Guide to Slack import and export tools

Post by dsacco » Wed, Mar 21, 2018, 4:29 PM UTC

afastow wrote: post #164

dsacco wrote: post #108

Earlier quoted context omitted.

What is the material difference between having employees save DM logs in an auditable, authenticated way and being able to view employee DMs? If any employee can ostensibly be compelled to provide their logs when asked by their employer, you are getting just as much information as if IT can view them directly. The only way IT doesn't get as much information is if the system doesn't work, for example because employees…

> What is the material difference between having employees save DM logs in an auditable, authenticated way and being able to view employee DMs? > When you are reviewing an auditable log of information related to an employee, you don't necessarily want to have to ask the employee for that information, nor do you necessarily want them to know you're reviewing it. You just answered your own question. You might not want…

Post by dlubarov » Wed, Mar 21, 2018, 4:30 PM UTC

dsacco wrote: post #89

IncRnd wrote: post #43

Earlier quoted context omitted.

There are security issues here that you may not be aware. For one example, if technically knowledgeable people want to falsify signed logs without having the signing key, they can simply keep a separate set of logs with actual innocuous conversations. Slack would sign those in your scenario without a problem. This is the canonical problem of keeping "double-books".

While I agree with auditable access to employee DMs, there is a middle ground solution that trivially solves the problem you've presented. Instead of providing the employer with access to the employee's messages directly, logs can be signed at both the blob and message level. Then if an employee selectively turns over only some of their logs, the mismatch will be readily apparent.

Post by rmc » Wed, Mar 21, 2018, 4:31 PM UTC

pera wrote: post #180

theobon wrote: post #124

Earlier quoted context omitted.

You are assuming that harassment was direct, sending messages to the accusers. My impression is that this was a group chatting privately about the accusers either making fun of them or coordinating actions. While this can be done through other channels (in person or private cellphone) allowing it on corporate infrastructure without monitoring is not acceptable.

If harassers, as you have mentioned, can simply switch to another channel, then what problem exactly is this measure trying to solve? I'm honestly confused.

Post by kingnight » Wed, Mar 21, 2018, 4:32 PM UTC

Post by rmc » Wed, Mar 21, 2018, 4:32 PM UTC

kryptiskt wrote: post #188

s3nnyy wrote: post #105

Earlier quoted context omitted.

> "Compare that to our email, where I can go into anyone's messages immediately if need-be. This is all very standard corporate IT stuff that you need for HR and legal reasons." Wow, THAT is highly illegal in Europe.

Europe consists of plenty of countries, all of them different. It seems like statements on HN about how it is "in Europe" is usually Americans writing fan fiction about some never-never land.