We use Slack and I always thought this was an odd behavior. We're a part of a major university so our domain is quite large and we can see dozens of other departments and projects using Slack just by putting in our email.
Wanna know what product your competitor is working on? Try Slack
101–110 of 145 posts
Re: Wanna know what product your competitor is working on? Try Slack
#102Earlier quoted context omitted.
The way companies handle security disclosures lately (i.e. laughing it off, or paying $6 reward), it seems like shaming them would work much better. Plus, this is truly a beginner-level failure, the kind you'd get insulted for by Linus.
Completely untrue about the people at Slack. I disclosed a pretty trivial vulnerability to them and got a $100 reward. How about next time you stop generalising?
Well considering other people posted a tweet about someone trying to report it as a vuln on August 13th and getting told it's a feature, I'd say he's not exactly generalizing in this specific instance.
Re: Wanna know what product your competitor is working on? Try Slack
#103Earlier quoted context omitted.
Except it will forever be called that. A quick example is where I work we have a 'new product x billing' system and it is still called the 'new' one five years later when it is also the only one. There is some debate internally over whether 'new' refers to 'new as in old' or 'new' as in the opposite of 'renewal'. No one knows why it is called what it is called.
The solution is to use a name that will never get pass legal, like a trademark of another company. That's what Sun did with Swing, which was originally called Kentucky Fried Chicken[0] internally. [0] https://blogs.oracle.com/thejavatutorials/entry/why_is_swing...
In this case, it is an internal project so it never would have touched legal.
Re: Wanna know what product your competitor is working on? Try Slack
#104Earlier quoted context omitted.
Maybe this kind of exposure is the only way we will teach people to stop trusting fly-by-night cloud startups with their confidential data?
So hurting people in order to teach them a lesson about not getting hurt?
The lesson can be had independently of the intent of douchery. Shit happens, and learning from your mistakes (by admitting them) is a fine way to get better at what you do.
Re: Wanna know what product your competitor is working on? Try Slack
#105My response to all the people who says it is nothing just the team names
Check this screenshot of google teams http://m.imgur.com/a/eWLEf. There is a team name called viber and google doesn't own viber.
Check this news that came 2 days back:http://www.jbgnews.com/2014/10/google-looking-to-rival-whats...
Connect the dots. You can infer a lot. It is information disclosure at the finest.
Smart thing is to accept it is a problem and address it. Defending to say it is nothing doesn't make the problem go away. The fault is on both slack and the companies who are using it.
Re: Wanna know what product your competitor is working on? Try Slack
#106Its difficult to balance ease of use with vulnerabilities like this one. Our product Sococo requires a moderator to enter email addresses of invitees to a group. This is more secure, but slows down our adoption rate. We've resorted to a more direct marketing approach to overcome this, but in the end our clients are more secure.
Re: Wanna know what product your competitor is working on? Try Slack
#107Seriously, just the idea of keeping ALL your company internal conversations on a 3rd party server is quite crazy, but to get access without even hacking anything.. I wonder if situations like this will result in business customers more carefully evaluating SaaS solutions that deal with sensitive data, because "in-house" solutions may be old school, but at least a) no one will suddenly terminate the service and b) all…
https://sandstorm.io/ seems to aim for the best of both worlds - web apps trivially easy to deploy locally.
Re: Wanna know what product your competitor is working on? Try Slack
#108Earlier quoted context omitted.
It beats me to see so many Microsoft and google teams. Don't they have their own tools to do this securely. Leaking of business conversations can have serious implications on many areas from financial to legal. If an employee leaves the company how that will be handled.
What conversations are being leaked? It's a list of team names.
By using slack or any other external chat system, you're leaking metadata and comms content.
Re: Wanna know what product your competitor is working on? Try Slack
#109The issue seems to be solved
Re: Wanna know what product your competitor is working on? Try Slack
#110While I'm unable to comment on the content of the article, I really have to applaud HostGator's error page marketing strategy here. We've met with a horrible fate (status code 500) while generating what appears to be a static page. This site is hosted by HostGator! Get yours now!
If they're generating 500 errors while serving up static sites, someone is doing something very wrong.
There will be other layers (routing, caching, WAF, etc) that could generate 500 errors in between you and the software serving the static site.