• 资讯
    裁员:甲骨文中国北京研发大面积裁员,被裁职位转移回美国! 还记得12月那个传闻吗: 突发丨Oracle疑似大规模裁员,可能涉及2000人! http://www.hrtechchina.com/15642.html   2017年1月14日早上9:09分,甲骨文研发北京的同事收到了来自BU老大的一封邮件。在邮件中提到由于市场变化,甲骨文公司开始整合各研发中心资源公司在云计算方向发力,邮件的最后,单独提出了中国将会进行裁员,并且2017年3月31号所有人必须离开。 虽然在一个月之前,北京这边有大约10几人被告知裁员,大家也以为是人员冗余而进行的精简,但是这次200多人同时收到这封措辞严谨的公开信,摆明了甲骨文云计算存储相关的北京研发团队要全部走人。 甲骨文最新的财报显示向云计算方向的转型相当成功,云软件即服务和和平台即服务的收入同比增长了81%。而从公司最近的战略投资来看,云计算存储业务相关的投资数额增长巨大,只不过这些投资和美好的云计算前景已经与中国员工无缘。相反,所有北京工程师的开发工作主要由美国的工程师来接管,部分测试工作将移交给印度工程师。 在一个月前川普访问硅谷的座谈会上,甲骨文CEO卡兹女士承诺帮助川普政府实现目标,没想到仅仅不过一个月的时间就做出了这样的决定,不免令人担忧甲骨文公司在中国的研发战略和投资是不是已经开始收紧,除了从中国巨大的市场上获取经济利益,甲骨文高层是不是也应该学会尊重中国员工的职业发展,在中国承担起相应的社会责任,这样为了政治利益不惜损害普通员工的做法实在无法使人相信这是一个负责任的企业。如果甲骨文本次顺利执行裁员计划,其他的在华美企后续会不会为了抱川普的大腿有样学样? 本次裁员消息的发布时间在春节前两周,而各大IT公司在春节前后一个月的时间基本上不会招新员工,本次200多被裁的绝大部分雇员将很难在3月31日前找到新工作。   来源:IT战略家 公众账号
    资讯
    2017年01月16日
  • 资讯
    抓取微博信息,脉脉被判不正当竞争,并赔偿微博公司200万元 日前,有关“脉脉非法抓取使用新浪微博用户信息”的案件在北京知识产权法院终审宣判。法院驳回了脉脉的上诉,维持原判,认定北京淘友天下技术有限公司和北京淘友天下科技发展有限公司(均为脉脉的经营公司)构成不正当竞争,立即停止涉案不正当竞争行为。根据判决,上述两家公司应共同在脉脉网站首页、脉脉客户端软件首页连续48小时刊登声明,就本案不正当竞争行为为微博公司消除影响,并赔偿微博公司200万元。   进入大数据时代后,包括微博在内的平台方均有责任和义务推动数据生态繁荣,建立使用规则,并及对滥用行为加以制止。本案为大数据不正当竞争纠纷案首案,对行业规则的建立以及如何维权具有重要指导意义。北京知识产权法院首次指出:明确网络平台提供方可以对在用户同意的前提下基于自身经营活动收集并进行商业性使用的用户数据信息主张权利。这意味着,第三方公司抓取微博数据用于商业化将构成侵权行为,微博可以进行起诉。 北京知识产权法院认为,互联网络中,用户信息已经成为今后数据经济中提升效率、支撑创新最重要的基本元素之一,因此,数据的获取和使用,不仅能成为企业竞争优势的来源,更能为企业创造更多的经济效益,是经营者重要的竞争优势与商业资源。因此,网络平台提供方可以就他人未经许可擅自使用其经过用户同意收集并使用的用户数据信息主张权利。 该法院同时指出,明确第三方应用通过开放平台例如Open API模式获取用户信息时应坚持“用户授权”+“平台授权”+“用户授权”的三重授权原则。数据提供方不仅应将用户数据信息作为竞争优势来加以保护,还应将保护用户数据信息作为企业的社会责任,采取相应的技术措施提升Open API合作模式中相应权限的控制,通过Open API接口调用的检测以及保存调用过程的控制,不断完善Open API合作模式。 公开资料显示,北京淘友天下技术有限公司、北京淘友天下科技发展有限公司负责经营的“脉脉”是一款移动端的人脉社交应用。上线之初因和微博合作,用户可通过微博账号和个人手机号注册登录脉脉,用户注册时还要向脉脉上传个人手机通讯录联系人。但微博随后发现,脉脉用户的“一度人脉”中,大量非脉脉用户直接显示有新浪微博用户头像、名称、职业、教育等信息。 此后双方终止合作,微博提起诉讼,认为被告存在非法抓取、使用微博用户信息,非法获取并使用脉脉注册用户手机通讯录联系人与微博用户的对应关系,以及发表言论诋毁公司商誉等行为。 2016年4月,北京市海淀区人民法院审结该案,认定北京淘友天下技术有限公司和北京淘友天下科技发展有限公司非法抓取、使用新浪微博用户信息等行为构成不正当竞争。此后,上述两家公司提起上诉。2016年12月30日,北京知识产权法院做出终审判决,驳回上诉,维持原判。
    资讯
    2017年01月11日
  • 资讯
    一个崭新的、遵纪守法的 Zenefits 。 David Sacks 的一封信:The New Zenefits - Becoming the Compliance Company   这是Zenefits的CEO David Sacks新官上任3个月后、尝试以公开透明的姿态,向公众汇报Zenefits最近一段时间积极配合政府部门的检查、以及改过自新的各种举措。另外这个David Sacks 也要加入特朗普的团队了~~ 文中主动坦承了创始人、前CEO确实写了个脚本帮员工知法犯法地、作弊考取卖保险的资格认证。这篇检讨书可以打几分?可以多大程度拯救这个“从天上掉到地上的独角兽”?   详细看看他的原文吧: Three months ago, I became CEO of Zenefits after an internal investigation brought to light deficiencies in the company’s licensing compliance. In my Day 1 memo, I said that we would be transparent about these failings, because in order to fix a problem, you must first admit that it exists. Regulators and the public have an expectation that their rules will be followed, and the new leadership of this company is completely committed to doing that. Getting compliance right is important for all businesses, but this is especially true for Zenefits. Our software is intended to help customers with their HR and Benefits, so compliance is fundamental to our value proposition. We not only have to be a compliant company, we have to be excellent at understanding compliance and delivering that in our product. We have to be the Compliance Company. Over the past three months, we have worked hard to become this company. This transformation is still underway and there is still some work to do. But we have brought our licensing into compliance. We have dealt with many other issues as well, including a previous culture that was complacent about cutting corners and dismissive towards long-term planning. We have made a break with this culture and defined operating with integrity as our new number one value. If there is a silver lining to the difficulties that Zenefits has gone through the past three months, it is that we have turned compliance into a core part of our values, culture, and expertise. In turn, I believe that we will be able to use this experience to improve our product and help our customers with their own compliance needs. This will ultimately make us into a stronger and more differentiated company that provides a much greater level of value to our customers. I want to thank our customers for sticking by us during this difficult period. The fact that our ARR remains the same today as it was before all of this happened is a testament to the value that small businesses find in our platform. As I reflect back on these first three months, I think it’s important first to make clear how our compliance issues came to light. We need to close the chapter on what went wrong so we can move forward. Second, I want to describe our remediation efforts in more detail. Finally, I want to tell you about how we are looking forward as