Because the expected loss from a malicious actor with access to those logs cloning your product (without any access to the actual people who thought up your product!) is often more than balanced by the expected benefit from getting everyone on a knowledge base with a brilliant UX.

Sure, you wouldn't have wanted to host the Apollo Program's lab notes on Soviet servers, but your cat selfie startup isn't quite as high-stakes as that.

Unless your cats are taking selfies on Mars. In which case, yeah, maybe developing an in-house chat service is worth the investment.

But Slack isn't just used for discussions. It's used for sharing. People send files through slack -- files that probably contain sensitive data, code, financials, etc. People pass secret sharing URLs (think Google Docs' "anyone with the link can access") through it. If we're being honest, probably some people exchange passwords over it. People directly grant OAuth access to other services for "integrations". Some people do "ChatOps" -- literally controlling production servers through chat -- over Slack.

And then what if Slack gets hacked?

http://slackhq.com/post/114696167740/march-2015-security-inc...

    Q: Were my messages taken/read/accessed?

    If you have not been explicitly informed by us in a separate
    communication that we detected suspicious activity involving
    your Slack account, we are very confident that there was no
    unauthorized access to any of your team data (such as messages
    or files).

So. Slack has been hacked, and at least some people's logs were evidently stolen.

Yikes.

Yeah, what you just said is probably the case for the majority of Slack's users, and I get that.

My perspective is framed by working with an EMS provider (PCB design & assembly) who does business in some highly regulated fields. We've started using Slack in the last couple months for some of our teams, and love it, but the idea of using it as a catch all strikes me as questionable.

If we used Slack for actually talking about the design/assembly portion of the business, and not just coordinating sales and marketing efforts, our customers would flip shit. And rightfully so.

I own a contract manufacturing company in China, had similar concerns. We implemented an open source Slack alternative that runs on our own server. Project is called Zulip --> https://github.com/zulip/zulip

I feel like I came across that as I was weighing the various options for us to try haha. Zulip is the kind of thing I'd love to give a shot, but I have to take into account people who won't be tech savvy enough to use something like that. Therein lies Slack's value to us.

At the end of the day, Slack is really useful, but I just don't see its use getting expanded much. At least for us. There's lots of stuff that just shouldn't get communicated across there. Coordination across the sides of the business that don't use Slack wasn't an issue in the first place, it was never really even considered afaik.

(Zulip committer here) Definitely agree that user onboarding could use some work, feel free to send feedback.

hn-username @zulip.org , or https://groups.google.com/group/zulip-devel

Another self-hosted alternative you might like is MatterMost, which is quite similar to Slack in look-and-feel, but free software and self-hosted.

> Sure, you wouldn't have wanted to host the Apollo Program's lab notes on Soviet servers, but your cat selfie startup isn't quite as high-stakes as that.

I find this to be a pretty interesting comparison. To the best of my knowledge, the entire stakes of the space race were "we might lose face".

That, and "Soviets are going to launch satellites loaded with nuclear weapons into space and end the cold war".

Slack is classic "shadow IT". It isn't introduced or managed by IT. It is introduced by users. If IT departments were in charge of Slack, you'd have to have seven layers of managerial interference before you could open a new channel and it'd have the usability of Lotus Notes.

You are right, a lot of companies would walk away from that pretty quickly as long as it's a third party thing. Github launching it's self hosted enterprise is what really enabled it to reach the larger companies, as they tend not to trust their valuable data to exist outside of their control.

Slack has said before that they're going to release a self hosted version at some point, so they have to know this is true. I think it makes sense for them to focus on the larger market (personal use and the SMB sector) for now though, even though the enterprise market will really make them money, because it's a much lower pressure space where they can afford to experiment.

First, because the (perceived) risk is relatively small, both of damage and the chances of damage.

Second (this is the point I think hn-like forums grossly underestimate) is because the alternatives are not really alternatives. In practice the likelihood of using Irc or some open source chat within a company with the same wide buy in as slack (or Skype etc) is 0.

The way to judge this is adoption.

HipChat is a real on premise alternative.

It may not be quite as "slick" looking, but it works very well.