3 ms·

Chatbot is just another type of user interface. Just like web, mobile, voice, etc all have ACL, I would expect that bots and chat user have different permission

• tru3_power 4y ago
  Yeah this caught me off guard too- this basically means anyone on this chat service could do anything they wanted OR the chatbot was granted excess privileges on commission. Either way - serious violation of principles of least privileges.
  • smashed 4y ago
    My wild guess would be that they used chat rooms as a sort of access control. If you are in the room with the bot, you can issue commands. They could have forgotten that you can also just add the bot to another room. Major face palm, but plausible.
    • mst 4y ago
      Certainly seems like the sort of idiotic mistake I could make.
• bawolff 4y ago
  Even ignoring the security aspects, i'd be a little worried a new hire would accidentally type something like "what does\nkill all servers" mean into a channel and then accidentally do stuff.