a company. I. Background In late November, the company conducted an internal review of our licensing procedures that made me aware of two issues for the first time. First, contrary to what I had been led to believe, the company had engaged in many instances of unlicensed selling. Second, the review uncovered the existence a software program, or “Macro”, that created the perception that employees were studying required online coursework when they were not in fact logged in. In response, the company initiated two investigations. In December, the company hired a Big Four auditing firm to itemize the licensing failures. After I became CEO in February, we self-reported the findings to all the state departments of insurance. Since then, we have been cooperating with regulators to fully account for all historical violations while instituting new technology and practices to avoid future ones. Separately, we hired the firm Cooley LLP to investigate the Macro. Cooley reviewed over 15,000 documents and interviewed current and former employees. On January 25, Cooley reported its findings to me. This is when I learned for the first time that founder and former CEO Parker Conrad had written the Macro and that its use violated a state licensing requirement. I immediately escalated the matter to the Board of Directors. An emergency board meeting occurred on February 1, Parker agreed to resign, and I instructed company counsel to self-report the issue to the California Department of Insurance. All of these actions are described in Cooley’s investigative report to the Board, which we are making public as part of our commitment to transparency. II. Remediation Since I became CEO on February 8, we have moved swiftly to remediate these issues. As I outlined in my Day 1 memo, this has required not just new policies, procedures, and technology but also sweeping changes to our leadership, governance, values and culture. a. Macro Remediation To ensure that something like Macro cannot happen again, we have disabled the underlying technology on our network. More to the point, we have terminated executives who were ringleaders in encouraging and disseminating the Macro. We are committed to operating with integrity, and behavior of this kind will never be tolerated at Zenefits again. We are also requiring that every broker at Zenefits take 52 hours of coursework created by industry authority NAHU (the National Association of Health Underwriters). Of this, 12 hours consists of ethics training. For each NAHU course, the participant must pass a proctored NAHU test. The program has already begun and will be completed by October 1. You can see our NAHU curriculum here. b. New Licensing Controls To bring our licensing into compliance, our engineers have developed sophisticated new controls on the Salesforce.com platform that prevent any current or prospective account from being assigned to a sales rep who does not have a valid license in the correct state. Recently, we integrated this technology with a live feed from a national licensing database, so data on our employees’ insurance licenses is always up-to-date. Zenefits currently has approximately 300 licensed employees with almost 10,000 licenses. In the words of our Big Four auditing firm, “the processes and controls over the licensing of sales agents are adequately designed to address the risk of sales activity being performed by agents without the appropriate license.” If you’re familiar with the words of auditors, this is about as enthusiastic as their evaluations get. We will be bringing back our auditors in Q3 to verify that the new controls are working as designed. c. Dedication to Broker Education And Professionalism Zenefits is not content just to do the minimum broker education required by the state. We have also instituted the following additional education: As described above, every broker at Zenefits must take 52 hours of mandatory NAHU coursework and pass the NAHU test. Zenefits has created a Boot Camp for new hires, where they receive an additional 20 hours of insurance training. In order to get into Boot Camp, new hires must show proof that they have already obtained their broker license prior to starting work. After Boot Camp there is continuing education. We’ve developed our own quarterly exam (written by individuals with over 30 combined years of broker/carrier experience) to make sure that our brokers are keeping up their insurance knowledge. Twice monthly, the entire team is trained on subjects like new legislation. Zenefits will begin seeking continuing education credits for many of these trainings. Zenefits has established a Zenefits Insurance Advisory Board (ZIAB), consisting