> At some point in the future, slack will get hacked.

There are a number of high profile companies that have gotten hacked as well, some of which had REAL damage done as a result.

Running On-Prem is no safeguard for hacks, and you are trading one set of vulnerabilities for another set.

Following that same line of reasoning, services like AWS shouldn't be used either, as they also provide a new threat vector for attacks.

////

This is from Mattermost's web site:

> Mattermost is written in Golang and React and runs as a single Linux binary with either MySQL or Postgres.

For an on prem solution, you've now taken on the responsibility for maintaining at least a few linux machines. Including patching, hardware failure etc. Next comes the database, including performance tuning, security configuration and patching. Finally when updates to Mattermost software itself, ensuring you stay up to date with that.

If Messaging is somewhat critical, you'll need to ensure you have fail-over/fault tolerance in your architecture.

You'll also want to make sure when you patch, you do a rolling patch, so you don't accidently break messaging.

Plus you'll want to backup your message data and run through DR protocols.

This will be in addition to maintaining all the other corporate IT internal systems a company may use.

> Running On-Prem is no safeguard for hacks, and you are trading one set of vulnerabilities for another set.

I think the parent poster's point is, concentrating all of these user accounts into one location makes it a more enticing target. Robbing a bank is more enticing than robbing a liquor store. To strech the analogy a bit, and support your point, Banks are better at securing the money.

So, to be explicit, in house maybe not as secure as slack, but the possible rewards are just your company's value. If 1000 companies are all in the slack pool, slack ought to be 1000 times better than a single company alone. Because the reward for a hack is so outsized.

Running on-premises makes you a smaller target. If a hacker gets into slack, he can do "REAL damage" to every company using slack, not just one single on-premises target.

"High profile company" and "smaller target" are somewhat mutually exclusive.

Think about it this way: Slack's entire business revolves around secure company communication. That's just a blip on High Profile Co's list of priorities.

Slack maintains a bug bounty program. What's the likelihood that High Profile Co is doing the same for their messaging app?

That doesnt change the fact that it's (a) high value target and (b) highly likely to be compromised by the people they worry about most. Whereas on premise means hackers run into who knows what apps, network configs, routers, OS's, etc. Lots of extra work for them. Plus some company and its employees dont have access go your data without a risky subversion.

Real damage hacks like corporate espionage you don't hear about, because it is in no one's interest involved to reveal those to anyone other than the buyer of the information, which usually a premium if it's kept discrete. No way to say this has not already happened.

> At some point in the future, slack will get hacked

Slack got hacked last year: http://techcrunch.com/2015/03/27/slack-got-hacked/

That didn't leak any actual communications, though, just user database information. Still, point taken, let's hope they have implemented structural improvements to their security / qa processes.

I'm sort of astounded at the demand for these products. Instant messaging/chat/constant interruptions is an antipattern in my book. I don't use Slack or have any other instant messaging running on my desktop. I used to, but found it highly annoying. I just use email, and check it a few times a day. What is the need to suck on this firehose of instant information about all kinds of mundane events?

I think this is highly dependent on culture and the type of work you're doing. Is the software you're doing organized such that you can effectively lock yourself away for an entire day and just solve problems? If so, you're probably not going to see much value from Slack, if any.

But what if you do need to collaborate on pieces constantly? Bouncing emails back and forth isn't the best. If you don't have an office environment that's conducive to collaborating like that, slack is also a boon here. Doubly so if members of the team are distributed. What if you've got issues with your email where there's a ton of it, and 90% of it is only mildly important? If lots of the people sending out that email instead just sent chats to a channel that you turn off notifications for, you won't see notifications for it and your inbox is cleaner.

Of course it can be disastrous, with channels turning into nothing but a bunch of GIF sharing and other stupid shit. The onus is on the team to keep work channels clean and focused, and have appropriate channels for goofy stuff that people will naturally tend to participate in.

Note that I'm not saying whether or not this ultimately allows work to happen more efficiently. I honestly can't tell if using Slack makes things easier in the long run, but I certainly prefer using it over email if I can.

