21–30 of 71 posts
Earlier quoted context omitted.
Because when you host it yourself, it can be off of the public internet.
and what about if your network is compromised? For most small-medium businesses, that's more likely than Slack being compromised.
I'm not saying it's safer to self-host. There are a ton of foot-guns with operating your own IRC server.
Umm... why do people always assume "hosting it yourself" is more secure and not less? Do you have Slack's security expertise and budget? In my experience when small to mid-size companies attempt to manage security themselves they do a passable job but are convinced they are doing an excellent job - until they get hacked. Larger companies usually have the budget, tools and expertise. But even then there are lots big c…
Corollary question: Why do you assume that Slack's security expertise and security budget is greater than your own? All we can do is assume that Slack cares about security enough to be sufficient. Last I checked, they didn't have any form of compliance certification, yet HIPPA, PCI, etc. compliant clients use them without reservation.
I don't assume it. I know it for a fact; I've met some of their team and I know others by reputation. And I'm not exactly a slouch when it comes to this stuff (I don't eat and sleep crypto but a large part of my business is building secure infrastructure/consulting on the systems running on that infrastructure for regulated as well as non-regulated environments).
Why would a zebra have evolved to have black and white stripes? You could see a zebra from miles away due to how it stands out! Yet.. when it's in a herd of zebra, it's hard to pick any individual one out, and that's why the pattern works.
And so it goes with using services like Slack, Gmail, S3, etc. My account on its own may not be the most secure thing ever but it's hidden in such a large pool of data - much of it far more valuable than mine - that the safety of the herd becomes relevant.
Umm... why do people always assume "hosting it yourself" is more secure and not less? Do you have Slack's security expertise and budget? In my experience when small to mid-size companies attempt to manage security themselves they do a passable job but are convinced they are doing an excellent job - until they get hacked. Larger companies usually have the budget, tools and expertise. But even then there are lots big c…
I think both options have tradeoffs. If you use a service, you're outsourcing your security to perhaps more competent people, but you're making yourself a larger target. Self-hosting makes you a smaller target, but you're taking all the risk on yourself. Neither is a panacea.
Earlier quoted context omitted.
Corollary question: Why do you assume that Slack's security expertise and security budget is greater than your own? All we can do is assume that Slack cares about security enough to be sufficient. Last I checked, they didn't have any form of compliance certification, yet HIPPA, PCI, etc. compliant clients use them without reservation.
> Why do you assume that Slack's security expertise and security budget is greater than your own? I don't assume it. I know it for a fact; I've met some of their team and I know others by reputation. And I'm not exactly a slouch when it comes to this stuff (I don't eat and sleep crypto but a large part of my business is building secure infrastructure/consulting on the systems running on that infrastructure for regula…
Based on their security practices document, they seem to store documents unencrypted on their servers. It's encrypted in transit, sure, but not in storage? I was shocked when I found out.
https://help.salesforce.com/servlet/servlet.FileDownload?fil...
At least Slack encrypts data at rest https://slack.com/security
You should assume that chat logs can become public at anytime, if you host it yourself or not. Don't put sensitive/embarrassing unencrypted information in chat or email. People forget this is still data at rest.
>> It's just a matter of time before there's a huge incident. I suppose that's correct. When (or maybe if, but probably when) Slack gets breached/hacked/owned it's going to be huge because a huge number of people are going to lose something that they didn't want to lose. When I'm self hosting something and that thing gets breached/hacked/owned it's going to be huge for me because I and/or my company are going to lose…
The most successful software apps in the world are built with PHP. Facebook, Wikipedia, Slack, WordPress, Flickr, Yahoo. Users don't care about your tech.
However, most of the backend services at Slack (the ones you'd actually want to attack) aren't even in PHP anymore: according to their job reqs, they're in Java and Go.