Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Wanna know what product your competitor is working on? Try Slack

tanay.co.in

Post reply on HN
Print view View original

131–140 of 145 posts

Re: Wanna know what product your competitor is working on? Try Slack

#131

Post by sneak »

thecus wrote: post #125
tangoalpha wrote: post #120

Sorry that the site was down for long. The site was on poorman's hosting (hostgator) that could not take HN traffic and bogged down. Cloudflare, along with flatfile caching by Drupal's Boost module came to the rescue. Hope that stays alive for a while now. Regarding not having disclosed this one discretely to Slack: * I have considerable experience in a couple opensource projects including Drupal and have reported mu…

I also want to add on that I do not view this as a security issue. There are a myriad of things that should be done: 1) Your company should not be using SaaS services for sensitive projects w/o codenames. (Codename FishSauce = Viber M&A) -- obviously just obscurity, but still solid opsec. 2) I'd love to see your write-up on HipChat uploading all files directly to an S3 bucket accessible to the world. 3) Every user w/…

> I also want to add on that I do not view this as a security issue

This is absolutely a security issue. What companies I do business with is protected under NDA.

Re: Wanna know what product your competitor is working on? Try Slack

#132

Post by d23 »

djur wrote: post #124
peterevans wrote: post #118

Earlier quoted context omitted.

How is this the fault of companies using Slack? That's nothing more than victim-blaming.

Victim-blaming? This isn't an assault or a crime, it's a shortcoming of the service. It falls well under the umbrella of "caveat emptor".

Is caveat emptor something they sold the company when trying to land that enterprise contract? Or did they sell them security of their information?

Re: Wanna know what product your competitor is working on? Try Slack

#134

Post by kolev »

waseem_ wrote: post #59
kolev wrote: post #48

Earlier quoted context omitted.

I'm sure way more businesses use Skype and Hangouts than Slack and HipChat.

Skype is actually pretty good for teams. I used to work at a company where it was our primary medium of communication, and we were almost forty people. It's extremely easy to create a group chat in Skype and destroy it with IRC OPs like features. It is also tempting to use since Skype provides a way to initiate a voice call right there from the chat. And one can always access the chat history as well. People have als…

Skype is a resource hog - especially on mobile. Plus, no API, no thank you! (Disclaimer: I'm actively using Skype as work, just because everybody's so used to it.)

Re: Wanna know what product your competitor is working on? Try Slack

#135

Post by sintheticlabs »

lukashed wrote: post #61

Even if they fixed this flaw, you could still reverse this technique by using a dictionary attack against {{ name }}.slack.com (e.g. eng.slack.com), and parse out the given domain name.

I reported that issue to Slack 6 months ago. Their response was "This is an intentional part of the product design.".

Re: Wanna know what product your competitor is working on? Try Slack

#136

Post by rtpg »

demachina wrote: post #129
dasil003 wrote: post #116

Earlier quoted context omitted.

Leaking to where? By using the internet you're leaking [meta]data. It's a question of degrees and trust.

They are leaking potentially confidential information to a third party company running the service, in this case Slack. For all you know they could be doing stock trades based on all the insider info they can glean from their chat traffic as their business model. If the communication includes material insider information, like companies/products they are considering buying, and they are flinging it all over the inter…

>For all you know they could be doing stock trades based on all the insider info they can glean from their chat traffic as their business model.

From the Slack TOS:

>Your acceptance of this TOS gives us the permission to do so and grants us any such rights necessary to provide the service to you, only for the purpose of providing the service (and for no other purpose).

They _could_ be breaking the TOS (and thus the contract between you and the them), but I doubt it.

Re: Wanna know what product your competitor is working on? Try Slack

#137

Post by rtpg »

kolev wrote: post #12

This is a capitulation - even Google uses Slack instead of Hangouts (although just a few teams); even Microsoft instead of Skype.

Hangouts and Skype are good for instant connections to somebody for a quick video chat. Slack is for long-length conversations which require a good historical record. They're aiming for different use cases.

Re: Wanna know what product your competitor is working on? Try Slack

#138

Post by anonfunction »

scriptheaven wrote: post #88
anonfunction wrote: post #40

Earlier quoted context omitted.

I wrote a node script[1] you could use for this. [1] http://pastebin.com/raw.php?i=NgTeseN1

Here's a streaming version that runs through the top 1m Alexa sites. It looks like it gets throttled after a while though, but you can fix it with some trial and error by dialing down the concurrency in concurrent-map-stream and by introducing pauses. https://gist.github.com/anonymous/4e34a10f1552dd8ede96

Cool idea to use the alexa top 1m.

Got this error though:

phantom stdout: TypeError: 'null' is not an object (evaluating 'element.value = text')

	  phantomjs://webpage.evaluate():3
	  phantomjs://webpage.evaluate():4
	  phantomjs://webpage.evaluate():4
	TypeError: 'null' is not an object (evaluating 'element.value = text')

Re: Wanna know what product your competitor is working on? Try Slack

#139

Post by couchand »

peterwwillis wrote: post #100
noahc wrote: post #92

Earlier quoted context omitted.

Except it will forever be called that. A quick example is where I work we have a 'new product x billing' system and it is still called the 'new' one five years later when it is also the only one. There is some debate internally over whether 'new' refers to 'new as in old' or 'new' as in the opposite of 'renewal'. No one knows why it is called what it is called.

That's why you give it a nonsense name. Windows XP was codenamed 'Whistler'. Nobody calls it Whistler (except when reminiscing about the warez scene). https://en.wikipedia.org/wiki/List_of_Microsoft_codenames https://en.wikipedia.org/wiki/Code_name

I came very close to including a "Longhorn" example in my original comment.
Post reply on HN