Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Wanna know what product your competitor is working on? Try Slack

tanay.co.in

Post reply on HN
Print view View original

41–50 of 145 posts

Re: Wanna know what product your competitor is working on? Try Slack

#41

Post by [deleted] »

smt88 wrote: post #17
tomp wrote: post #11

Earlier quoted context omitted.

The way companies handle security disclosures lately (i.e. laughing it off, or paying $6 reward), it seems like shaming them would work much better. Plus, this is truly a beginner-level failure, the kind you'd get insulted for by Linus.

Why assume the worst about Slack just because some other companies have handled disclosures badly? Real people work at Slack, and very few of them were likely responsible for this oversight. OP could still pat him/herself on the back after disclosing and waiting for a fix.

[deleted]

Re: Wanna know what product your competitor is working on? Try Slack

#42

Post by ankey1 »

jcrei wrote: post #10

I haven't tried the hack, but it's something that had occurred to me for a while. We're using Slack internally and I've been wanting to get everyone in our larger organization to use it. Anyone with an email using our domain would be able to join. Which is ok with me. The only real flaw here is showing which groups are available (many of which can be client names or project names or product names that have yet to be…

Private channels could help with this. I believe they aren't visible unless you're explicitly invited.

Re: Wanna know what product your competitor is working on? Try Slack

#43

Post by richmarr »

tomp wrote: post #11
johannh wrote: post #3

This is something that could definitely have been reported to Slack before disclosing it publicly. Maybe he did that, but it's not mentioned in the blog post so I assume he didn't. It's just a nice thing to do and they might reward you for it. You can still post it on your blog after they released a fix.

The way companies handle security disclosures lately (i.e. laughing it off, or paying $6 reward), it seems like shaming them would work much better. Plus, this is truly a beginner-level failure, the kind you'd get insulted for by Linus.

Shaming Slack is one point. This guy just exposed the confidential information of who knows how many of Slack's customers. In my opinion that's douchery of epic proportions.

Re: Wanna know what product your competitor is working on? Try Slack

#45

Post by sdfjkl »

Jamie452 wrote: post #27
jdkanani wrote: post #22

I just realized that any facebook user can signup on https://facebook.slack.com/ with his fb username.

I'm too scared to try it - I have all my photos and stuff like that on my Facebook account. So tempting though!

If you trusted Facebook with that, you aren't scared enough.

Re: Wanna know what product your competitor is working on? Try Slack

#46

Post by ayrx »

tomp wrote: post #11
johannh wrote: post #3

This is something that could definitely have been reported to Slack before disclosing it publicly. Maybe he did that, but it's not mentioned in the blog post so I assume he didn't. It's just a nice thing to do and they might reward you for it. You can still post it on your blog after they released a fix.

The way companies handle security disclosures lately (i.e. laughing it off, or paying $6 reward), it seems like shaming them would work much better. Plus, this is truly a beginner-level failure, the kind you'd get insulted for by Linus.

Completely untrue about the people at Slack. I disclosed a pretty trivial vulnerability to them and got a $100 reward.

How about next time you stop generalising?

Re: Wanna know what product your competitor is working on? Try Slack

#47

Post by jdkanani »

praseodym wrote: post #44
jdkanani wrote: post #22

I just realized that any facebook user can signup on https://facebook.slack.com/ with his fb username.

Signup confirmation mail doesn't seem to arrive, maybe Facebook was quick to add a filter for mails coming from Slack.

You first have to enable your facebook email address from facebook email settings.

Re: Wanna know what product your competitor is working on? Try Slack

#48

Post by kolev »

smt88 wrote: post #19
kolev wrote: post #12

This is a capitulation - even Google uses Slack instead of Hangouts (although just a few teams); even Microsoft instead of Skype.

Neither Skype nor Hangouts are intended to compete with Slack. They're consumer products, while Slack is intended for business teams.

I'm sure way more businesses use Skype and Hangouts than Slack and HipChat.

Re: Wanna know what product your competitor is working on? Try Slack

#49

Post by sintheticlabs »

jdkanani wrote: post #24
patrickaljord wrote: post #21

Here are the ones for: - amazon - ebay - facebook - apple - google http://imgur.com/a/eWLEf

Bad thing is that every facebook user has email id `fbusername@facebook.com`. So you can easily get into any team you want.

Facebook uses the fb.com domain name for employee email addresses. The facebook.com domain doesn't seem to be linked to the fb.com domain on Slack.
Post reply on HN