2 ms·
> I think all the talk about channel permissions is making the discussion more confusing than it needs to be. I totally disagree, because the channel permissio
by hn_throwaway_99 2y ago
> I think all the talk about channel permissions is making the discussion more confusing than it needs to be.
I totally disagree, because the channel permissions critically explain how the vlunerability works. That is, when User A performs an AI search, Slack will search (1) his private channels (which presumably include his secret sensitive data) and (2) all public channels (which is where the bad guy User B is able to put a message that does the prompt injection), importantly including ones that User A has never joined and has never seen.
That is, the only reason this vulnerability works is because User B is able to create a public channel but with himself as the only user so that it's highly unlikely anyone else would find it.
- paxys 2y agoYes, but that part isn't the vulnerability. That's how Slack search works. You get results from all public channels. It would be useless otherwise.
- Y-bar 2y agoOur workplace has a lot of public channels in the style of "Soccer" and "MLB" and "CryptoInvesting" which are useless to me and I have never joined any of them and do not want them at all in my search results. Yes, creating new public channels is generally a good feature to have. But it pollutes my search results, whether or not it is a key part of the security issue discussed. I have to click "Only my channels" so much it feels like I am playing Cookie Clicker, why can't I set it as checked by default?