of experienced brokers who oversee the training curriculum and have Broker Office Hours to answer additional questions. ZIAB is also active in the company’s emerging compliance structure. Finally, as a part of our dedication to the broker profession, every producer at Zenefits is a member of NAHU, as well as their associated state and local organizations. Zenefits is encouraging active participation and pays for membership fees. d. Corporate Governance and Leadership Zenefits has reconstituted its Board of Directors and Executive Team. Previously, the Board consisted of 4 seats, three of which were controlled by Parker; effectively he had total control. The new Board consists of 6 seats and is balanced: in addition to a CEO seat, there is one founder seat (Laks Srini), one seat for the Series A/B investors (Lars Dalgaard from Andreessen Horowitz), one seat for the Series C investors (Bill McGlashan from TPG), and two outside directors (Antonio Gracias from Valor and Peter Thiel from Founders Fund). We are grateful that prominent investors and industry leaders like Antonio, Bill, and Peter agreed to join the Board when I became CEO. We also named a new Executive Team after each member was vetted by Cooley to ensure that they had no role in disseminating or encouraging use of the Macro. New Sales leadership has been appointed in both San Francisco and Phoenix. And throughout the company, we have appointed or promoted over 20 new mid-level managers and executives. e. Creation of Compliance Team One of my first acts as CEO was to appoint Josh Stein, a former federal prosecutor, in the new role of Chief Compliance Officer, which reports directly to me and to our Board of Directors. One of our key failings under the previous CEO was that we did not have a dedicated compliance department — we have fixed that. Over the past three months, Josh has done an amazing job standing up a robust compliance organization that works with the Exec Team and managers throughout the company. We have 9 dedicated compliance personnel — up from zero under the previous CEO — with plans to hire 3 more. The team is conducting a top-to-bottom compliance review, and we have established a compliance hotline that allows any employee to report (anonymously, if they desire) any issue that needs to be investigated. Maintaining robust compliance monitoring and remediation is something that we will never stop doing as a company. f. Change in Culture and Values Company culture is what guides employees’ decisions when no one is looking. As Warren Buffett has written, “Culture, more than rule books, determines how an organization behaves.” That is why some of the most important changes that we’ve made have been at the level of culture and values. Zenefits declared three new company values on Day 1: #1 Operate with integrity. We have empowered our employees to act with integrity and we are seeing amazingly positive results from that.  We don’t punish employees who make honest mistakes; we recognize them for tackling the root causes that led to those mistakes. Our employees are spotting issues and bringing them forward, knowing that the company will take their concerns seriously. Operating with integrity is about more than just compliance, as important as that is. It’s about integrity in everything we do. A key component of that is the integrity of our data and infrastructure. We have declared a War on Errors with a dedicated quality team, and we have created a new Core Service team in Engineering. As a result of these initiatives, key metrics for error rates, site performance and reliability have all improved markedly, improving the experience for our clients and their employees. We have seen that our problem was not the vast majority of our employees — our problem was fundamentally a failure of tone and leadership from the top. I’m proud of our current employees and inspired by their dedication to doing the right thing. #2 Put the customer first. We have made the decision to focus on small businesses because this is where we can be most impactful as a company. These are the businesses that most need a product like Zenefits. Small businesses rarely have an HR department larger than one — many have no one at all, with the heavy administrative burden falling on the business owner. We have found that many small businesses are offering health insurance for the first time (28% of our new clients) because Zenefits makes it easy to do so. Similarly, many of our small business clients are now able to offer other big company benefits, like commuter benefits or FSAs. This helps our small business clients compete for talent and take care of their employees. Part of our