It was only three days ago that I wrote about the almost hopeless challenge of web security, specifically around new vectors with cross-site scripting attacks. Today came news that an XSS vulnerability had been found in the RubyOnRails development framework – and that applications built on the framework, such as Twitter and Basecamp, were vulnerable to XSS attacks.

The vulnerability was discovered by Brian Masterbrook. He probed Twitter with some Unicode characters and found it vulnerable, tried the same thing on Basecamp and found it vulnerable, and then deduced that it must be a problem with RubyOnRails. He has an excellent and detailed write-up on his site about the process he went through. If you are running RubyOnRails anywhere, stop now and read his post as well as the security notice from the Rails developers and get your servers updated (the patch is in the notice, it will be in the release branch ‘today or tomorrow’).

There are a few parts to this story. The first part is that it is great that Brian just happen to be one of the ‘good guys’. We find out about this vulnerability because he put the effort in to inform the parties involved and to get a fix out. We could have easily found out about this the hard way.

The second part is the poor response he got from the guys at Basecamp. I use Basecamp, I have two accounts there and we use it somewhat internally at Techcrunch. Not anymore. Their response to a major security issue does not inspire any confidence, at least not enough confidence that I would feel comfortable having my personal data residing on their servers (for more details on their response, see Brian’s post). Twitter I am not as concerned about – they seem to have their act together in terms of responding to issues promptly (they have had their fair share of security issues, no link required there I think). Brian originally discovered this issue almost a month ago – he seems to have spent a lot of time just communicating with these vendors.

Third part – learning from the mistakes of others. Point one would be: if you are a vendor of an application, get your shit together so that when one of the good guys wants to be able to tell you about a vulnerability he or she discovered, you don’t lose a day arguing about if an email had been sent or not (I am looking at you too Apple – that post will come later). ‘Getting your shit together’ involves having a clear contact page for security issues, a PGP key (afterall, you don’t want everybody reading about how your site is vulnerable), and perhaps a few lines of policy on what you will do if a security issue is discovered (‘its not our fault’ is not a policy).

Point two (of the third part – you following?) is about what developers can learn. If you scan the patch file that the RubyOnRails guys sent out you will see one word consistently popup in the code – ‘verify’. That is what this issue, and what almost all security issues, come down to – not trusting user data and making assumptions about what data your application will receive. The majority of applications take a blacklist approach – ie. check for that, check for this, filter, block, filter .. filter. The more correct approach is to assume that everything coming in from anywhere is going to completely screw you up, and then allow only what the application can handle and only what you expect. If your application is all in English, and you start seeing some funky Unicode characters that were previously only used by a long-forgotten African tribe – there is a safe bet that somebody is messing with you. Blacklist vs Whitelist.

Something else I noticed that has come out of this incident. The RubyOnRails notice attributes the cause of this vulnerability to:

“Due to the way that most databases either don’t accept or actively cleanse malformed unicode strings”

Oh, im sorry? Its the database! Remind me next time I pick a database server to use that I choose one that will filter and anticipate all my user data for me (hint: I was being a sarcastic, if you are a CIO who just picked up the phone to Oracle to ask for the XSS-proofing module, put the phone down). It is easy to shift blame – but this would be like the Microsoft IIS 4.0 team blaming Dennis Ritchie for all their buffer overflows.

We are going backwards with security. It is 2009 and vendors aren’t responding properly and blame is being shifted. In the meantime, RubyOnRails is now seeing a surge in downloads from Russia and various other places – not because those new users want to build apps, but because they want to own yours.

This was that I had in mind when Israeli startup Clarizen approached me, explaining theirs is a project management and collaboration tool specifically aimed at non-project managers. There’s no question Clarizen is a latecomer to the space, but they seem to have the right ingredients: A fairly convenient interface, a smidgen of unique differentiation, and friendly pricing to boot—and $15M in funding doesn’t hurt either, of course.

Clarizen is making two great offers available for TechCrunch readers:  First, Clarizen is auctioning off five (5) FREE one year subscriptions to TechCrunch readers. All you need to do is explain in the comments why you need and want Clarizen and how you intend to use it. The Clarizen team will select the 5 winners. Make sure to include a valid email address along with your comment!  Second, anyone who mentions this TechCrunch post to Clarizen’s sales team when making any purchase will receive one additional free subscription for the term of their purchase.