> Bouncing emails back and forth isn't the best.

Seems to work just fine for the linux kernel.

On the contrary, I think using a single tool (i.e. email) for every type of communication is the anti-pattern. The fact of the matter is that real-time chat is much better suited for most types of conversations that happen in a typical workplace.

My policy is that if the email is going to be less than two paragraphs, it's better to send it as a Slack message (or IRC or whatever your team uses). But if you need to elaborate on an idea, or bring someone up to speed on something, then write an email, and make sure it's exhaustive.

Yeah, I don't get it either. The majority of what I've seen at my company is giphy spam in every channel. The vast majority of people constantly check slack for any giphy updates or other BS. Direct messages are distracting because they are intrusive even if they're not that important right now. The whole thing is anti-productivity masquerading as collaboration.

I get its uses, but I rarely see those in practice.

"Instant messaging/chat/constant interruptions is an antipattern in my book"

It's a lot better than someone coming over to your desk and poking you.

If everybody I knew were emailing instead of texting, chatting, calling, video calling, I would have much better relationships, professional and personal.

Can I ask why you feel that way about personal relationships?

Because most talk is reflexive and not thought-through. When you write emails you are forced to think and express yourself in the best way possible.

Just to clarify, are you asking about the use of instant messaging in a work environment, or at all? I can see an argument that it's counterproductive at work, but the purely social utility has been obvious for decades; it basically evolved out of IRC.

FWIW Slack does make it very easy to specify a conservative data retention policy organization-wide: https://get.slack.help/hc/en-us/articles/203457187-Custom-me...

I've found message retention to be a "checkmark feature:" It's technically there, but it's not really achieving the goals you'd hope for message retention to help with. You'd want to be able to say "Don't retain messages more than 90 days old except for the rooms I, the admin, specify." But:

* There's no API to set retention settings or defaults

* There's no API to audit retention settings for private channels

* Non-admin users can change retention settings for DMs and private rooms

* There's no way to enforce that private rooms and DMs get a maximum retention setting

That the cloud service company had access to your communications was something that was brought up at Blekko which was using Google's hosted domain feature. On the down side, there was at least one documented case of an engineer pawing through other people's mail. On the other hand, a lot of the VCs and partners had Google hosted email as well so "copies" of our communication would be there anyway.

At the end of the day the vendor's priorities were aligned with ours, they want to sell hosted mail/docs/etc service and having people with bad experience (even one) really limits them. So I think Slack would also be similarly aligned with maintaining their security and the security of their clients for exactly similar reasons.

The issue that Schneir pointed out about protecting your data when you're SaaS provider goes chapter 7 on you, that one is still real. And while there are people with cash hoards who could do it, I've yet to see someone spend money to buy a SaaS company so that they could get access to the data of a competitor. Although to be honest I did wonder a bit about Yammer. Killing a potential competitor (Whatsup, Instagram) sure, but actual industrial espionage would seem to be an unlikely outcome. (Would make for a fun story though, if you're reading Charlie :-)

The majority of the corporate world is either already on Office 365 or moving to Office 365 for their email, which could be subject to the same argument.

That said, I think any hacker would die of boredom reading my company's Slack channels before they hit any nugget of interesting information!

CtrlF: illegal, $, credit card info, etc.

Again and again, the issue is not the encryption algos, it's the bits between the keyboard and chair. People are stupid.

Any hacker capable of hacking slack would likely automate searching of interesting information too :) It is not like they are going to sit and read tons of boring chats!

Not everyone is on Google Apps or Office 365. Most of the big corporations outside tech still use self hosted mail servers and use outlook client.

This is changing - rapidly. Even some of the biggest companies in the uber-conservative oil and energy industries are moving to O365 and similar.

There are very few holdouts that have no privileged corporate information in one SaaS or another - SFDC, github for enterprise, Workday, netsuite, etc...

Currently use Google, SFDC, GHE and Workday. NetSuite may be coming soon, we're very much so in the cloud!

