2

I've been using Sublime Text for pretty much everything related to my development needs. In terms of Salesforce, I know there's a plugin called MavensMate doing just the same as the Eclipse plugin, but it requires many dependencies (all the Ruby-related stuff and much more) and is hard to install on Windows.

I recently discovered Salesforce IDE and I tried it with personal projects, and it's super easy to install and blazing fast.

Now, for using it for customer projects, that's another question. Anyone ever tried it, or did a security audit on it to make sure that it does not leak any sensitive information?

1 Answer 1

2

The software is FOSS, so it goes without saying that the author most likely has not intentionally hidden any back doors in the software. A cursory search and browse suggests that the code makes no attempt to access any servers or networks outside of salesforce.com, does not perform any disk activity outside that needed to process ZIP files, bulk API requests, etc, and appears to have no abnormal security flaws.

From a brief skimming, there appears to be no unusual bugs that would cause crashes or hangs, although there (however unlikely) may be obscure bugs that would require deeper analysis. The code is written in a straight-forward manner with no obfuscation of variable names, dictionary keys, method names, etc. All connections are secured with OpenSSL, all messages appear to be well-formed and properly escaped, etc. The code is legible and appears well-formed.

Of course, as with most tools that interface with salesforce.com, your username and password are stored in the clear, meaning that you should take appropriate measures to restrict access to your workspace files through whatever mechanisms your OS provides for locking down file access (Unix-like permissions should be 0600/0700, Windows permissions should grant access only to SYSTEM, Administrators, and you), and possibly encrypted as a whole if you were paranoid (EFS or equivalent). Note that data will inevitably reside on your hard drive as a result of using this plugin. All data appears to be contained in the workspace folder/directory. Securing your workspace folder should be considered important if you do not want to risk exposing client data.

In summary, short of some odd user-facing messages and comments that simply suggest that American English is not the author's native language (e.g. "This command is ongoing" instead of something closer to "The command is executing" or "Executing command"), which is not a problem, as the messages are still intelligible, there are no obvious security flaws or blatantly obscured code that would suggest any real security concerns. Please note that although I am a professional developer, I am by no means a security consultant, so you should probably take the time to examine the software closely yourself, or, if you are not familiar with Python, find someone who is.

2
  • Exactly, I did a quick overview of the code, but I'm not so familiar with Python. Thanks for your quick analysis. Are you using this module?
    – jpmonette
    Jan 29, 2014 at 0:56
  • @jpmonette I am not. I am writing my own Chrome app that will provide the features that I need/want, including automatic syncing across my devices, full code completion support, and cross-server deployment using OAuth2/REST/etc. Unfortunately, it's not ready yet, but I'll tweet about it someday (hopefully this year, lol). In the meantime, I use the Force.com IDE for day to day stuff.
    – sfdcfox
    Jan 29, 2014 at 2:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .