61–70 of 140 posts
Earlier quoted context omitted.
That means they're not using SAML/SSO which sounds absolutely crazy to me, unless you only have like a dozen users. The implication is that your IT team doesn't take security seriously. Not because you can change names, but because they aren't implementing identity policies.
you can very much allow people to change display names while using saml/sso. My work setup allows this. We can change photo and description as well but nothing else.
Earlier quoted context omitted.
SCIM adoption isn't near where it needs to be. I guess yeah, this is the correct answer. We live in a world where SSO is considered an enterprise feature, I hope one day that it's considered default.
Shameless plug for my startup (hope that's ok!) If you're building an app and need to add SCIM, check out WorkOS. My email is in my profile to chat. More info -> https://workos.com/directory-sync
Earlier quoted context omitted.
On the other hand, an over-zealous IT guy at my job just deleted our Jira automation account (because he didn't know what it was there for and got sketched out by the name $CompanySecretary). Cue (a few days later) a large pile of pain as we tried to find and fix every workflow and ticket that formerly referred to that user before something really important broke.
Aah, he took down Chesterton's fence and found the reason of its existance! ( https://en.wiktionary.org/wiki/Chesterton%27s_fence )
> Of course, not every company will fall for this trick The company can have the last laugh: https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act
That’s why he waited two years to say he did it which just so happens to be the CFAA statute of limitations.
For criminal charges, I believe you'd use the default 5 year statute of limitations for noncapitcal federal crimes (18 U.S.C. § 3282)
Earlier quoted context omitted.
On the other hand, an over-zealous IT guy at my job just deleted our Jira automation account (because he didn't know what it was there for and got sketched out by the name $CompanySecretary). Cue (a few days later) a large pile of pain as we tried to find and fix every workflow and ticket that formerly referred to that user before something really important broke.
Aah, he took down Chesterton's fence and found the reason of its existance! ( https://en.wiktionary.org/wiki/Chesterton%27s_fence )
One place I worked was slow to deactivate slack accounts, so when I left I made a private channel #daves_cave and invited friends my friends to it. I would leave a short story or pithy saying now and then; it was fun until management got wise and deactivated me.
Earlier quoted context omitted.
At the same time the ability to change name is sich a godsend. We're currently abusing it to have presence info straight in the display name (e.g. mike-2/12~16vac.) to let anyone contacting us what to expect for response times, or wether to ask for a task if it's a few days before a planned vacation. Nobody seemed to look at the actual status property and it beats going to the calendars to check.
> mike-2/12~16vac Looks like mike-2 is a robot powered by a doorbell transformer.
The fact slack doesn't allow you to lock down name changes must be such a gaping security hole for big companies. Change your name to the CEO, and profile image to match. Odds of people noticing the difference are extremely small until it's too late. Changing to slackbot seems like small fry!
Name changes can be locked; I'm in an Enterprise Grid org and our display names/usernames are synced against our employee profile. We're also required to SSO every single time we launch the desktop app so once you're terminated you're definitely not getting back in (they deactivate accounts very quickly too, so mobile is likely not a major concern). Basically the only thing you can change without filing a ticket is y…
the screenshots of people replying to him who clearly know he's not slackbot, including calling him Tom, kind of contradict the headline here. he was clearly not "undetected". we've got some former staff in our slack still. they check in and say hi every now and then, it's nice. if one of them started pretending to be a snarky slackbot one day, we'd probably have a laugh about it too.
Best place to hide is something that looks like a service account everyone is afraid to touch for fear of what will break if disabled. Well played!
On the other hand, an over-zealous IT guy at my job just deleted our Jira automation account (because he didn't know what it was there for and got sketched out by the name $CompanySecretary). Cue (a few days later) a large pile of pain as we tried to find and fix every workflow and ticket that formerly referred to that user before something really important broke.