Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Wanna know what product your competitor is working on? Try Slack

tanay.co.in

Post reply on HN
Print view View original

31–40 of 145 posts

Re: Wanna know what product your competitor is working on? Try Slack

#31

Post by ankey1 »

tomp wrote: post #11
johannh wrote: post #3

This is something that could definitely have been reported to Slack before disclosing it publicly. Maybe he did that, but it's not mentioned in the blog post so I assume he didn't. It's just a nice thing to do and they might reward you for it. You can still post it on your blog after they released a fix.

The way companies handle security disclosures lately (i.e. laughing it off, or paying $6 reward), it seems like shaming them would work much better. Plus, this is truly a beginner-level failure, the kind you'd get insulted for by Linus.

Slack has a Reporting Security Vulnerabilities page on its site: http://slack.com/whitehat. Seems like something they would have taken seriously if it had been brought to them first.

Re: Wanna know what product your competitor is working on? Try Slack

#32

Post by fidz »

junto wrote: post #25
jdkanani wrote: post #22

I just realized that any facebook user can signup on https://facebook.slack.com/ with his fb username.

And this is why you should silo customer domains from internal domains as github did (smartly)!

I am curious. Could you elaborate on this?

Edit: I wonder how Github distinguish their own "internal" email doing.

Re: Wanna know what product your competitor is working on? Try Slack

#35

Post by rbinv »

fidz wrote: post #32
junto wrote: post #25

Earlier quoted context omitted.

And this is why you should silo customer domains from internal domains as github did (smartly)!

I am curious. Could you elaborate on this? Edit: I wonder how Github distinguish their own "internal" email doing.

Well, this flaw is one example: Slack assumes that someone with an @facebook.com email address must be a Facebook employee. However, Facebook issues @facebook.com email addresses to regular users, too.

Re: Wanna know what product your competitor is working on? Try Slack

#38

Post by tiglionabbit »

johannh wrote: post #3

This is something that could definitely have been reported to Slack before disclosing it publicly. Maybe he did that, but it's not mentioned in the blog post so I assume he didn't. It's just a nice thing to do and they might reward you for it. You can still post it on your blog after they released a fix.

This is hardly an exploit. Since no authentication is required in order to see the chatroom listings for any domain, we must assume that they meant for their chatroom directory to be public information. This may not be what their customers are expecting, though...

Re: Wanna know what product your competitor is working on? Try Slack

#39

Post by DHowett »

While I'm unable to comment on the content of the article, I really have to applaud HostGator's error page marketing strategy here.

We've met with a horrible fate (status code 500) while generating what appears to be a static page. This site is hosted by HostGator! Get yours now!

Re: Wanna know what product your competitor is working on? Try Slack

#40

Post by anonfunction »

theunixbeard wrote: post #28

Fun to scan down this list: http://www.siliconvalley.com/SV150/ci_25548370/ Naturally the biggest companies have the most teams.

I wrote a node script[1] you could use for this.

[1] http://pastebin.com/raw.php?i=NgTeseN1

Post reply on HN