6 ms·

What's the most interesting in this whole write-up is this: > Security update hidden from search engines Slack is selectively and deliberately limiting public

What's the most interesting in this whole write-up is this: > Security update hidden from search engines Slack is selectively and deliberately limiting public access (discoverability) to the security breach announcements.

have_faith 4y ago
> marked with 'noindex' How do they even provide a plausible excuse for this? very bad look.
- r4vik 4y ago
  it's totally plausible. and best practice. If you have a localised blog for multiple regions you will probably have your main blog set up to be indexed and your regional blogs set up to be no-indexed so that Google isn't indexing the same stuff twice.
  - sleepychu 4y ago
    > For starters, this "news" item doesn't appear on the company's international news blog aside other articles, at the time of writing. From the linked article.
    - kindofpenguin 4y ago
      They likely published it as soon as they could and translations will be a couple of days behind. Other blog posts will be pre-planned and pre-translated. The noindex on non-us versions is probably also related to it not being fully translated. Check in a few days to see if I'm right
      - nanis 4y ago
        > BleepingComputer further observed that the "meta" tag containing the "noindex" attribute was itself placed towards the bottom within the page's HTML code, in an elongated line that overflows without breaking. Placing meta tags at the bottom, out of sight ... an _interesting_ choice given the nature of the news.
        deleted 4y ago
        [deleted]
        londons_explore 4y ago
        That might just be a limitation of the CMS
        wut42 4y ago
        Agree. While I'm pretty sure this is to bury the articles in search, that part is probably just technical reasons (or, even more credible, technical laziness).
      - bithaze 4y ago
        > Check in a few days to see if I'm right Or, you know, to see if they change it in response to the article or the discussion here.
      - wut42 4y ago
        In a "few days", well we have the August 2022 precedent! > In August 2022, Slack reset user passwords after accidentally exposing the password hashes in a separate incident. Unsurprisingly, that particular notice is also marked with a 'noindex' (both the U.S. and international versions). Here all versions have the noindex. And it's 4 months after.
  - voytec 4y ago
    > it's totally plausible. and best practice. Best for what (except PR)? It's hostile towards users which in this case involves a lot of corporate ones.
  - deleted 4y ago
    [deleted]
  - weird-eye-issue 4y ago
    No that's not best practice. You think only English should be indexed in Google?
    - savolai 4y ago
      The point as I understood it was that if en-US is indexed, it makes no sense to index en-GB too.
      - Karunamon 4y ago
        Not only does it make no sense, it hurts you from an SEO standpoint since the content is probably identical.
        wut42 4y ago
        that's why you use rel=canonical and rel=alternate. Read the google recommandations. Nowhere it is said to add noindex. Just the rels.
  - h1fra 4y ago
    Not best practice at all. Multi-language blog posts should be handled via canonical or rel=”alternate” (own google recommendation)
- deleted 4y ago
  [deleted]
bradhe 4y ago
Slack aka salesforce
- chasd00 4y ago
  Right. Salesforce does a good job of keeping major security incidents out of the news. I suspect that practice also applies to all their acquisitions.
muglug 4y ago
I work for Slack, opinions my own. As far as I can tell, Slack's not trying to hide this news. Slack communicated about the breach here: https://slack.com/blog/news/slack-security-update https://slack.com/blog/news/slack-security-update There is no `noindex` tag on that page (check the source). There is a `noindex` tag on an alternate "en-gb" version of that page: https://slack.com/intl/en-gb/blog/news/slack-security-update https://slack.com/intl/en-gb/blog/news/slack-security-update This is to be expected — it's presumably SEO equivalent to specifying a canonical URL.
- oxfordmale 4y ago
  Slack communicated the incident on the 31st of December. That day is typically used by politicians to bury bad news, as attention to news is quite low on that day. It might be coincidental, however, the little cynic voice in me is left wondering.
  - _zn02 4y ago
    They detected the incident on the 29th of December. I kinda think that regardless of what day they disclosed, from that day to today, people would find various reasons to complain- "to soon to know what happened", "the day before New Years", "the day after New Years", and "too long after the event". In snark I will suggest that's a pessimist voice you're hearing- the cynic in me wonders if there's any time to disclose that won't receive a complaint.
    - bostik 4y ago
      Slack probably has a lot of large - and very demanding - enterprise clients who absolutely require their non-trivial service suppliers to have infosec policies with a maximum of 72-hour notification window for security breaches. And I can guarantee that no company wants to have client-specific notification window policies in place. That way lies road to madness, missed commitments and nasty litigation. It's a good practice, in all honesty. The time window is for the initial notification, after that there will be subsequent notifications when actual investigations complete.
- 4y ago

have_faith 4y ago

> marked with 'noindex' How do they even provide a plausible excuse for this? very bad look.

