Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A former Gizmodo writer changed name to 'Slackbot', stayed undetected for months

theverge.com

Post reply on HN
Print view View original

91–100 of 140 posts

Re: A former Gizmodo writer changed name to 'Slackbot', stayed undetected for months

#91

Post by Prcmaker »

solatic wrote: post #86

A lot of people advise ways of locking down name changes, but this doesn't really solve the problem. I'm sure there's someone out there whose first name is actually Jira. I worked for $company where customer dashboards were set up on a wildcard - https://*.$company.com , e.g. https://foo.$company.com . Guess what happens when someone picks a dashboard slug that conflicts with an actual record, like `www` or `blog`? T…

My partners work has an employee named 'Admin'. IT struggles with what to do thee.

Re: A former Gizmodo writer changed name to 'Slackbot', stayed undetected for months

#92

Post by lostlogin »

brunosutic wrote: post #85

Replacing ascii with similar-looking unicode characters is an old trick. There's a bunch of these characters out there. You can use it in the code to prank your colleague developers - April 1st is nearing! I even made a vim plugin that highlights these "dangerous" characters: https://github.com/vim-utils/vim-troll-stopper I've never been pranked with unicode characters, but I've had a situation at work where a consul…

The accidental crap can go a long way. I recall someone using a superscript ‘O’ as a degrees symbol in a medical report. This then got converted to a non—superscript character and rather changed the meaning. Extra unhelpful was that they wrote the word ‘degrees’ after the attempt at the symbol too.

Re: A former Gizmodo writer changed name to 'Slackbot', stayed undetected for months

#93

Post by berkes »

adamrezich wrote: post #38

this is a reporter "reporting" on another reporter's self-reporting (on twitter) of what he did from when he quit/was fired/laid off (the "article" doesn't even say) from his job as a reporter. "reporting" is in quotes here because it's the thinnest possible veneer atop the original tweet. what possible value does this article have over the original tweet, aside from adding an additional, unnecessary needed layer of…

The author gave some context for readers not familiar with slack. And interviewed another former employee (albeit with minimal effort) to add another validation point.

Re: A former Gizmodo writer changed name to 'Slackbot', stayed undetected for months

#94

Post by ryanjshaw »

dazbradbury wrote: post #14

The fact slack doesn't allow you to lock down name changes must be such a gaping security hole for big companies. Change your name to the CEO, and profile image to match. Odds of people noticing the difference are extremely small until it's too late. Changing to slackbot seems like small fry!

In MS Teams, your name is from AD and you almost certainly don't have permission to change that. Also, bots have hexagonal avatar frames while humans have circular ones. I'm not sure how many people notice, though.

Re: A former Gizmodo writer changed name to 'Slackbot', stayed undetected for months

#95

Post by stefan_ »

brunosutic wrote: post #85

Replacing ascii with similar-looking unicode characters is an old trick. There's a bunch of these characters out there. You can use it in the code to prank your colleague developers - April 1st is nearing! I even made a vim plugin that highlights these "dangerous" characters: https://github.com/vim-utils/vim-troll-stopper I've never been pranked with unicode characters, but I've had a situation at work where a consul…

Lots of apps have helpfully started turning two dashes (—-) into some sort of Unicode long dash that is more aesthetically pleasing, while also breaking command line tools.

Re: A former Gizmodo writer changed name to 'Slackbot', stayed undetected for months

#96

Post by newdee »

mooreds wrote: post #84
amenghra wrote: post #62

Earlier quoted context omitted.

$125 per connection / month and then you wonder why companies don't offer SSO/SCIM by default in their free/cheap plans.

(I work for a competitor in the same space as grinich.) Charging for scim is a convenient way to segment customers, the same way SLAs are. For companies that care deeply about controlling user access (or are forced to by law or regulator), that isn't much money. Features like this subsidize the free/cheap version, which you can then offer to let folks learn about and love your software, and use. After all, you can re…

> Charging for scim is a convenient way to segment customers

It’s also a convenient way to keep charging non-SCIM customers for unused licenses when they inevitably forget to manually nuke accounts belonging to leavers.

Re: A former Gizmodo writer changed name to 'Slackbot', stayed undetected for months

#97

Post by kzrdude »

lostlogin wrote: post #92
brunosutic wrote: post #85

Replacing ascii with similar-looking unicode characters is an old trick. There's a bunch of these characters out there. You can use it in the code to prank your colleague developers - April 1st is nearing! I even made a vim plugin that highlights these "dangerous" characters: https://github.com/vim-utils/vim-troll-stopper I've never been pranked with unicode characters, but I've had a situation at work where a consul…

The accidental crap can go a long way. I recall someone using a superscript ‘O’ as a degrees symbol in a medical report. This then got converted to a non—superscript character and rather changed the meaning. Extra unhelpful was that they wrote the word ‘degrees’ after the attempt at the symbol too.

There's also the Spanish superscript a and o symbols (used for ordinals) that can be confused for this.

Re: A former Gizmodo writer changed name to 'Slackbot', stayed undetected for months

#98

Post by solatic »

hennell wrote: post #90
solatic wrote: post #86

A lot of people advise ways of locking down name changes, but this doesn't really solve the problem. I'm sure there's someone out there whose first name is actually Jira. I worked for $company where customer dashboards were set up on a wildcard - https://*.$company.com , e.g. https://foo.$company.com . Guess what happens when someone picks a dashboard slug that conflicts with an actual record, like `www` or `blog`? T…

Limit usable characters, and just literally check the page doesn't resolve already before allowing the change. Customers will never be locked out and characters can't impersonate others. If you want to allow some symbols you can either whitelist or check if usernames are an appropriate levenshtein distance away from core names (like say slackbot) and either ban such things or flag to a human "hey this could be an iss…

> just literally check the page doesn't resolve already before allowing the change

It's a wildcard DNS record, it always resolves, even if it's not saved in the system.

There's a general rule of thumb: when someone on HN tells you to "just" do something, they generally underestimate the amount of effort involved in doing it properly.

Re: A former Gizmodo writer changed name to 'Slackbot', stayed undetected for months

#99

Post by johnnyanmac »

Prcmaker wrote: post #91
solatic wrote: post #86

A lot of people advise ways of locking down name changes, but this doesn't really solve the problem. I'm sure there's someone out there whose first name is actually Jira. I worked for $company where customer dashboards were set up on a wildcard - https://*.$company.com , e.g. https://foo.$company.com . Guess what happens when someone picks a dashboard slug that conflicts with an actual record, like `www` or `blog`? T…

My partners work has an employee named 'Admin'. IT struggles with what to do thee.

huh, real life Bobby Drop Tables, huh? Wonder what name would cause the most damage to flimsy tech while still sounding like a relatively normal name?

Re: A former Gizmodo writer changed name to 'Slackbot', stayed undetected for months

#100

Post by input_sh »

Prcmaker wrote: post #91
solatic wrote: post #86

A lot of people advise ways of locking down name changes, but this doesn't really solve the problem. I'm sure there's someone out there whose first name is actually Jira. I worked for $company where customer dashboards were set up on a wildcard - https://*.$company.com , e.g. https://foo.$company.com . Guess what happens when someone picks a dashboard slug that conflicts with an actual record, like `www` or `blog`? T…

My partners work has an employee named 'Admin'. IT struggles with what to do thee.

I have met a few Admins in my life and, needless to say, there's all sorts of things they have to work around to do normal things online. For example, set the first name to "Admi" and "N" as the middle name to be able to receive a package. And good luck looking them up on places like LinkedIn or Facebook that require but do not accept their actual name.

It's not exactly a common Muslim first name, but it's not unheard of.

Post reply on HN