5 ms·
I work for Slack, opinions my own. IMO the headline should be updated — much less than 1% of Slack’s private code can be accessed via github.com.
by muglug 4y ago
I work for Slack, opinions my own.
IMO the headline should be updated — much less than 1% of Slack’s private code can be accessed via github.com.
- jbotdev 4y agoThe article did mention that this breach did not include the “primary codebase”. Where is the rest of the code hosted? I’m guessing some private Git server (e.g. “on-prem” GitHub/GitLab Enterprise)?
- nightpool 4y agoI would be surprised if Slack disclosed publicly exactly which source code provider they used, but something hosted like Github EE sounds like a very reasonable assumption given their response. Maybe someone was given a goal to migrate their main source code repo to a shared Salesforce instance for security or cross team integration reasons, and everything left on Github.com was just the stuff too unimportant to migrate. If so, seems like it payed off for them in this case.
- oxfordmale 4y agoIf you don't communicate, you lose the narrative. As the article highlights, it seems Slack has gone out of its way to exclude this incident report from appearing in Google searches. As a result this article will likely appear first. It is also worth nothing that other major breaches (LastPass) were preceded by source code breaches. The corresponding incident reports also included re-assurances that there was no impact on customer safety. The Slack incident report doesn't specify what type of Github repos were accessed, so it is hard to judge if any sensitive code has been leaked. From the recent LastPass security incident report: Based on our investigation to date, we have learned that an unknown threat actor accessed a cloud-based storage environment leveraging information obtained from the incident we previously disclosed in August of 2022 (source code breach)
- muglug 4y agoSlack communicated about the breach here: https://slack.com/blog/news/slack-security-update https://slack.com/blog/news/slack-security-update There is no `noindex` tag on that page (check the source). There is a `noindex` tag on an alternate "en-gb" version of that page: https://slack.com/intl/en-gb/blog/news/slack-security-update https://slack.com/intl/en-gb/blog/news/slack-security-update This is to be expected — it's presumably SEO equivalent to specifying a canonical URL.
- richardwhiuk 4y agoAbove poster is from Slack. That's not the standard SEO way of flagging a canonical URL.
- nightpool 4y agoSure, but it's a way less misleading comment then the original bleeping computer article, which mentions the "noindex" tag without ever mentioning that it was applied only to duplicate content.
- seti0Cha 4y agoIt's not unheard of either and likely makes very little difference in the actual discoverability of the document.
- prepend 4y ago> The Slack incident report doesn't specify what type of Github repos were accessed, so it is hard to judge if any sensitive code has been leaked. This is so important. Saying “less than 1% of code” is not very useful as a passwords or config repo being leaked may only be a few bytes. It’s also not customer data. But it’s extremely important. I think the fact that they are being not forthcoming means they are clueless, or something really bad happened and they are weaseling and hoping nothing bad happens (spoiler: it will).