5 ms·

I'd imagine that they have separate, encrypted siloed search indexes for each paying organization. Why would someone put sensitive information on Slack otherwis

by jitix 9y ago

I'd imagine that they have separate, encrypted siloed search indexes for each paying organization. Why would someone put sensitive information on Slack otherwise?

adamnemecek 9y ago
Doesn't seem like it https://slack.com/security https://slack.com/security
sillysaurus3 9y ago
Few organizations care. And those that do get left in the dust by organizations that don't.
- pavel_lishin 9y ago
  > Few organizations care. And those that do get left in the dust by organizations that don't. Are you saying that organizations that care to keep secrets get left behind by those that don't? That sounds kind of ridiculous.
  - sillysaurus3 9y ago
    We live in interesting times. Organizations that refuse to use Slack are at a disadvantage. When employees show up and realize there's no Slack, they start to analyze all other company decisions. How much effort could be saved just by using Slack? Those secrets had better be important to justify this loss. There are alternatives. Rocket Chat is self-hosted, and maybe it's sufficient. But second-place software will always feel second-place. If your reasoning is solely "We are a company, so we have secrets," that's justifiable only in narrow domains, like a security company. For the rest, and especially at startups, the strategic risk of revealing your secrets to Slack is counterbalanced by the fact that Slack can't take advantage of those secrets without committing suicide. The moment everyone stops trusting Slack, that trust is gone forever. In the meantime, Slack has been a faithful steward. What are the risks? An employee could go rogue and steal the data. An acquirer like Amazon could use the data maliciously. Slack could get hacked and the data could be made available publicly. Of those, getting hacked is the only relevant concern. Employees are unlikely to end their careers by stealing data. But if Slack's data is ever stolen and made public, everyone will have egg on their face simultaneously. That means it's less likely to be a disaster for any individual organization. Talent has a way of sniffing out incongruities like this. When an organizational mandate doesn't pass the bullshit test, opinionated talent will usually try to change the situation, or leave. And opinionated talent tends to be effective talent. When effective talent leaves, better watch out. You might have suddenly become one of those organizations that find it impossible to attract top performers. To put it plainly, who would want to work someplace that puts the company's quality of life over the employee's over something so trivial? Of the startups that will eventually survive, even if all of them revealed all of their operational and strategic insights simultaneously, they're unlikely to die. Or even be slowed down, really. Most startups are working on ideas that seem bad. That's why startup investing is hard. Revealing your seemingly-bad strategies to the world won't change much. And if your idea seems good, you tend to be entrenched. It's unlikely some other company could form and steal it from under you before you can execute on it. In all but a handful of domains, we're left with repellant pseudo-justifications for avoiding the one tool that everybody uses. Hopefully those secrets were very important!
    - stephenr 9y ago
      > When employees show up and realise there's no Slack, they start to analyze all other company decisions. If I hire you, and your concern is "why can't I use this one specific chat service", I hired the wrong fucking person.
      - thomk 9y ago
        No kidding, sheesus.
    - pavel_lishin 9y ago
      > If your reasoning is solely "We are a company, so we have secrets," that's justifiable only in narrow domains, like a security company. My friend's company used Hipchat over Slack for precisely that reason - they're a security company, one you've likely heard of.
    - ForHackernews 9y ago
      I consider Slack a negative signal. I would be more likely to want to work at a company that just ran IRC.
      - rpcope1 9y ago
        I'm glad I'm not the only one that feels this way and prefers IRC. :)
      - pc86 9y ago
        I help hire people and consider strong opinions about which chat service is used a negative signal.
        ForHackernews 9y ago
        I don't have a strong opinion, but I do think using Slack shows that a company is vulnerable to chasing hype and eager to hop on bandwagons.
eduren 9y ago
From what I've seen, there are plenty of companies that keep sensitive data out-of-band for just that reason, and have policies to keep it out of their Slacks.
- deegles 9y ago
  Ironically, Slack is explicitly prohibited for internal use at Amazon.
  - benjamincharity 9y ago
    Source?
1dundundun 9y ago
Same reason we put all of our business on Google. Convenience.

