Identigral

SEC sued SolarWinds (SW) for poor InfoSec practices. The thrust of the lawsuit is SW misleading investors regarding SW risk controls, incl. a password policy (!). Even if they do not prevail in court, bringing action is a shot across the company boards' bow. Nice one, Gary.

SAML is far from dead: testimony by @davidjbrossard at @Identiverse '23 regarding customer/implementation challenges at @Salesforce : lnkd.in/gMr9rZMZ

$OKTA Q2 earnings: Workforce vs CIAM (Auth0 + "legacy" Okta) ACV split is 60/40 but growth vs '22 is about even. Taken together it's a somewhat...interesting result.

Data (CDP, Tableau, Mulesoft) growing faster than other segments. On the earnings call, mgmt chanted the mantra of AI + Data as both vision and R&D spend. Three "zones" of AI: Einstein, Gen AI, Autonomous (agents). AI applied in in Slack, Data (segmentation), Service Cloud.

@JefTek @divinetechygirl Thread on a sweater type of problem. Long tail of dependencies => cost of change management and maintenance for end-to-end workflow. Turn the question around: how will this action increase revenue or lower COGS for the business? If cost or risk avoidance, then please quantify.

@Alex_A_Simons @ArvindHarinder Does cross-tenant sync work for B2B -> B2C? Docs only mention B2B. Have a customer who's interested in this scenario, would be nice to skip PS scripting.

"Fun", real-world example of how challenging it is to walk the UX/security line when humans are involved. So what if Trusted Relationship is a known attack vector, mitigation beyond basic is costly due to asymmetric impact. Arguably, detect+term via the Law is a cheap alt route

@salesforcedocs The doc on combining Tooling requests via Composite could use an update salesforce.stackexchange.com/questions/3714…

Flexport is organizing an airlift of humanitarian relief supplies to refugee centers in Eastern Europe. You can help by donating to pay for more flights at flexport.org/donate. 🧵👇

@salesforcedocs doc bug: the Sforce-Duplicate-Rule-Header example at the end of developer.salesforce.com/docs/atlas.en-… contains unrendered doc markup

@jaminball The folks who wrote this could have padded the numbers in a more...readable manner by using cust_o_mers or custOmers. Don't need a natural language model to parse snake_case or camelCase.

The definition of each: "We often provide our software to a distinct department, business unit, or group within a Customer, and use customer to mean each distinct department, unit, or group within a Customer."

My favorite thing in the C3 S1 is the difference between Customers and customers (capital C being the difference). Leads to interesting sentences like the following: "As of September 30, 2020, we had 29 Customers and 59 customers."

OpenID Connect: fun with the spec wording of "audience must be an array of strings" without specifying the type of array and its interpretation by OPs/RPs. In this case the players are @azuread and @salesforce salesforce.stackexchange.com/questions/3253…

@itickr The content feels like the oAuth scope conversation all over again re: human-readable explanation. For example, Google Account prompt says you're authenticating to 'google.com' regardless of the targeted service. The grey pop-up is like a brick in your window.

Enrollment in #FIDO should be as simple and consistent as connecting with Wifi or Bluetooth. How long before enrollment flow across all OS/Browsers shares the same content, graphics, pop-up window size, and background color. #TuesdayThoughts

@jaghub @Apple @salesforce Control over entire experience, including chain of custody and exclusion of possible issues due to ecosystem/3rd parties. Vertical integration has always been Apple's theme.

Does anyone know why @Apple did not implement TOTP for 2FA? I have been a huge fan of managing all of my 2FA using @Salesforce Authenticator App. I am all in Apple Ecosystem and it would be of huge help to manage all in a single place! Any better suggestions?

Google Project Zero vs AWS IAM and GCP IAM with predictable results. "A strong developer might be able to reason about all security pitfalls of their own software, but it becomes very difficult once a complex external service comes into play". Most IAM services are external, yay!

@dunnry @tonyszko @vibronet Quest 1 -- good to go w/o a FB account until Jan 2023.

@tonyszko @vibronet And you both are ok with the mandatory Facebook crap? I am likely going to sell my Quest. No way am I going to have my kids require a Facebook account to use.

When the new toy arrives, but you still have meetings before you can even open it 😛 #OculusQuest2 #1stWorldProblems

If Martin Fowler has trouble with oAuth, what about all other devs? This Patreon -> Slack integration is a good litmus test for evaluating no-code/low-code platforms with effort to implement as a comparison metric. (Google says Apps Script is low-code, a debatable assertion).

@manicode We've heard this and similar confuzzled terms from users many times. It makes sense to them as an outcome - usually hashing or some attack/mitigation scenario such as stolen laptop vs encrypted drive. "We encrypt our passwords" is very common.

Is “one way encryption” a meaningful term? I voted no on this but think I’m wrong....

@MichaelDell @EliasatDell Same machine is now dead due to another issue. Product is still under premium warranty with Next Business Day On-Site. Service request was opened 2 days ago. Requesting ETA from support leads to "please wait" answers. Your NPS score is trending to -100

@matt_levine Your top 3 footnote-obsessed writers? Our list: 1. Nabokov 2. DFW 3. Edward Gibbon

it's been kind of a strange day nytimes.com/2020/10/08/bus…