dedication to small business is a dedication to smart growth. Rather than chasing ever larger accounts, we have re-dedicated ourselves to improving our service with our small business customer in mind. Today we are focused on the quality of our offerings, with important initiatives like our War on Errors. In the near future, look for even more radical changes dramatically expanding the power of our platform for small businesses. #3 Make this a great place to work. We have made strides in making Zenefits a great place to work. By “great”, I don’t mean just a fun place to work. Having fun is important, but it’s not the end of the story. Working at Zenefits should be a rewarding experience, where employees believe they are part of making an important change in the world and feel a connection with each other and our customers. We started by declaring our mission statement, which is to make entrepreneurship easier and more accessible to everyone. We sharpened our focus on small businesses to make winning achievable. We recognize employees who demonstrate our new values at our All Hands meetings through a peer nomination process. We are deepening the connections between our customers and employees with our biweekly “Live Chat” series, which brings in customers to share their experience with Zenefits. This is especially important for our employees who don’t have regular contact with our customers. A rewarding place to work is one where you can see the positive impact you’re making. And we are catching up on all the other things employees expect from a company they give their all to: a more generous benefits program, a 401k, a thoughtful goal setting and review process, more commuter benefits, manager training, and events to socialize together outside of the office. Today, thanks to our facilities team, employees in San Francisco arrived to a much needed spruce-up of our office space in San Francisco. III. Moving Forward Although our work on remediation is not yet done, we have made major progress. We have sent an independent audit to regulators, owned up to our historical issues, and will accept the consequences for our past mistakes. We will continue the partnership with regulators we have forged by self-reporting this issue. Now it is time to look forward as a company. We need to focus on making small business ownership easier and more accessible. We need to use the deeper understanding of compliance that we now have to help our customers with their own compliance-related needs. This is a value proposition that already undergirds some of our most compelling products. One example is Onboarding. We offer a simple “Hire” button that, once configured, keeps small businesses in compliance by extending offer letters, running background checks, automatically offering eligible new hires insurance, facilitating completion of I9s, and collecting the information required for W-4s. Our goal is to make hiring a new employee as easy as calling an Uber. Another example is our ACA Compliance tool. Particularly for companies with part-time or hourly employees, calculating whether you have to provide coverage, and for whom, when, and how much is very complex. And producing the Form 1094-Cs/1095-Cs filings is a significant administrative burden. This tool is free, regardless of whether you make us your broker. But it’s much more powerful when we’re the broker because we can auto-populate so much of the data. This shows how an all-in-one HR and Benefits system drives so much value for small businesses. Products like these demonstrate the value we deliver as the Compliance Company. Our focus now is to continue executing for small businesses and living up to the great potential of this company. About David Sacks David is CEO of Zenefits. He is an Internet entrepreneur who was the founding CEO of Yammer and original COO and product leader of PayPal. He also produced the award-winning independent film Thank You For Smoking. He is an angel investor in tech companies like Facebook, Uber, Airbnb, Houzz, SpaceX, and Palantir.               详细文章来看看吧:https://www.zenefits.com/blog/new-zenefits-becoming-compliance-company
    资讯
    2017年01月11日
  • 资讯
    支付宝因做社交暴漏巨大安全漏洞!!!简直是可恨!! 网曝支付宝存在新漏洞:熟人可重置登录密码。 PS: 最新消息漏洞被堵上了。 1月10日上午消息,近日,网曝支付宝存在新漏洞——陌生人有五分之一的机会登录你的支付宝,而熟人则有百分之百的机会登录你的支付宝。 网曝支付宝存在新漏洞:熟人可重置登录密码 按照网友的说法,漏洞的原理是这样的:登录手机账号——忘记密码——手机不在身边——淘宝买过的东西9张图片选1个——好友验证9个好友图片选1个——登录成功。这时就可以直接扫二维码付款不用密码。 对此,新浪科技根据上述步骤进行试验。首先,退出登录现有账户,然后输入你想要登录的手机账号,点击“密码登录”,此时会有“忘记密码?”的选项,确认需要重置登录密码的账户,点击“下一步”;此时,会收到支付宝发来的检验码;因为此时登录账号的手机不在你手里,因此选择“无法接收短信”;支付宝会提供其他的验证方式,这个时候“选一个您购买过的商品”的验证页面就出现了;选择以后点击下一步,还需要“选一个你可能认识的人”;完成这两个步骤之后,你就可以修改该账户的密码了,连同该账户关联的淘宝登录密码也会被修改。 从上述过程中可以发现,若为熟人操作,则账户被登录的成功率极高。       广告:
    资讯
    2017年01月10日
  • 资讯
    Yahoo!被收购后,要改名为 Altaba(阿里他爸?)CEO梅耶尔离开董事会       北京时间1月10日消息,根据雅虎提交的资料显示,公司出售核心业务之后,雅虎CEO梅耶尔与公司联合创始人大卫·费罗(David Filo)将会退出董事会,雅虎名字也会变成Altaba。 不只如此,雅虎48亿美元将互联网业务出售给Verizon之后,董事长梅那德·韦伯(Maynard Webb)也会离开董事会,还有前董事长埃迪·哈顿斯坦(Eddy Hartenstein)、查德·希尔(Richard Hill)和简·萧奥(Jane Shaw)。 博通前CFO埃里克·勃兰特(Eric Brandt)将会接替韦伯成为雅虎新任董事长。 去年用户数据大规模泄露,雅虎出售资产的交易因此蒙上阴影,数据泄露事件可以追溯到2013年,影响10亿帐户。Verizon高管暗示说,所有选择都是可能的,比如重新协商条款,或者放弃收购。(中天)
    资讯
    2017年01月10日
  • 资讯
    Atlassian + Trello: changing the way teams work,Atlassian4.25亿美金收购Trello! 本次交易绝大多数以现金(3.6亿美元)交易,剩余的用以支付限制的股票和期权。此次收购预计将在2017年3月31日之前完成。 When we founded Atlassian 15 years ago, it seemed obvious to us that software could help teams work better together. But in those days most software companies were focused on developing for personal productivity. We felt that using tools designed for individuals to accomplish teamwork is a bit like using scissors to mow your lawn. You can do it, but it’s a lot harder than it needs to be. That’s why we focused on building for teams from day one. Fast forward to today and there are still surprisingly few companies building software for teams. One company that has had breakout success is Trello. Over the past five years, Trello has grown to over 19 million registered users by solving an important problem: capturing and adding structure to fluid, fast-forming work. Trello’s pioneering use of an intuitive visual system has been embraced by all kinds of teams to do everything from managing marketing campaigns to tracking action items from team meetings. Organizations in nearly every country and as varied as the Red Cross and Google have adopted Trello to get work done. Today, I am thrilled to announce that we have entered into an agreement to acquire Trello and add their amazing product to our growing family. Choosing the right tool for your team Atlassian’s mission is to unleash the potential in every team. That’s a big mission. In Trello we found a group that is as dedicated to helping teams get stuff done as we are. In fact, we have identical milestones towards achieving our missions: for our tools to be used by 100M people. Atlassian tools are built to help all teams organize, discuss and complete their work. By adding Trello to the Atlassian family, we’re giving teams more choice in the tools they use to support the way that they want to work. Trello will become an important part of the Atlassian portfolio, offering a fun new way for teams to organize the often messy range of information that feeds into great teamwork. Its card system is intuitive, easy to use, and instantly familiar, which has made it extremely popular with teams across marketing, legal, HR, sales and beyond. One of Trello’s strengths is its flexibility. You control how the board looks and operates so you can mold it to how your team works, and track progress in stages that reflect your processes. You can take this flexibility a step further by integrating the tools you already use with Trello as Power-Ups that extend the functionality of the boards to meet your team’s unique needs. The JIRA family of products will continue providing purpose-built experiences such as JIRA Software, the #1 tool for agile software teams; JIRA Service desk, a beautifully simple service desk solution for IT and business teams; and JIRA Core for project and process management. JIRA tools excel at work that benefits from a well-defined, traceable, and repeatable process, whilst Confluence is great for teams creating and collaborating on documents and rich content. Trello perfectly fills a gap between the structured workflows of JIRA and the free-form collaboration of Confluence and will give teams the option to find the right Atlassian tool for the type of work they need to complete. Keep an eye out for integrations between these products in the near future. What happens now We’re thrilled to welcome the talented Trello team to Atlassian and look forward to working with them to change the way teams work together. Deep investments in R&D have long been a cornerstone of Atlassian’s business and we will continue that tradition with Trello. If you currently use Trello as either a free or paid user, you can rest assured that we will continue to offer Trello as a standalone service. We’ll be working with their product team to help them accelerate development efforts. If you are an Atlassian user, I encourage you to set up an account on Trello and check out how it might work for your team. Teams have always been the critical element of successful organizations. We’re excited about the opportunities that lie ahead in unleashing the potential of every team.