Clarizen was designed as a PM tool for operational/functional managers (think: department heads). This is a good move because the biggest failing point in project management is probably during the set-up stage which requires the project be planned out to the “T” before it can be rolled out. This is a process that requires a high level of familiarity with such methodologies, so it’s no surprise why non-professional project managers bail on it so often.

Clarizen deals with this basic problem by allowing the project participants to assist in the planning, even if the project has already begun. The collaborative planning and execution can transpire among teams working within the same organization, or among those whose resources are dispersed between two or more companies.

Here’s an example: Let’s say my project is the creation of a Facebook app and I own entire the project. I can delegate my R&D manager to set and manage the in-house development process and its dependencies. When it comes to the user interface, though, I’ve gone with an outside contractor who obviously has his own work processes and dependencies. With Clarizen I can have the contractor enter and update all the relevant info independently, while I maintain a unified view of the project at large. As a side note, Clarizen includes with each company subscription a single free license for a partner.

One of the things I like about Clarizen is that it puts reality above methodology. Even if the full scope is unknown or the whole plan is not complete, projects can be kicked-off by activating only the parts that are ready to roll. At any point, any portion of the project can be switched back to draft mode, be paused, re-planned and reactivated. So if the graphics designer goes snowboarding for a week unexpectedly (something far too many of us can relate to), no problem, the task can be reactivated when he/she gets back. Other PM tools provide similar functionality but in a version control paradigm that involves the project’s “baseline”. Basically this creates a new version of the project each time an “anomaly” (i.e., delays caused by the real world) occur.  Clarizen, in contrast, treats delays as a normal occurrence.

Another feature I found useful is that Clarizen allows projects to be updated without having to log into the application. Using the Facebook app example above, the contractor would be sent an email notification (screenshot below) with a link to a form in which the task statuses can be updated. No login is required, no subscription has to be purchased. Very convenient indeed.

Clarizen has been selling its solution for a year now with the bulk of its customer base considering it an alternative to heavy-duty enterprise solutions such as Clarity and Primavera. The company did not reveal the amount of actual subscribers it has, but did share with me that it has over 200 customers and that current contract closures are predominantly for 12-month terms.

College students now have their own Yammer. Last week, Wiggio came out of beta with a new look and a slew of group messaging and group management features. For each private group that you create, Wiggio provides a Twitter-like message stream from all the group members. But it also includes a slew of other features such as a shared calendar, mass text and voice messaging, file-sharing (including online docs and spreadheets), polling, and more.

Many of these features can be found in other products such as Yammer, Basecamp, WizeHive, and Producteev. But Wiggio is a solid addition to the group messaging family, and it is already gaining some traction by targeting college students and their particular group dynamics (academic, extracurricular, social, committees, sports teams, music/dance, religious, charity, etc.). Wiggio, which has been in closed beta for a year, already has 45,000 users, about 80 percent of which are college students and faculty members.

The site was created in January, 2008 by Dana Lampert, who was then a senior at Cornell. His two co-founders are Rob and Derek Doyle, sons of Bob Doyle, the creator of MacPublisher (the first desktop publishing program) and the 1970s electronic game Merlin. The elder Doyle is an adviser and investor in Wiggio, and houses the four-person startup in his lab a block away from Harvard. Wiggio raised $450,000 in an angel round last August.

The site offers following features:

• Shared calendar (with SMS reminders)
• Folder (includes group editing of docs and spreadsheets, photo sharing, video)
• Mass text and voice messaging
• Free conference calling and web meetings
• Polling
• List-serv

Groups can be created by simply adding people’s email. They don’t even have to sign up. Wiggio hooks into existing text messaging and email services. You can email an entire group, take group polls, import calendars, share documents, links, photos, videos, and other files. Wiggio uses Zoho and Scribd for shared document viewing and editing, and has partnered with Rondee for the teleconferencing. All the other features were developed in-house.

Lampert has several ideas for making money, including display ads targeted by group type and university, SMS ads, and subscriptions for additional customization and security features.

