that as a stock symbol), simply because it had a better process flow, even for Sales, which I was heading at the time. (Yes, we got p***ed learning we’d have to create Sales Orders outside the other system, even though we had quotes in the system, only to come back and re-enter the data manually).  NetSuite was simply a better CRM system, even before considering other business areas.

Parallel to our NetSuite implementation we introduced a Wiki, JotSpot, which just launched in those days (since acquired by Google) and soon we realized a lot of the support information for Sales could either reside in NetSuite or in the Wiki.  This has been bugging me ever since:

Why do structured, process-oriented systems and unstructured  collaboration tools live in different worlds?

Like I’ve said, I’m all for Suites, but the true Suite in my definition includes integrated collaboration and communication tools – I’m still waiting for that … perhaps not for long 🙂

Now, if NetSuite was the “one”, who is the “half”?   It’s SAP’s very capable, but dormant Business ByDesign – which may just come to life later this year.  But I’ve been torturing you long enough, so let’s leave that to another discussion.

(Cross-posted @ CloudAve)

post

Atlassian Security Breach and Warning. >>> Update: Apology and Disclosure

crikey Well, well, hours after telling you not to change passwords, now I am telling you to change it… but this time with good reason. Minutes ago I’ve received a email from Atlassian:

We are sending you this message because we experienced a security breach and suspect that your Atlassian customer account password details (only) may have been compromised.
It is very unlikely that an unauthorised user has had the opportunity to log in to your account so far and if they have, there is very little in the way of personal information which could have been accessed. However, to minimise any further risk to your Atlassian account being compromised, we strongly recommend that you change your Atlassian account password as soon as possible using the procedure below.
Be aware that this security issue only affects Atlassian customers who created an Atlassian account and purchased one of our products before June 2008. Since then, we have been using a more secure user management system based on Atlassian’s Crowd product. When you change your Atlassian account password using the procedure below, your Atlassian customer account details will be stored in our updated Crowd user management system, which will further minimise the chance of a security breach occurring in future.
Procedure for changing your Atlassian customer account password:
1) Login to http://my.atlassian.com
2) Click “My Profile” (3rd tab)
3) Click “Change Password” (in Contact Information section)
4) Update your password to a new value
Atlassian apologises for the inconvenience caused. However, this is an extremely rare event for us and since we take security issues seriously, we are taking every precaution possible to minimise the effects of this security breach.

Sincerely/Best regards,
Glenn Butcher
Director of IT

Not fun .. and I expect to we’ll hear more from Atlassian soon.  For now they are obviously figthing whatever it is – status update from Twitter:

Atlassian had a security breach. Apologies for the confusion. Our site is experiencing heavy loads. We are working on getting back up ASAP.

Personally I am safe – I don’t have active accounts, just decided to help push Atlassian’s charity towards the finish line by purchasing 10 licences, but if you do, time to change the passwords…

Update:  co-Founder and co-CEO Mike Cannon-Brookes posted the details on the Atlassian blog.

Apparently an old, inactive database table that had already been migrated in July 2008 to the secure Crowd identity management system was not deleted mistakenly.  That indirectly answers the speculation about Atlassian passwords being stored in plain text format.  They are not – anymore, but they used to be, prior to July 2008.

Mike goes on to detail what was / was not compromised:  read for changes, they are resetting potentially compromised account passwords now.

He does not BS, owns up the mistake:

We made a big error. For this we are, of course, extremely sorry. The legacy customer database, with passwords stored in plain text, was a liability. Even though it wasn’t active, it should have been deleted. There’s no logical explanation for why it wasn’t, other than as we moved off one project, and on to the next one, we dropped the ball and screwed up.

They are still investigating what happened and Mike promises full disclosure, coming this week.

It’s been a bad day for Atlassian and some of their customers – but I’m glad they live up to their “Open Company, No Bullshit” slogan, and respond as expected.

(Cross-posted @ CloudAve)