r4vik 4y ago
it's totally plausible. and best practice. If you have a localised blog for multiple regions you will probably have your main blog set up to be indexed and your regional blogs set up to be no-indexed so that Google isn't indexing the same stuff twice.
- sleepychu 4y ago
  > For starters, this "news" item doesn't appear on the company's international news blog aside other articles, at the time of writing. From the linked article.
  - kindofpenguin 4y ago
    They likely published it as soon as they could and translations will be a couple of days behind. Other blog posts will be pre-planned and pre-translated. The noindex on non-us versions is probably also related to it not being fully translated. Check in a few days to see if I'm right
    - nanis 4y ago
      > BleepingComputer further observed that the "meta" tag containing the "noindex" attribute was itself placed towards the bottom within the page's HTML code, in an elongated line that overflows without breaking. Placing meta tags at the bottom, out of sight ... an _interesting_ choice given the nature of the news.
      - deleted 4y ago
        [deleted]
      - londons_explore 4y ago
        That might just be a limitation of the CMS
        wut42 4y ago
        Agree. While I'm pretty sure this is to bury the articles in search, that part is probably just technical reasons (or, even more credible, technical laziness).
    - bithaze 4y ago
      > Check in a few days to see if I'm right Or, you know, to see if they change it in response to the article or the discussion here.
    - wut42 4y ago
      In a "few days", well we have the August 2022 precedent! > In August 2022, Slack reset user passwords after accidentally exposing the password hashes in a separate incident. Unsurprisingly, that particular notice is also marked with a 'noindex' (both the U.S. and international versions). Here all versions have the noindex. And it's 4 months after.
- voytec 4y ago
  > it's totally plausible. and best practice. Best for what (except PR)? It's hostile towards users which in this case involves a lot of corporate ones.
- deleted 4y ago
  [deleted]
- weird-eye-issue 4y ago
  No that's not best practice. You think only English should be indexed in Google?
  - savolai 4y ago
    The point as I understood it was that if en-US is indexed, it makes no sense to index en-GB too.
    - Karunamon 4y ago
      Not only does it make no sense, it hurts you from an SEO standpoint since the content is probably identical.
      - wut42 4y ago
        that's why you use rel=canonical and rel=alternate. Read the google recommandations. Nowhere it is said to add noindex. Just the rels.
- h1fra 4y ago
  Not best practice at all. Multi-language blog posts should be handled via canonical or rel=”alternate” (own google recommendation)
deleted 4y ago
[deleted]

bradhe 4y ago

Slack aka salesforce

chasd00 4y ago
Right. Salesforce does a good job of keeping major security incidents out of the news. I suspect that practice also applies to all their acquisitions.

muglug 4y ago

I work for Slack, opinions my own. As far as I can tell, Slack's not trying to hide this news. Slack communicated about the breach here: https://slack.com/blog/news/slack-security-update https://slack.com/blog/news/slack-security-update There is no `noindex` tag on that page (check the source). There is a `noindex` tag on an alternate "en-gb" version of that page: https://slack.com/intl/en-gb/blog/news/slack-security-update https://slack.com/intl/en-gb/blog/news/slack-security-update This is to be expected — it's presumably SEO equivalent to specifying a canonical URL.

oxfordmale 4y ago
Slack communicated the incident on the 31st of December. That day is typically used by politicians to bury bad news, as attention to news is quite low on that day. It might be coincidental, however, the little cynic voice in me is left wondering.
- _zn02 4y ago
  They detected the incident on the 29th of December. I kinda think that regardless of what day they disclosed, from that day to today, people would find various reasons to complain- "to soon to know what happened", "the day before New Years", "the day after New Years", and "too long after the event". In snark I will suggest that's a pessimist voice you're hearing- the cynic in me wonders if there's any time to disclose that won't receive a complaint.
  - bostik 4y ago
    Slack probably has a lot of large - and very demanding - enterprise clients who absolutely require their non-trivial service suppliers to have infosec policies with a maximum of 72-hour notification window for security breaches. And I can guarantee that no company wants to have client-specific notification window policies in place. That way lies road to madness, missed commitments and nasty litigation. It's a good practice, in all honesty. The time window is for the initial notification, after that there will be subsequent notifications when actual investigations complete.
4y ago