3 ms·

We were looking at using these kids of tools, but having your internal corporate communication hosted on an external site which you have little control over was

by lokedhs 11y ago

We were looking at using these kids of tools, but having your internal corporate communication hosted on an external site which you have little control over wasn't really something we wanted to do. We ended up developing our own system which ended up a bit similar to Slack. Of interest to the crowd here, the server side is implemented in Common Lisp. We'll release it as open source as soon as we've cleaned it up a bit. I have an externally available demo system, but I don't want to reveal the URL to it publicly right now since it runs on the smallest possible Google Cloud instance. If anyone is interested in testing it, send a private message to me, or wait until we release it.

tedsuo 11y ago
Just pointing out that none of the security issues written about in the article appeared to be related to it being an external service. Their problems seemed to be: a) no one actively admining the service, in particular removing accounts when people left. b) users themselves were communicating things they were not supposed to, like instructions for circumventing other security procedures. You can just as easily have these problems with an internal service. Telling is that the illegal advice VA staff were giving each other had to do with circumventing other security procedures that were interfering with their ability to work effectively (like needing to be available via email but not having access to email on an available device). These are issues all big organizations face, regardless of whether they are purchasing IT services or implementing themselves.
- solipsism 11y ago
  You can just as easily have these problems with an internal service. Not for the typical definition of "internal". Typically to reach an internal service you have to be on the internal network. Removal of an ex-user's intranet credentials is usually something IT handles well.
pbreit 11y ago
I don't think the trade off makes sense for most organizations. I'm guessing your system is substantially inferior to offerings like a Slack or Yammer.
- lokedhs 11y ago
  Oh most definitely on both counts. I'm not the one that is generally worried about sharing too much information with third party companies that I trust. And of course they have more features. They have hundreds of developers and we have 2, working on spare time. What we implemented has worked well for us for a long time now, but the features that are important to us is there (free-text search, email notifications for example) , and being in control of code so that we can add features as we please is quite liberating to me. But like you said, most teams are not interested in that.

by lokedhs 11y ago

tedsuo 11y ago

Just pointing out that none of the security issues written about in the article appeared to be related to it being an external service. Their problems seemed to be: a) no one actively admining the service, in particular removing accounts when people left. b) users themselves were communicating things they were not supposed to, like instructions for circumventing other security procedures. You can just as easily have these problems with an internal service. Telling is that the illegal advice VA staff were giving each other had to do with circumventing other security procedures that were interfering with their ability to work effectively (like needing to be available via email but not having access to email on an available device). These are issues all big organizations face, regardless of whether they are purchasing IT services or implementing themselves.

solipsism 11y ago
You can just as easily have these problems with an internal service. Not for the typical definition of "internal". Typically to reach an internal service you have to be on the internal network. Removal of an ex-user's intranet credentials is usually something IT handles well.

pbreit 11y ago

I don't think the trade off makes sense for most organizations. I'm guessing your system is substantially inferior to offerings like a Slack or Yammer.

lokedhs 11y ago
Oh most definitely on both counts. I'm not the one that is generally worried about sharing too much information with third party companies that I trust. And of course they have more features. They have hundreds of developers and we have 2, working on spare time. What we implemented has worked well for us for a long time now, but the features that are important to us is there (free-text search, email notifications for example) , and being in control of code so that we can add features as we please is quite liberating to me. But like you said, most teams are not interested in that.