by jitix 9y ago

I'd imagine that they have separate, encrypted siloed search indexes for each paying organization. Why would someone put sensitive information on Slack otherwise?

adamnemecek 9y ago

Doesn't seem like it https://slack.com/security https://slack.com/security

sillysaurus3 9y ago

Few organizations care. And those that do get left in the dust by organizations that don't.

pavel_lishin 9y ago
> Few organizations care. And those that do get left in the dust by organizations that don't. Are you saying that organizations that care to keep secrets get left behind by those that don't? That sounds kind of ridiculous.
- sillysaurus3 9y ago
  We live in interesting times. Organizations that refuse to use Slack are at a disadvantage. When employees show up and realize there's no Slack, they start to analyze all other company decisions. How much effort could be saved just by using Slack? Those secrets had better be important to justify this loss. There are alternatives. Rocket Chat is self-hosted, and maybe it's sufficient. But second-place software will always feel second-place. If your reasoning is solely "We are a company, so we have secrets," that's justifiable only in narrow domains, like a security company. For the rest, and especially at startups, the strategic risk of revealing your secrets to Slack is counterbalanced by the fact that Slack can't take advantage of those secrets without committing suicide. The moment everyone stops trusting Slack, that trust is gone forever. In the meantime, Slack has been a faithful steward. What are the risks? An employee could go rogue and steal the data. An acquirer like Amazon could use the data maliciously. Slack could get hacked and the data could be made available publicly. Of those, getting hacked is the only relevant concern. Employees are unlikely to end their careers by stealing data. But if Slack's data is ever stolen and made public, everyone will have egg on their face simultaneously. That means it's less likely to be a disaster for any individual organization. Talent has a way of sniffing out incongruities like this. When an organizational mandate doesn't pass the bullshit test, opinionated talent will usually try to change the situation, or leave. And opinionated talent tends to be effective talent. When effective talent leaves, better watch out. You might have suddenly become one of those organizations that find it impossible to attract top performers. To put it plainly, who would want to work someplace that puts the company's quality of life over the employee's over something so trivial? Of the startups that will eventually survive, even if all of them revealed all of their operational and strategic insights simultaneously, they're unlikely to die. Or even be slowed down, really. Most startups are working on ideas that seem bad. That's why startup investing is hard. Revealing your seemingly-bad strategies to the world won't change much. And if your idea seems good, you tend to be entrenched. It's unlikely some other company could form and steal it from under you before you can execute on it. In all but a handful of domains, we're left with repellant pseudo-justifications for avoiding the one tool that everybody uses. Hopefully those secrets were very important!
  - stephenr 9y ago
    > When employees show up and realise there's no Slack, they start to analyze all other company decisions. If I hire you, and your concern is "why can't I use this one specific chat service", I hired the wrong fucking person.
    - thomk 9y ago
      No kidding, sheesus.
  - pavel_lishin 9y ago
    > If your reasoning is solely "We are a company, so we have secrets," that's justifiable only in narrow domains, like a security company. My friend's company used Hipchat over Slack for precisely that reason - they're a security company, one you've likely heard of.
  - ForHackernews 9y ago
    I consider Slack a negative signal. I would be more likely to want to work at a company that just ran IRC.
    - rpcope1 9y ago
      I'm glad I'm not the only one that feels this way and prefers IRC. :)
    - pc86 9y ago
      I help hire people and consider strong opinions about which chat service is used a negative signal.
      - ForHackernews 9y ago
        I don't have a strong opinion, but I do think using Slack shows that a company is vulnerable to chasing hype and eager to hop on bandwagons.

eduren 9y ago

From what I've seen, there are plenty of companies that keep sensitive data out-of-band for just that reason, and have policies to keep it out of their Slacks.

deegles 9y ago
Ironically, Slack is explicitly prohibited for internal use at Amazon.
- benjamincharity 9y ago
  Source?

1dundundun 9y ago

Same reason we put all of our business on Google. Convenience.