4 ms·
Well for one thing, there's the hassle of maintaining it. Don't get me wrong, I maintain lots of things. It's my full-time job. I count it as a victory every
by yebyen 11y ago
Well for one thing, there's the hassle of maintaining it.
Don't get me wrong, I maintain lots of things. It's my full-time job. I count it as a victory every time I can gain some capability without adding some additional thing to maintain. Double victory even better every time I can take something I thought I needed to maintain and throw it on the scrap heap, eg because its functionality was subsumed by something else I need more.
Then there is security. If I take this open-source app and deploy it on my servers, and there is a vulnerability that results in privilege escalation, I have just opened up my network. Skilled admins will balk, but if I chat over Slack and there is a security vulnerability in Slack, even something related to my own (or my users' own) incompetence, I've just exposed... worst case is Slack, and Slack's network, and whatever my users already saw fit to expose to Slack.
It should already be eminently clear to my users that data in Slack's hands has left the garden of our own control, and is not to be trusted.
I am a proponent of other and opener Slack alternatives (to put it mildly), but I prefer things that come in a bigger stack, so when I waste my time setting them up, I get something back better than... my own watered-down version of Slack that I need to add to the maintenance charts.
(Insert small, shameless plug for Urbit, which has a centralized talk server and stores backlogs)
- lez 11y agoabout the security issue, you're wrong: if you want to host it for your company, put it behind a VPN or defend the site with a password on the HTTP level. This prevents all attacks from outside.
- yebyen 11y agoThat also hinders remote access and promotes a sense of false security with users who don't know better. Better to tell them to use a secure channel for sensitive things. Then again if you thought slack was really secure I could set how you might think that. There are both arguments. We have a VPN but don't let just any user on it. Then again I'm not sure if I want those people on slack with me either. The times when we want to use slack can tend to not overlap with the times we want to worry about whether the VPN works or if I can connect to it. We even use slack to organize a distributed disaster recovery and coordinate it!
- hobarrera 11y ago> Well for one thing, there's the hassle of maintaining it. You're confusing FLOSS with self-hosted. You can use free software, but hire it as a service. Example: https://githost.io/ https://githost.io/