4 ms·

So it seems that Slack is going through their log files and closing down accounts that have used IP addresses that are considered to be in embargoed countries.

So it seems that Slack is going through their log files and closing down accounts that have used IP addresses that are considered to be in embargoed countries. I base that assumption on various comments here and on Twitter. If true, it is definitely the worst way to do. It doesn't take into account any circumstantial evidence that could explain the use of such an IP address (vacation, VPN, BGP or a mistake in the geolocation data used) and Slack doesn't seem to offer any way to appeal or even inform other users about what happened to their contacts. Slack should offer a configurable notification that could contain other contact methods to the banned user. Slack could also give those users at least sth like 48 hours to inform their contacts about what is going to happen. And it could offer banned users a downloadable archive of all content created to make sure no data is lost. But the way Slack is doing it right now means that you can't trust them and one should really think about relying on their services in the future. I am still on IRC and XMPP (Jabber) for good reasons ;)

mirimir 8y ago
Yeah, and from jordank's comment about his wife, they're using logs from years ago. That is impressively stupid.
basilgohar 8y ago
This is very disturbing for ways that some folks might not realize. One of the servers I've leased was assigned an IP address range whose reverse DNS (i.e., PTR records) ended in .ir. I only discovered this because I was trying to use Google's CLI tools and got blocked, with the shocking message that access from embargoed countries was not allowed. I was utterly confused given that my server, myself, and anything to do with my hosting was all contained completely within the US. After studying the message and finally figuring out after some time the problem, I reported it to my host and they promptly submitted a correction to that, and the issue was resolved. But had I somehow used this host to access Slack, I would find my own account deleted, if what is being deduced here is correct. Deleting or disabling accounts is completely the wrong approach. The absolutely maximum that could be done is BLOCKING ACCESS (i.e., actually embargoing) from these restricted IPs. Disabling or deleting accounts is stupid and shows that Slack has a profound MISUNDERSTANDING of how the Internet works, i.e., it's not perfect. This is exactly akin to using an IP address for identification. IP addresses, and hostnames, are not identification of people and cannot nor should be used for these kinds of heavy-handed, punitive punishments.
- mirimir 8y ago
  Wow. But yes. I recall news from a year or two ago, about hosting providers not cleaning up old PTR records. Also, I gather that there's quite the market now for IPv4 blocks, so geolocation is an iffy thing.
chisleu 8y ago
Vacation isn't a valid legal reason to export crypto.
- tremon 8y ago
  It also isn't a valid reason to ban an otherwise non-sanctioned citizen for life.
Spoom 8y ago
> Slack should offer a configurable notification that could contain other contact methods to the banned user. Slack could also give those users at least sth like 48 hours to inform their contacts about what is going to happen. And it could offer banned users a downloadable archive of all content created to make sure no data is lost. The government could argue that any of these options is "doing business with" an identified, sanctioned individual. I'm not saying it's right, I could just see a company attorney wanting to minimize potential federal liability.
- chki 8y ago
  But sanctions do not just happen from one day to the other (usually). At least in the case of Iran my understanding was that there was a political declaration to withdraw from the Nuclear Deal and impose sanctions, but not immediately. So business did have the opportunity to prepare a transition.
darkarmani 8y ago
So the next time someone attacks BGP they should divert slack traffic through Iran to get all users automatically banned? Or just think if slack accounts are compromised and a hacker logs-in through a proxy in Iran.

mirimir 8y ago

Yeah, and from jordank's comment about his wife, they're using logs from years ago. That is impressively stupid.

basilgohar 8y ago

This is very disturbing for ways that some folks might not realize. One of the servers I've leased was assigned an IP address range whose reverse DNS (i.e., PTR records) ended in .ir. I only discovered this because I was trying to use Google's CLI tools and got blocked, with the shocking message that access from embargoed countries was not allowed. I was utterly confused given that my server, myself, and anything to do with my hosting was all contained completely within the US. After studying the message and finally figuring out after some time the problem, I reported it to my host and they promptly submitted a correction to that, and the issue was resolved. But had I somehow used this host to access Slack, I would find my own account deleted, if what is being deduced here is correct. Deleting or disabling accounts is completely the wrong approach. The absolutely maximum that could be done is BLOCKING ACCESS (i.e., actually embargoing) from these restricted IPs. Disabling or deleting accounts is stupid and shows that Slack has a profound MISUNDERSTANDING of how the Internet works, i.e., it's not perfect. This is exactly akin to using an IP address for identification. IP addresses, and hostnames, are not identification of people and cannot nor should be used for these kinds of heavy-handed, punitive punishments.

mirimir 8y ago
Wow. But yes. I recall news from a year or two ago, about hosting providers not cleaning up old PTR records. Also, I gather that there's quite the market now for IPv4 blocks, so geolocation is an iffy thing.

chisleu 8y ago

Vacation isn't a valid legal reason to export crypto.

tremon 8y ago
It also isn't a valid reason to ban an otherwise non-sanctioned citizen for life.

Spoom 8y ago

> Slack should offer a configurable notification that could contain other contact methods to the banned user. Slack could also give those users at least sth like 48 hours to inform their contacts about what is going to happen. And it could offer banned users a downloadable archive of all content created to make sure no data is lost. The government could argue that any of these options is "doing business with" an identified, sanctioned individual. I'm not saying it's right, I could just see a company attorney wanting to minimize potential federal liability.

chki 8y ago
But sanctions do not just happen from one day to the other (usually). At least in the case of Iran my understanding was that there was a political declaration to withdraw from the Nuclear Deal and impose sanctions, but not immediately. So business did have the opportunity to prepare a transition.

darkarmani 8y ago

So the next time someone attacks BGP they should divert slack traffic through Iran to get all users automatically banned? Or just think if slack accounts are compromised and a hacker logs-in through a proxy in Iran.