It was a social engineering attack that leveraged the device OAuth flow, where the device gaining access to the resource server (in this case the Salesforce API) is separate from the device that grants the authorization.
The hackers called employees/contractors at Google (& lots of other large companies) with user access to the company's Salesforce instance and tricked them into authorizing API access for the hackers' machine.
It's the same as loading Apple TV on your Roku despite not having a subscription and then calling your neighbor who does have an account and tricking them into entering the 5 digit code at link.apple.com
Continuing with your analogy, they didn't break into the off-site storage unit so much as they tricked someone into giving them a key.
There's no security vulnerability in Google/Salesforce or your apartment/storage per se, but a lapse in security training for employees/contractors can be the functional equivalent to a zero-day vulnerability.
Salesforce architect here (from partner firm, not the mothership directly)--Salesforce's query language, SOQL, is definitely a different beast as you say. I'd like to learn more about the issues you're having with the integration, specifically the permissions enforcement. I may be misunderstanding what you meant in the blog post, but if you're passing a SOQL query through the REST API then the results will be scoped by default to the permissions of the user that went through the OAuth flow. My email is in my profile if you're open to connecting.
Tython | Salesforce Software Engineer | Remote (US) | Full-time Contract to Hire | https://www.tython.co
Tython provides consulting services to Salesforce ISVs, partners, and customers with a focus on lightning web components, Apex development, and backend integrations.
Tython was founded in 2012 and since then has provided consulting and development services to Fortune 100 companies and nonprofits alike, as well as released products on the Salesforce AppExchange.
Tython is currently a lean group of Salesforce engineers and admins spread out between San Diego, Long Beach, St. Louis, and Durham, North Carolina. We're looking to build out a fun, diverse, and supportive team of both junior and experienced Salesforce consultants, admins, and software engineers.
We offer great benefits including medical, dental, vision & life insurance, 401k matching, charitable donation matching, training opportunities, and an unlimited vacation policy.
The technologies and tools we use today include:
* Apex
* Lightning Web Components
* Aura Components
* SFDX
* GitHub
* VSCode
* GitHub Actions
Reach out if you would enjoy working with a small team, having a flexible work schedule, and building complex applications/integrations with the Salesforce platform.
Interested? Send your resume to [email protected] (no recruiters please)
Tython | Salesforce Software Engineer | Long Beach, San Diego, Research Triangle Park, or Remote | Full-time Contract to Hire | ONSITE or REMOTE | https://www.tython.co
Tython provides consulting services to Salesforce ISVs, partners, and customers with a focus on lightning web components, Apex development, and backend integrations.
Tython was founded in 2012 and since then has provided consulting and development services to Fortune 100 companies and nonprofits alike, as well as released products on the Salesforce AppExchange.
Tython is currently a lean group of Salesforce engineers and admins spread out between San Diego and Long Beach, but we will soon be opening an office in the RTP area of North Carolina. We're looking to build out a fun, diverse, and supportive team of both junior and experienced Salesforce consultants, admins, and software engineers.
We offer great benefits including medical, dental, vision & life insurance, 401k matching, and an unlimited vacation policy.
The technologies and tools we use today include:
* Apex
* Lightning Web Components
* Aura Components
* SFDX
* GitHub
* VSCode
* CircleCI (moving to GitHub Actions)
Reach out if you would enjoy working with a small team, having a flexible work schedule, and building complex applications/integrations with the Salesforce platform.
Interested? Send your resume to [email protected] (no recruiters please)
Tython | Salesforce Software Engineer | San Diego, CA | Full-time | ONSITE or REMOTE | https://www.tython.co
Tython provides consulting services to Salesforce ISVs, partners, and customers with a focus on lightning web components, Apex development, and backend integrations.
Tython was founded in 2012 and since then has provided consulting and development services to Fortune 100 companies and nonprofits alike, as well as released products on the Salesforce AppExchange. Tython was formerly based in Washington, DC where I formed and led the local Salesforce developer group before relocating to San Diego, CA.
As the founder of Tython, I've spoken at Salesforce’s annual Dreamforce conference multiple times as well as the TrailheaDX developer conference. During the last Dreamforce Hackathon held in 2014 my team and I were awarded 4th place and $20,000.
Tython is currently a lean group of Salesforce engineers and admins, but we're looking to build out a fun, diverse, and supportive team of both junior and experienced Salesforce software engineers.
Reach out if you would enjoy working with a small group, having a flexible work schedule, and building complex applications/integrations with the Salesforce platform.