    资讯
    2017年01月10日
  • 资讯
    印度 SaaS 供应商 Zoho 一口气投资了五家初创公司,加速产品整合 Zoho 是印度知名的 SaaS(软件即服务)供应商,旗下开发了超过 30 款企业级软件产品,旨在将自身打造成一个“企业应用操作系统”。近日,该公司宣布对五家初创公司投资 1000 万美元(约合 6.8 亿印度卢比),其中包括机器视觉初创公司 Zentron Labs 和 医疗设备制造商 vTitan,根据当地媒体《印度金融时报》消息,这些投资将帮助相关初创公司创始人渡过过产品研发阶段。 根据 Zoho 公司首席执行官 Sridhar Vembu 透露: 我们所投资的初创公司,其创业理念和价值观必须和 Zoho 保持一致,我们不是风险投资公司,所以不是以短期退出为投资目标,而是为这些初创公司提供长期支持,寻求长期回报。 虽然 Zoho 公司主要业务在印度,并且在金奈设有办事处,但他们的总部却设在美国加州。该公司成立于 1996 年,起初以“AdventNet”品牌名称提供网络管理服务,之后他们开始转型提供企业级应用软件服务,业务涵盖电子邮件服务、项目管理、人力资源管理、客户关系管理、企业级财务管理。目前,Zoho 公司旗下包括三个品牌产品,分别是企业级操作系统 Zoho、企业级信息科技管理产品 Manage Engine、以及网络管理架构 Webnms,这些产品已经应用在了医疗健康、教育服务和娱乐等行业,用户数量更是超过了 2000 万。 在 Zoho 公司所投资的初创公司中,比较特殊的是总部位于班加罗尔的机器视觉公司 Zentron Labs,因为早在 2014 年,Zoho 就对该公司有过投资,并且获得了该公司少量股权。 Vembu 是 Zoho 公司创始人兼首席执行官,他表示: 我们会和企业创始人进行大量交流,只有这些初创公司的产品能够和 Zoho 旗下产品组合很好地融合在一起,才会决定投资或收购。如果创业者单独开发了一款产品,同时并不具备较好地整合性,那么可能就不会太适合 Zoho 公司投资文化了。我们在印度构建了首批软件产品,而且在 Zoho 公司 20 多年的发展历史上,已经多次挑战了传统智慧。 去年十一月,Zoho 公司发布一款智能桌面帮助软件 Zoho Desk,该软件会利用客户和其他 Zoho 旗下产品(比如客户关系管理产品 Zoho CRM 和项目管理产品 Zoho Project)的交互数据,有效整合票务代理和实时问题解决方案。值得一提的是,Zoho Desk 也是该公司在 2016 年推出的第六款产品。 本文来自翻译:techcircle.vccircle.com
    资讯
    2017年01月09日
  • 资讯
    纯技术角度:从 MONGODB “赎金事件” 看安全问题 今天上午(2017年1月7日),我的微信群中同时出现了两个MongoDB被黑掉要赎金的情况,于是在调查这个事的过程中,我发现了这个事。这个事件应该是2017年开年的第一次比较大的安全事件吧,发现国内居然没有什么报道,国内安全圈也没有什么动静(当然,他们也许知道,只是不想说吧),Anyway,让我这个非安全领域的人来帮补补位。 事件回顾 这个事情应该是从2017年1月3日开始的,是由安全圈的大拿 Victor Gevers (网名:0xDUDE,GDI.foundation 的Chairman),他在2016年12月27日,他发现了一些在互联网上用户的MongoDB没有任何的保护措施,被攻击击把数据库删除了,并留下了一个叫 WARNING 的数据库,这张表的内容如下: { "_id" : ObjectId("5859a0370b8e49f123fcc7da"), "mail" : "harak1r1@sigaint.org", "note" : "SEND 0.2 BTC TO THIS ADDRESS 13zaxGVjj9MNc2jyvDRhLyYpkCh323MsMq AND CONTACT THIS EMAIL WITH YOUR IP OF YOUR SERVER TO RECOVER YOUR DATABASE !" } 基本上如下所示: MongoDB ransom demand (via Victor Gevers)说白了就是黑客留下的东西——老子把你的MongoDB里的数据库给转走了,如果你要你的数据的话,给我0.2个的比特币(大约USD200)。然后,他的twitter上不断地发布这个“赎金事件”的跟踪报道。与此同时,中国区的V2EX上也发现了相关的攻击问题 《自己装的 mongo 没有设置密码结果被黑了》 然后,在接下来的几天内,全球大约有1800个MongoDB的数据库被黑,这个行为来自一个叫 Harak1r1 的黑客组织(这个组织似乎就好黑MongoDB,据说他们历史上干了近8500个MongoDB的数据库,几乎都是在祼奔的MongoDB)。 