5 ms·
Keeping comments is a bad practice: If your slack ever gets compromised you’ll wish you deleted everything. We purge every 6 mo. Keep updates in tickets.
by dkdk8283 6y ago
Keeping comments is a bad practice: If your slack ever gets compromised you’ll wish you deleted everything. We purge every 6 mo. Keep updates in tickets.
- bawolff 6y agoAnd if your ticket system gets compromised? I get it from the perspective of slack is a disorganized mess in terms of long term history, but moving sensitive data from one system to another with similar security doesnt seem like a win (or loss) for security to me.
- dkdk8283 6y agoWhen I update a ticket I write it expecting someone else to read it. It’s well written and thought out. When I chat I say whatever is reasonable, it’s low effort. Note I didn’t call out sensitive information specifically. Just that you wished you deleted messages. You shouldn’t store secrets in a ticket system either.
- kurbin 6y agoStill don't quite follow your comment. Is "keeping updates in tickets" separate from the comment on deleting messages?
- dkdk8283 6y agoI worked at a place that used Slack pings in lieu of tickets. The history was kept for ~7 years. This is a huge liability IMO. A off comment by the CEO could be misunderstood by an attacker or the public if it was to be leaked. I’m saying it’s ok for quick cursory discussions but those who retain Slack messages for tribal knowledge tend to have larger organizational issues. This knowledge should be in tickets where it’s expected to write well written responses with the intention of documenting knowledge.
- ciarannolan 6y agoWe purge daily. We use it as an ephemeral messaging service, not as a wiki.