Interested? Send your resume to [email protected] (no recruiters please)
Tython | Salesforce Software Engineer | San Diego, CA | Full-time or Part-time | ONSITE or REMOTE (PDT +/- 3) | https://www.tython.co
Tython provides consulting services to Salesforce partners, customers, and ISVs with a focus on lightning web components, Apex development, and backend integrations.
Tython is currently a two man show, but we're looking to build out a fun, diverse, and supportive team of both junior and experienced Salesforce software engineers. Reach out if you would enjoy working with a small group, having a flexible work schedule, and building complex applications/integrations with the Salesforce platform.
We're looking for a software engineer first and foremost, but there will also be a consultant aspect to the role as some client interaction may be necessary to go over requirements/deliverables. We're definitely open to helping a strong developer not already familiar with Salesforce transition to the platform, but candidates would ideally already have experience in the following:
- Lightning Component (Aura/Web) Development
- Apex Development
- SFDX
Interested? Send your resume to [email protected] (no recruiters please)
Tython | Salesforce Software Engineer | San Diego, CA | Full-time or Part-time | ONSITE or REMOTE | https://www.tython.co
Tython provides consulting services to Salesforce partners, customers, and ISVs with a focus on lightning web components, Apex development, and backend integrations.
As the founder at Tython, I've been working on the Salesforce platform since 2010 and in that time provided consulting and development services to Fortune 100 companies and nonprofits alike, released products on the Salesforce AppExchange, and spoken at Salesforce’s annual Dreamforce conference multiple times. In 2014 I formed the DC Salesforce developer group and later that same year my team and I were awarded 4th place and $20,000 at the Dreamforce Hackathon.
Tython is currently a two man show, but we're looking to build out a fun, diverse, and supportive team of both junior and experienced Salesforce software engineers. Reach out if you would enjoy working with a small group, having a flexible work schedule, and building complex applications/integrations with the Salesforce platform.
Interested? Send your resume to [email protected] (no recruiters please)
"But the highest praise I can give The Left Hand of Darkness is that Le Guin captures the texture of life. This book is full of little moments, bits of sensation and emotion, that show what it feels like to be alive, day after day."
Well put; this was one of the things I enjoyed most about the book as well. I began reading fully expecting to be immersed in the Gethenians' world and their foreign culture, just as Mr. Ai did at the start of his journey. By the end though I realized Le Guin had used these "aliens" to show Mr. Ai and the reader what it truly meant to be human.
The fact that some others here feel that LHoD was not Le Guin's best work makes me excited to read her other books!
Tython | Salesforce Software Engineer | San Diego, CA | Full-time or Part-time | ONSITE or REMOTE | https://www.tython.co
Tython provides consulting services to Salesforce partners, customers, and ISVs with a focus on lightning components, Apex development, and backend integrations.
I've been working on the Salesforce platform since 2010 and in that time provided consulting and development services to Fortune 100 companies and nonprofits alike, released products on the Salesforce AppExchange, and spoken at Salesforce’s annual Dreamforce conference multiple times. In 2014 I formed the DC Salesforce developer group and later that same year my team and I were awarded 4th place and $20,000 at the Dreamforce Hackathon.
Currently I'm a one man show, but now I'm looking to build out a fun, supportive team of both junior and experienced Salesforce software engineers. Reach out if you would enjoy having a flexible work schedule and building complex applications/integrations with the Salesforce platform.
Interested? Send your resume to [email protected] (no recruiters please)
I joined Gigster mid-November 2016 and had similar concerns as the OP regarding specific clauses of the contract. This is definitely a tough situation for a developer going through onboarding-personally I wanted the first impression I left to be that I'm a "team player," as opposed to starting a legal battle on day one.
Unfortunately, these interactions always seem to favor companies over individuals. People in general don't enjoy bickering over legalese so individuals don't want to ruffle feathers by pushing back, while company employees are able to take cover under the umbrella that they're just following policy. Truthfully though, it is most often companies-not prospective employees-that initiate legal discussions by presenting contracts and individuals should feel justified in verbalizing any concerns they have. I think this is possible while still remaining professional and courteous.
The first thing I did was look to Google to see if any other developers in the past had similar concerns as me, which brought me to this Quora post - https://www.quora.com/Is-the-contract-for-Gigster-reasonable... Richard's response was helpful and thorough (if you're reading this, thank you!) and although he had additional issues with the contract, my main concern was with sections 2.1 and 2.2 (assignment of IP to Gigster for work not specific to the customer and the exemption of pre-existing IP from being assigned to Gigster including only that which is explicitly outlined, respectively).
I actually discussed the contract language with my family and got some good advice from both my father and brother. They agreed I was within my right to voice my concerns so long as I did it in a productive way. For example, instead of presenting problems by just stating language I didn't like they told me it would be better to provide solutions in my response by offering amendments that I would feel comfortable with.