不过,这个组织干了两天后就停手了,可能是因为这事已经引起了全球科技媒体的注意,产生了大量的报道(如果你在Google News里查一下“mongodb ransom”,你会看到大量的报道(中文社区中,只有台湾有相关的报道)),他们也许是不敢再搞下去了。 不过,很快,有几个copycats开始接着干, 马上跟进的是 own3d ,他们留下的数据库的名字叫 WARNING_ALERT,他们至少干掉了 930个MongoDB,赎金0.5个比特币(USD500),至少有3个用户付费了 然后是0704341626asdf,他们留下的数据库名字叫PWNED,他们至少干掉了740个MongoDB,赎金0.15个比特币(USD150),看看他们在数据库里留下的文字——你的MongoDB没有任何的认证,并且暴露在公网里(你TMD是怎么想的?)…… 0704341626asdf group ransom note (via Victor Gerves)就在这两天,有两个新的黑客也来了 先是kraken0,发现到现在1天了,干了13个MongoDB,赎金 0.1个比特币。 然后是 3lix1r,发现到现在5个小时,干了17个MongoDB,赎金0.25比特币。 BBC新闻也于昨天报道了这一情况——《Web databases hit in ransom attacks》,现在这个事情应该是一个Big News了。 关于MongoDB的安全 安全问题重来都是需要多方面一起努力,但是安全问题最大的短板就是在用户这边。这次的这个事,说白了,就是用户没有给MongoDB设置上用户名和口令,然后还把服务公开到了公网上。 是的,这个安全事件,相当的匪夷所思,为什么这些用户要在公网上祼奔自己的数据库?他们的脑子是怎么想的? 让我们去看一下Shodan上可以看到的有多少个在暴露在公网上而且没有防范的MongoDB?我了个去!4万7千个,还是很触目惊心的(下图来自我刚刚创建的 Shodan关于MongoDB的报表)   那么,怎么会有这么多的有对象显露的MongoDB?看了一下Shodan的报告,发现主要还是来自公有云平台,Amazon,Alibaba,Digital Ocean,OVH,Azure 的云平台上有很多这样的服务。不过,像AWS这样的云平台,有很完善的默认安全组设置和VPC是可以不把这样的后端服务暴露到公有云上的,为什么还会有那么多?   这么大量的暴露在公网上的服务是怎么回事?有人发现(参看这篇文章《It’s the Data, Stupid!》 ),MongoDB历史上一直都是把侦听端口绑在所有的IP上的,这个问题在5年前(2011年11月)就报给了MongoDB (SERVER-4216),结果2014年4月才解决掉。所以,他觉得可能似乎 MongoDB的 2.6之前的版本都会默认上侦听在0.0.0.0 。 于是我做了一个小试验,到我拉Ubuntu 14.04上去 apt-get install mongodb(2.4.9版),然后我在/etc/mongodb.conf 文件中,看到了默认的配置是127.0.0.1,mongod启动也侦听在了127.0.0.1这台机器上。一切正常。不过,可能是时过境迁,debain的安装包里已加上了这个默认配置文件。不管怎么样,MongoDB似乎是有一些问题的。 再到Shodan上看到相关的在公网裸奔的MongoDB的版本如下,发现3.x的也是主流:   虽然,3.x的版本成为了主流,但是似乎,还是有很多人把MongoDB的服务开到了互联网上来,而且可以随意访问。 你看,我在阿里云随便找了几台机器,一登就登上去了,还都是3.2.8的版本。 真是如那些黑客中的邮件所说的:WTF,你们是怎么想的? 后续的反思 为什么还是有这么多的MongoDB在公网上祼奔呢?难道有这么多的用户都是小白?这个原因,是什么呢?我觉得可能会是如下两个原因: 1)一是技术人员下载了mongod的软包,一般来说,mongodb的压缩包只有binary文件 ,没有配置文件 ,所以直接解开后运行,结果就没有安全认证,也绑在了公网上。也许,MongoDB这么做的原因就是为了可以快速上手,不要在环境上花太多的时间,这个有助于软件方面的推广。但是,这样可能就坑了更多的人。 2)因为MongoDB是后端基础服务,所以,需要很多内部机器防问,按道理呢,应该绑定在内网IP上,但是呢,可能是技术人员不小心,绑在了0.0.0.0的IP上。 那么,这个问题在云平台上是否可以更好的解决呢? 关于公网的IP。一般来说,公有云平台上的虚拟主机都会有一个公网的IP地址,老实说,这并不是一个好的方法,因为有很多主机是不需要暴露到公网上的,所以,也就不需要使用公网IP,于是,就会出现弹性IP或虚拟路由器以及VPC这样的虚拟网络服务,这样用户在公有云就可以很容易的组网,也就没有必要每台机器都需要一个公网IP,使用云平台,最好还是使用组网方案比较好的平台。 关于安全组。在AWS上,你开一台EC2,会有一个非常严格的安全组——只暴露22端口,其它的全部对外网关闭。