8 ms·

This issue arises because, if the site allows any public sharing, the "create filter" UI gives team members the option to share a new filter with "Everyone", wh

by mik3y 7y ago

This issue arises because, if the site allows any public sharing, the "create filter" UI gives team members the option to share a new filter with "Everyone", which sounds like an org-local scope but is in fact a public/non-logged-in scope. The org-level scope is called, "Open", and is not part of this UI. Sigh. To prevent this issue as a site admin on Jira cloud, go to: Jira Settings -> System -> General Configuration and disable "Allow users to share dashboards and filters with the public." This doesn't affect existing filters, which you have to manually fix. In true Jira fashion, if you try to reassign a filter after flipping this setting, it will deny the operation and ask you to edit the ACL, which there is no convenient admin UI to do. Jira is a disaster of UX.

koolba 7y ago
Restricting the IP of your internal servers goes a long way for defense in depth. It’s not a panacea, but it prevents immediate owned to the world.
- ghshephard 7y ago
  I’m not sure which IP you are restricting - it’s a cloud based service, so, by definition, your clients are pretty much anywhere on the Internet. What would you restrict?
  - javagram 7y ago
    JIRA can also be run on your own servers and then you can do whatever IP whitelist you want in front of it, or just not put it on the public internet at all and require VPN...
  - bearer_token 7y ago
    Honestly I don't see how we could use the cloud version unless we could at least lock it down the same way we do behind a firewall; VPN or office only. Guess it's on the roadmap, like everything else. https://confluence.atlassian.com/confeval/other-atlassian-evaluator-resources/can-i-restrict-by-ip-in-atlassian-cloud https://confluence.atlassian.com/confeval/other-atlassian-ev...
    - Spivak 7y ago
      Defense in depth is always a nice thing to have but it hardly seems like a requirement since the reason you lock down services behind a firewall is supposed to be because they're aren't hardened enough to be on the public internet. I don't think that would describe the Atlassian suite who probably has better SecOps than most of their customers.
      - Aeolun 7y ago
        Except when they deliberately make their product obtuse and allow customers to expose their data to the entire world.
      - tastroder 7y ago
        The post you replied to mentions other methods to separate a service, not being hardened enough is only one of the reasons you would want to do that. A major one being that many Jira deployments are only useful internally anyway so there is no reason to expose it to the outside world.
    - ghshephard 7y ago
      It's weird - the last company I worked at (and ran IT for about 4 years had everything behind a firewall (like you are describing) - the current gig that I started at about 18 months ago (with about 80 employee) - no concept of a firewall. The entire office just sits behind a Comcast Modem. There is nothing to firewall. Atlassian/Salesforce/GitHub/CircleCI/Gmail/GoogleDocs/Drive/Slack/Lots of K8S and about 15-20 other cloud services make up our "IT" environment. There is zero difference to working from home to working from the office from a tech perspective.
  - anthonys 7y ago
    If you can use it, Cloudflare Access is great for these types of situations. Maybe not perfect with hosted cloud servers (as opposed to your own origins), but a good start!
wpietri 7y ago
I admit I have mostly avoided using it, so a question: > Jira is a disaster of UX. Jira is trying to be all things to all people. It seems to me to be based on a sort of shared illusion, namely that when people talk about work getting done they are talking about the same thing, when in fact they're often talking about wildly different processes, different philosophies. I think that sort of illusion guarantees a UX mess, because it's trying to cover up/accommodate too many different things. Is Jira a UX disaster because of just that? Or is it bad on top of that? And I worry that makes no sense, so by analogy let's imagine that somebody sold a "transport solution". This sounds great, because transportation is a universal need. But in reality transport solutions include shoes, scooters, bikes, motorcycles, cars, buses, trains, and airplanes. So this "transport solution" comes with a great mess of wheels, gears, shafts, etc, etc, plus reams of Ikea-style instructions for putting pieces together. It's universal, but also guaranteed to be a pain in the ass for any actual specific use.
- mik3y 7y ago
  Don’t mean to create a pile-on, but since you asked, yeah I should explain my barb: Is Jira a UX disaster because of just that? Or is it bad on top of that? My opinion - it’s both. The product has a ton of permutations, as you said, which makes stuff like this happen: Customers who never in the world imagined public issue tracking, suddenly bit by a feature they didn’t even know existed. Conversely I’m sure there are shops, who love this feature, for whom the distinction between “Everyone” and “Open” was always obvious. I don’t envy the team building / supporting the product across all that; I don’t know how I’d do it. But there are also endemic, continuously-poor design choices large and small. Unannounced and hard to disable major changes to the UI are the standard, and large. I’ll give you one example of the small: Recently, unannounced, the issue comment UI started auto-correcting the capitalization of Atlassian product names in the comment box. Type “JIRA”, get “Jira”. In my words in my issue tracker. (Yes, it was the js app, not the browser). It just always seems so user hostile. Net net, to me it’s an aging hydra of a product with ongoing missteps. I’d take good design and limited features over what you get here, at least with out heavy investment and expertise.
  - the_duke 7y ago
s_Hogg 7y ago
What's the current preferred alternative to Jira?
- awestroke 7y ago
  ClubHouse is great for programming project management
- dyeje 7y ago
  I don't think there is a dominant alternative but there are almost an infinite number of them. PivotalTracker, Rally, Trello, Aha, Asana, Basecamp, GitHub Issues, etc
hangonhn 7y ago
> Jira is a disaster of UX. Yes. It's crazy how many times I've made mistake in Jira or was surprised by it. It feels like there is no consistent in Jira and each feature has its own set of rules and logic and all these features were tacked on to create Jira.

