Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Wanna know what product your competitor is working on? Try Slack

tanay.co.in

Post reply on HN
Print view View original

11–20 of 145 posts

Re: Wanna know what product your competitor is working on? Try Slack

#11

Post by tomp »

johannh wrote: post #3

This is something that could definitely have been reported to Slack before disclosing it publicly. Maybe he did that, but it's not mentioned in the blog post so I assume he didn't. It's just a nice thing to do and they might reward you for it. You can still post it on your blog after they released a fix.

The way companies handle security disclosures lately (i.e. laughing it off, or paying $6 reward), it seems like shaming them would work much better. Plus, this is truly a beginner-level failure, the kind you'd get insulted for by Linus.

Re: Wanna know what product your competitor is working on? Try Slack

#15

Post by johannh »

tomp wrote: post #11
johannh wrote: post #3

This is something that could definitely have been reported to Slack before disclosing it publicly. Maybe he did that, but it's not mentioned in the blog post so I assume he didn't. It's just a nice thing to do and they might reward you for it. You can still post it on your blog after they released a fix.

The way companies handle security disclosures lately (i.e. laughing it off, or paying $6 reward), it seems like shaming them would work much better. Plus, this is truly a beginner-level failure, the kind you'd get insulted for by Linus.

True, but it still feels like the right thing to do.

I'd like people do be responsible when they discover a serious flaw in my programs, so I'll try to be responsible when discovering one in theirs.

Also Linus basically insults anyone for being alive.

Re: Wanna know what product your competitor is working on? Try Slack

#16

Post by Totoradio »

motdiem wrote: post #4

The site seems to be down at the moment. Here is a cached version [1] The gist of it: the slack mac client seems to ask you for your groups before properly authenticating you - hence if you put in the email address of a competitor (or famous person), you can see which groups they belong to, which might be valuable information. (haven't tried it myself, just summarising the post) [1] http://cc.bingj.com/cache.aspx?q=h…

1) The slack web sign up seems affected too

2) Any email address, valid or not with a valid domain name works

Re: Wanna know what product your competitor is working on? Try Slack

#17

Post by smt88 »

tomp wrote: post #11
johannh wrote: post #3

This is something that could definitely have been reported to Slack before disclosing it publicly. Maybe he did that, but it's not mentioned in the blog post so I assume he didn't. It's just a nice thing to do and they might reward you for it. You can still post it on your blog after they released a fix.

The way companies handle security disclosures lately (i.e. laughing it off, or paying $6 reward), it seems like shaming them would work much better. Plus, this is truly a beginner-level failure, the kind you'd get insulted for by Linus.

Why assume the worst about Slack just because some other companies have handled disclosures badly?

Real people work at Slack, and very few of them were likely responsible for this oversight.

OP could still pat him/herself on the back after disclosing and waiting for a fix.

Re: Wanna know what product your competitor is working on? Try Slack

#19

Post by smt88 »

kolev wrote: post #12

This is a capitulation - even Google uses Slack instead of Hangouts (although just a few teams); even Microsoft instead of Skype.

Neither Skype nor Hangouts are intended to compete with Slack. They're consumer products, while Slack is intended for business teams.
Post reply on HN