这样做,其实是可以帮用户防止一下不小心把不必要的服务Open到公网上。按道理来说,AWS上应该是帮用户防了这些的。但是,AWS上的MongoDB祼奔的机器数量是最多的,估计和AWS的EC2R 基数有关系吧(据说AWS有千万台左右的EC2了) 最后,提醒大家一下,被黑了也不要去付赎金,因为目前来说没有任何证据证明黑客们真正保存了你的数据,因为,被黑的服务器太多了,估计有几百T的数据,估计是不会为你保存的。下面也是Victor Gevers的提示: (全文完) 关注CoolShell微信公众账号可以在手机端搜索文章 (转载本站文章请注明作者和出处 酷 壳 – CoolShell ,请勿用于任何商业用途) http://coolshell.cn/articles/17607.html
    资讯
    2017年01月07日
  • 资讯
    HR 接收简历意外感染勒索软件 GoldenEye,须付上万赎金解密文件 稿源:HackerNews.cc翻译整理,封面来源:百度搜索。 转自 HackerNews.cc 原文链接:http://hackernews.cc/archives/4664 长期以来,勒索软件一直被认为是消费者和企业的主要威胁。最近一系列针对企业人力资源( HR )部门的恶意活动表明,勒索软件对企业的威胁正持续上升。攻击者精心设计了一个简历邮件,其中不仅包含了应聘人的简短介绍,还包含了两个“详细介绍”的附件。 安全公司 Check Point 称,此类钓鱼邮件专门针对人力资源部门,因为 HR 不可避免的需要打开陌生人的电子邮件和附件去了解情况。垃圾邮件一直被用作为恶意软件的传播媒介,毫无疑问,攻击者继续使用这种方法去传播勒索软件“ GoldenEye ”,“ GoldenEye ”是勒索软件 Petya 的一个变种系列,恶意宏代码可执行、加密计算机上的文件。加密完成后,代码会修改主引导记录( MBR ),重新启动电脑并加密磁盘文件。 安全公司 Check Point 表示“ GoldenEye ”主要针对德语用户。钓鱼邮件中包含两个附件,其中一个附件是正常的 PDF 求职信,目的是为了迷惑受害者让她相信这确实是一个求职者。此后,受害者会打开另外一个带有恶意宏功能的 Excel 文件。Excel 会显示一个正在加载的图片并请求受害者启用内容,以便继续加载宏文件。一旦受害者单击“启用内容”,宏内的代码将被执行并启动加密文件进程,使受害者无法访问文件。 勒索软件“ GoldenEye ”会以 8 个字符的随机扩展名加密文件,所有文件加密后,将会显示一个勒索信“你的文件已被加密.txt”。 你以为结束了?显示完勒索信后,勒索软件会强制电脑重新启动并开始加密电脑磁盘,在加密磁盘过程中屏幕会显示一个“假的”磁盘修复进程。最终,加密完成并显示解密方法。受害者需要缴纳 1.3 比特币的赎金(约 1.1 万人民币)。此外,勒索软件作者还提供邮件“咨询”服务,全程帮助受害者解决恢复文件过程中遇到的各种问题。 目前,尚且没有安全公司发布解密工具解密文件。人力资源部门在接收邮件时应警惕查看附件( Word、Excel、PDF ),禁用宏功能,切勿点击不可信链接,并及时做好文件备份。
    资讯
    2017年01月06日
  • 资讯
    Gartner 26亿美金收购CEB(SHL)通过现金加股票的方式,预计今年上半年完成   北京时间1月5日晚间消息,IT调研与咨询服务公司Gartner今日宣布,将以价值26亿美元的现金和股票收购商业调研与分析公司CEB,从而拓展公司的商业调研服务。 CEB总部位于弗吉尼亚州的阿灵顿(Arlington),主要服务包括人力资源、销售、财经和法律相关的研究与分析。收购CEB之后,Gartner的业务范围将得到进一步拓展。 根据收购协议,Gartner将以每股54美元的现金及0.2284股Gartner股票收购CEB,即每股CEB股票可兑换54美元现金和0.2284股Gartner股票。与CEB周三收盘价相比,该收购价格溢价约25%。 两家公司合并后,Gartner股东将拥有新公司约91%的股份。根据协议,CEB还拥有35天的“询价期”。该期间内,CEB还可以寻求其他更高的报价。 Gartner表示,预计该交易将于今年上半年完成。交易完成后即可推动公司每股摊薄收益增长(基于非美国通用会计准则),而2018年可推动每股摊薄收益涨幅达到两位数。(李明)   更新: @程时旭 程老大解读: Gartner和CEB为什么合并?这两家公司都是卖会员(Membership)的,Gartner强在IT、Marketing、Supply Chain;CEB强在HR、Sales、Finance、Legal。Gartner在全球99个国家营业,销售比CEB多出10倍以上,原则上来说,Gartner又有最好的东西可卖了,是完全的强强联手。
    资讯
    2017年01月05日