by mik3y 7y ago

koolba 7y ago

Restricting the IP of your internal servers goes a long way for defense in depth. It’s not a panacea, but it prevents immediate owned to the world.

ghshephard 7y ago
I’m not sure which IP you are restricting - it’s a cloud based service, so, by definition, your clients are pretty much anywhere on the Internet. What would you restrict?
- javagram 7y ago
  JIRA can also be run on your own servers and then you can do whatever IP whitelist you want in front of it, or just not put it on the public internet at all and require VPN...
- bearer_token 7y ago
  Honestly I don't see how we could use the cloud version unless we could at least lock it down the same way we do behind a firewall; VPN or office only. Guess it's on the roadmap, like everything else. https://confluence.atlassian.com/confeval/other-atlassian-evaluator-resources/can-i-restrict-by-ip-in-atlassian-cloud https://confluence.atlassian.com/confeval/other-atlassian-ev...
  - Spivak 7y ago
    Defense in depth is always a nice thing to have but it hardly seems like a requirement since the reason you lock down services behind a firewall is supposed to be because they're aren't hardened enough to be on the public internet. I don't think that would describe the Atlassian suite who probably has better SecOps than most of their customers.
    - Aeolun 7y ago
      Except when they deliberately make their product obtuse and allow customers to expose their data to the entire world.
    - tastroder 7y ago
      The post you replied to mentions other methods to separate a service, not being hardened enough is only one of the reasons you would want to do that. A major one being that many Jira deployments are only useful internally anyway so there is no reason to expose it to the outside world.
  - ghshephard 7y ago
    It's weird - the last company I worked at (and ran IT for about 4 years had everything behind a firewall (like you are describing) - the current gig that I started at about 18 months ago (with about 80 employee) - no concept of a firewall. The entire office just sits behind a Comcast Modem. There is nothing to firewall. Atlassian/Salesforce/GitHub/CircleCI/Gmail/GoogleDocs/Drive/Slack/Lots of K8S and about 15-20 other cloud services make up our "IT" environment. There is zero difference to working from home to working from the office from a tech perspective.
- anthonys 7y ago
  If you can use it, Cloudflare Access is great for these types of situations. Maybe not perfect with hosted cloud servers (as opposed to your own origins), but a good start!

wpietri 7y ago

I admit I have mostly avoided using it, so a question: > Jira is a disaster of UX. Jira is trying to be all things to all people. It seems to me to be based on a sort of shared illusion, namely that when people talk about work getting done they are talking about the same thing, when in fact they're often talking about wildly different processes, different philosophies. I think that sort of illusion guarantees a UX mess, because it's trying to cover up/accommodate too many different things. Is Jira a UX disaster because of just that? Or is it bad on top of that? And I worry that makes no sense, so by analogy let's imagine that somebody sold a "transport solution". This sounds great, because transportation is a universal need. But in reality transport solutions include shoes, scooters, bikes, motorcycles, cars, buses, trains, and airplanes. So this "transport solution" comes with a great mess of wheels, gears, shafts, etc, etc, plus reams of Ikea-style instructions for putting pieces together. It's universal, but also guaranteed to be a pain in the ass for any actual specific use.

mik3y 7y ago
Don’t mean to create a pile-on, but since you asked, yeah I should explain my barb: Is Jira a UX disaster because of just that? Or is it bad on top of that? My opinion - it’s both. The product has a ton of permutations, as you said, which makes stuff like this happen: Customers who never in the world imagined public issue tracking, suddenly bit by a feature they didn’t even know existed. Conversely I’m sure there are shops, who love this feature, for whom the distinction between “Everyone” and “Open” was always obvious. I don’t envy the team building / supporting the product across all that; I don’t know how I’d do it. But there are also endemic, continuously-poor design choices large and small. Unannounced and hard to disable major changes to the UI are the standard, and large. I’ll give you one example of the small: Recently, unannounced, the issue comment UI started auto-correcting the capitalization of Atlassian product names in the comment box. Type “JIRA”, get “Jira”. In my words in my issue tracker. (Yes, it was the js app, not the browser). It just always seems so user hostile. Net net, to me it’s an aging hydra of a product with ongoing missteps. I’d take good design and limited features over what you get here, at least with out heavy investment and expertise.
- the_duke 7y ago

s_Hogg 7y ago

What's the current preferred alternative to Jira?

awestroke 7y ago
ClubHouse is great for programming project management
dyeje 7y ago
I don't think there is a dominant alternative but there are almost an infinite number of them. PivotalTracker, Rally, Trello, Aha, Asana, Basecamp, GitHub Issues, etc

hangonhn 7y ago

> Jira is a disaster of UX. Yes. It's crazy how many times I've made mistake in Jira or was surprised by it. It feels like there is no consistent in Jira and each feature has its own set of rules and logic and all these features were tacked on to create Jira.