4 ms·

I work for Slack, opinions my own. As far as I can tell, Slack's not trying to hide this news. Slack communicated about the breach here: https://slack.com/blo

by muglug 4y ago

I work for Slack, opinions my own. As far as I can tell, Slack's not trying to hide this news. Slack communicated about the breach here: https://slack.com/blog/news/slack-security-update https://slack.com/blog/news/slack-security-update There is no `noindex` tag on that page (check the source). There is a `noindex` tag on an alternate "en-gb" version of that page: https://slack.com/intl/en-gb/blog/news/slack-security-update https://slack.com/intl/en-gb/blog/news/slack-security-update This is to be expected — it's presumably SEO equivalent to specifying a canonical URL.

oxfordmale 4y ago
Slack communicated the incident on the 31st of December. That day is typically used by politicians to bury bad news, as attention to news is quite low on that day. It might be coincidental, however, the little cynic voice in me is left wondering.
- _zn02 4y ago
  They detected the incident on the 29th of December. I kinda think that regardless of what day they disclosed, from that day to today, people would find various reasons to complain- "to soon to know what happened", "the day before New Years", "the day after New Years", and "too long after the event". In snark I will suggest that's a pessimist voice you're hearing- the cynic in me wonders if there's any time to disclose that won't receive a complaint.
  - bostik 4y ago
    Slack probably has a lot of large - and very demanding - enterprise clients who absolutely require their non-trivial service suppliers to have infosec policies with a maximum of 72-hour notification window for security breaches. And I can guarantee that no company wants to have client-specific notification window policies in place. That way lies road to madness, missed commitments and nasty litigation. It's a good practice, in all honesty. The time window is for the initial notification, after that there will be subsequent notifications when actual investigations complete.
openplatypus 4y ago
That article is NOT listed on news site https://slack.com/intl/en-gb/blog/news https://slack.com/intl/en-gb/blog/news Yes, your direct link works, but the article is not listed.
- input_sh 4y ago
  https://slack.com/blog/news https://slack.com/blog/news Not gonna guess why, but if you play with the region in the footer: English (US): it's listed English (UK): not listed English (India): not listed
  - deleted 4y ago
    [deleted]
richardwhiuk 4y ago
That's not the standard SEO way of flagging a canonical URL.
- rmbyrro 4y ago
  Who defines this standard? You may argue it's not common, but I'd expect a standard to be determined by an authoritative and fairly representative body. Not by HN forum or a private company in isolation.
  - richardwhiuk 4y ago
    Sure - there's an RFC - https://www.rfc-editor.org/rfc/rfc6596 https://www.rfc-editor.org/rfc/rfc6596
    - docandrew 4y ago
      Technically the parent’s point still stands - this is an informational RFC, not a standard.
      - richardwhiuk 4y ago
        It's also documented in Section 4.6.7 of WHATWG's HTML 5 standard if that makes you happier - https://html.spec.whatwg.org/multipage/links.html#linkTypes https://html.spec.whatwg.org/multipage/links.html#linkTypes
        docandrew 4y ago
        Doesn’t really make me happier or unhappier, was merely making a point that RFCs come in different flavors, only one of which is a “standard” [1]. Not sure why it touched a nerve with so many people. 1. https://www.ietf.org/standards/rfcs/ https://www.ietf.org/standards/rfcs/
        richardwhiuk 4y ago
deleted 4y ago
[deleted]
wut42 4y ago
Very doubtful on SEO and/or alternate content. BleepingComputer also notes the August 2022 notice, which is 'noindex' on all versions. This is most definitely to burry the notices.

by muglug 4y ago

oxfordmale 4y ago

Slack communicated the incident on the 31st of December. That day is typically used by politicians to bury bad news, as attention to news is quite low on that day. It might be coincidental, however, the little cynic voice in me is left wondering.

_zn02 4y ago
They detected the incident on the 29th of December. I kinda think that regardless of what day they disclosed, from that day to today, people would find various reasons to complain- "to soon to know what happened", "the day before New Years", "the day after New Years", and "too long after the event". In snark I will suggest that's a pessimist voice you're hearing- the cynic in me wonders if there's any time to disclose that won't receive a complaint.
- bostik 4y ago
  Slack probably has a lot of large - and very demanding - enterprise clients who absolutely require their non-trivial service suppliers to have infosec policies with a maximum of 72-hour notification window for security breaches. And I can guarantee that no company wants to have client-specific notification window policies in place. That way lies road to madness, missed commitments and nasty litigation. It's a good practice, in all honesty. The time window is for the initial notification, after that there will be subsequent notifications when actual investigations complete.

openplatypus 4y ago

That article is NOT listed on news site https://slack.com/intl/en-gb/blog/news https://slack.com/intl/en-gb/blog/news Yes, your direct link works, but the article is not listed.

input_sh 4y ago
https://slack.com/blog/news https://slack.com/blog/news Not gonna guess why, but if you play with the region in the footer: English (US): it's listed English (UK): not listed English (India): not listed
- deleted 4y ago
  [deleted]

richardwhiuk 4y ago

That's not the standard SEO way of flagging a canonical URL.

rmbyrro 4y ago
Who defines this standard? You may argue it's not common, but I'd expect a standard to be determined by an authoritative and fairly representative body. Not by HN forum or a private company in isolation.
- richardwhiuk 4y ago
  Sure - there's an RFC - https://www.rfc-editor.org/rfc/rfc6596 https://www.rfc-editor.org/rfc/rfc6596
  - docandrew 4y ago
    Technically the parent’s point still stands - this is an informational RFC, not a standard.
    - richardwhiuk 4y ago
      It's also documented in Section 4.6.7 of WHATWG's HTML 5 standard if that makes you happier - https://html.spec.whatwg.org/multipage/links.html#linkTypes https://html.spec.whatwg.org/multipage/links.html#linkTypes
      - docandrew 4y ago
        Doesn’t really make me happier or unhappier, was merely making a point that RFCs come in different flavors, only one of which is a “standard” [1]. Not sure why it touched a nerve with so many people. 1. https://www.ietf.org/standards/rfcs/ https://www.ietf.org/standards/rfcs/
        richardwhiuk 4y ago

deleted 4y ago

[deleted]

wut42 4y ago

Very doubtful on SEO and/or alternate content. BleepingComputer also notes the August 2022 notice, which is 'noindex' on all versions. This is most definitely to burry the notices.