Here are a couple intro videos and screenshots:

Yammer definitely started something. The enterprise Twitter service has more competition today from Wizehive, a Web-based group messaging and task management service for businesses. WizeHive just launched in beta. We have 500 invites (just enter “TC2009″ when you sign up).

WizeHive is a bootstrap startup funded with $100,000 from the founders Mike Carson and Michael Levinson. Levinson is also the founder of DreamIt Ventures, a YCombinator-like startup incubator in Philadelphia. DreamIt itself did not invest, but Levinson created WizeHive out of the frustrations of managing all the different DreamIt projects and applicants. Says Levinson:

I needed something to organize all my thoughts and activities for DreamIt. Stuff was flying all over the place. I looked at Basecamp and Central Desktop, I didn’t think they were intuitive enough, the way the interfaces were designed, for my partners (who are business partners, not techies).

Although it is similar in many respects to Yammer, Present.ly (our review), Basecamp, Central Desktop, and even in some ways to Producteev (our review), WizeHive is a worthy competitor and adds a few twists of its own.

Like Yammer and the rest, WizeHive lets you set up workgroups and displays messages to everyone in a Twitter-like stream. But conversations are threaded. You can click to see an entire thread (the most recent message also appears at the top of the stream). WizeHive also works great on the iPhone and other mobile browsers (Blackberry and Android optimizations are coming soon), and you can get it as a desktop Adobe Air client or receive alerts in your email. (If you CC notes@wizehive and put the workspace in brackets in the subject line of an email, WizeHive will ingest and categorize the contents of the email, including attachments). Soon, you will be able to get WizeHive updates in your Twitter feed as well.

WizeHive also adds task-management features like Basecamp, Huddle, and Producteev. You can create a task, set a due date, and assign it to yourself or to someone else. Each task can be marked as “open,” “completed,” or “in progress.” You can also upload files, and everyone can view them in-browser. Images and files can be attached to specific messages.

The most distinctive feature of WizeHive, though, is that it allows you to create a small database for each workspace, complete with customizable data fields. This is great for managing contacts or organizing events. WizeHive plans to add additional apps for which it will charge subscription fees. The first two due out in January will be a simple Opprtunity Tracking app for CRM purposes and one for TimeSheets. WizeHive already has an API and hopes others developers will build their own add-ons.

WizeHive is free for up to three people and up to 50MB of storage, and then fees start at $8 a month for a small group, with additional fees for extra storage. Add-on apps built on top of the API will cost less than $10 a month, and is where Levinson thinks he can make the most money.

http://vimeo.com/moogaloop.swf?clip_id=2574685&server=vimeo.com&show_title=0&show_byline=0&show_portrait=0&color=&fullscreen=1
WizeHive Overview from mike on Vimeo.

The products have a lot of similarities. They’re all web based applications for managing your team projects. Both GoPlan and BaseCamp are hosted pay services made by staunch Ruby evangelists, while the more basic ActiveCollab is an open source PHP installation. GoPlan and BaseCamp prices range from free plans up to beefier pay plans (BaseCamp’s unlimited maxes out at $150/month, while GoPlan tops off at $100/month). Derek over at 5ThirtyOne has a detailed feature comparison of the three.

GoPlan’s project management tool offers modules for note-taking, calendaring (with iCal export), task management, issue tracking, file management and online real-time chat (optional SSL). BaseCamp has a lot of the same features, minus bug tracking and a public project blog. GoPlan has also approached project tracking with a different design methodology. GoPlan not only lets you choose features based on plan levels, but also turn them on and off as needed to keep navigation free of feature clutter.

GoPlan has also shot for a lower price point than BaseCamp (basic $20/$24; premium $100/$150), but with less file storage (GoPlan tops out at 8GB). Their free account gets you everything except calendaring and chat. However, for the paid accounts, GoPlan unlocks features faster. $10/month gives you all of GoPlan’s features for 12 projects of 8 people each. For an extra $20/month you get unlimited users, and 30 projects (twice BaseCamp).

For readers interested in real-time project collaboration, check out our comparison coverage of ConceptShare and Thinkature.

First, Basecamp now hosts files directly on their servers without the need to set up your own FTP server. Files as large as 20 mb can be uploaded.

Second, Basecamp has created a basic affiliate program. If an affiliate pushes new paying members to Basecamp, the user gets credits against their Basecamp fees.