To this point I had interacted with three individuals: 1. The person who had reached out to me about joining Gigster 2. The individual that emailed me the DocuSign link containing the contract and 3. The individual that sent me a (possibly automated) response after my application was submitted to their website. Let's call these individuals Peter, Paul, & Mary.
I emailed my concerns to Paul and Mary, not knowing which would be better to handle this sort of thing. I received word back from Mary saying that Paul was more familiar with the contract so she'd let him handle it. After two days I received an email from Peter asking for an update on my onboarding process. I explained that I had emailed Paul about the contract and hadn't received word back but that I'd ping him again. Peter told me he would also follow up through other channels. I never did get a response from Paul personally, but after another two days I received word from Peter that he had spoken with Paul and the Gigster legal team and was wondering if I could hop on the phone.
Peter was very open to my concerns and explained the reasoning behind the contract language. I said that I understood, but that admittedly I still took issue with it. Peter seemed to understand and honestly that was pretty much that. He offered to share a Google Doc with me so I could highlight/tweak language I was uncomfortable with and afterwards the contract was promptly signed by both parties.
I also reached out internally to Peter, Paul, and Mary over slack before making this post so they could have a heads up. Paul explained to me that he was not really involved with the Gigster contract or its hiring policies, just that his role involved setting up the onboarding tools and this automatically attached his email to a lot of the communications; which would explain the lack of responses I saw. Paul told me he was “neither encouraging nor discouraging [me] from posting,” but Peter and Mary responded in support of me posting my experience to HN, which I thought was pretty cool.
For future reference here is a portion of my email to Gigster containing the changes I requested, which were accommodated:
I am a little uncomfortable with some of the language in sections 2.1 & 2.2 and was hoping we could revise:
a. Section 2.1 assigns ownership to Gigster not only of all Deliverables, which makes total sense, but also of all source code "including but not limited to source code developed or created by Contractor that is not specific to Customer and is generally applicable to other Customer projects and deliverables ("Community Code")." This language seems quite broad and what constitutes "Community Code" seems a bit difficult to define; I'd prefer to remove the last part of this sentence so the section instead reads "...or any Confidential Information (as defined below) (collectively, “Inventions”). Contractor hereby makes all.."
b. Section 2.2 exempts any of my pre-existing IP from being assigned ownership to Gigster, but then seems to require all such pre-existing IP be disclosed in writing. This seems difficult and probably unnecessary so I'd like to remove "in each case ((a) and (b)) that are expressly set forth in writing to Gigster prior to delivery of the Deliverables to Gigster." and just end the sentence after "any intellectual property rights therein."
I actually met Lukas a few days ago, very nice guy. I was in San Francisco for Salesforce's Dreamforce conference and was staying at a shared AirBnB where he was my roommate for the week.
One night there was a party hosted by Salesforce that I thought Lukas was planning on attending so when I noticed it seemed like he was turning in soon I asked him what changed his mind; he told me he had an interview in the morning with ABC. Not knowing his situation I assumed it was for his startup so I told him congratulations and asked what kind of work his company did. He saw I was confused by his answer that he was actually looking for a job so he just showed me a clip from Good Morning America that talked about the story and said it was probably easier to understand if I just watched the video.
I have a feeling I'll be seeing him again next year--leading a session on marketing at the conference.
Specifically I felt that going through the YC application forced me to think through questions that any other investor/incubator/accelerator (and even some customers) would also have.
Additionally, since the answers I had to those questions didn't pass muster with the partners I can either shrug it off (YC is extremely competitive and even they admit they make mistakes all the time) and take the rejection as additional motivation or I can take their decision as truth and take a closer look at my current business model to see what can/should be tweaked. Either way it can be helpful :)
Of course it would be nice if the rejection emails were more personalized, but I just don't think that's possible with the number of applications they receive.
Great attitude! I was rejected as well and plan to learn from the experience and move on. Ironically I think a company that focuses too much on getting into YC would probably not be viewed as a good candidate by the partners.
The hackers called employees/contractors at Google (& lots of other large companies) with user access to the company's Salesforce instance and tricked them into authorizing API access for the hackers' machine.
It's the same as loading Apple TV on your Roku despite not having a subscription and then calling your neighbor who does have an account and tricking them into entering the 5 digit code at link.apple.com
Continuing with your analogy, they didn't break into the off-site storage unit so much as they tricked someone into giving them a key.
There's no security vulnerability in Google/Salesforce or your apartment/storage per se, but a lapse in security training for employees/contractors can be the functional equivalent to a zero-day vulnerability.