>Every sufficiently popular product does.

I'm not a Slack shill, have never used the product, don't know anyone who works for the company.

But.

Has Facebook ever been hacked to this degree? Has Google ever been hacked to this degree? Has any sufficiently popular social-media/enterprise-knowledge-sharing app been hacked to this degree?

What makes you so completely certain that they will be hacked and that a 'treasure trove' will be available to the supposed hackers?

Seems like unwarranted FUD tbh.

> Has Facebook ever been hacked to this degree?

Yes, security researchers have reached FB servers in the past few months.

> Has Google ever been hacked to this degree?

Yes, by Mainland Chinese agents a few years ago.

I know of similarly large networks that are currently owned.

And almost everybody has an IPMI problem, whether they realize it or not yet.

(Silicon Valley engineer here.)

IPMI meaning the protocol for server management [1]? I'm curious on this one.

[1] https://en.wikipedia.org/wiki/Intelligent_Platform_Managemen...

IPMI cards are always-on, and run outside the rest of the server. They receive power even if the server is shut down. These are used for out-of-band management, power on/off, etc. Imagine if someone were to have control of the firmware running on your IPMI cards... they would have physical access to your server (essentially) from a remote location. You often don't control what's running on the IPMI cards or if they call home, etc. What if HP or Dell had sleeper software in your IPMI cards, and when it wakes up, opens a direct connection to your server?

Take for instance Intel's addons to IPMI "Automatic Management Technology".

Let's say you have a server, reachable on a certain network address on a LAN.

I can turn on AMT, I can set up server management answerable at the SAME address. network traffic to and from the machine and network is undisturbed.

I can install bios updates, configure aspects of the machine, all kinds of things, just with AMT. I have read in some cases you can configure the machine this way even if its powered off.

> Has Facebook ever been hacked to this degree?

Instagram could have been: http://exfiltrated.com/research-Instagram-RCE.php.

So your answer is 'nope, but here's a product they bought that could have been hacked'?

Pretty much. At a certain level, companies are the things they buy.

And we don't know how linked instagram and FB are. Is the instagram app signed by facebook? etc.

Did you miss the Snowden leaks? Yes, Google and Facebook have been hacked.

No. I did not miss them.

How does that affect your everyday company, with orders of magnitude less competence/intelligence per capita....?

My question is this; what company that uses Slack has good enough opsec that Slack is the vuln to be exploited.

Please name one company where Slack could even potentially be the easiest point of entry.

The issue with centralization is that you don't have to name one company where Slack is the weak point in the chain: a good exploit might get you access to data from 1000 companies. Then Slack could be a better target even if it's 999 times more secure than the weakest link at each individual company (assuming the attacker doesn't have a very specific, one-track target).

Yeah this is a great point, I agree.

I see your point, but that is detracting from the main point and larger dilemma which is that Slack has all this centralized data.

Easiest point of entry? No. Single point of entry? Yes.

> Slack is the only SaaS that has access to, and STORES PERMANENTLY

Isn’t Gmail in roughly the same spot?

I know people say things through work IM that they wouldn't message via email. Not a good practice at all, but there is the illusion of something being less permanent via IM.

Slack does a pretty okay job messaging that everything you say is available to your companies administrators. At the minimum, assume that everything said on your corporate IM system (even private to two users) is discoverable in a lawsuit.

At least with gmail chat there is an off the record option.

Worse yet, what if the government decides it wants data that Slack holds and forces their hand?

I don't think this problem isn't solvable. Public crypto could help alleviate some of the pain. For instance, what you say holds true for most Google services (Gmail, search data, hangouts, data from Android), Github (private repos), Amazon (credit card data, purchase data), Uber/Lyft (travel data) or basically any popular WWW service with wide enough adoption. Nothing peculiar to Slack.

I wonder if the concerns you raised could be done away with if they started using crypto similar to ones used by Telegram or say, Signal by Open Whisper Systems.

Re: Data Retention: Slack could provide a TTL field and that would help solve that.

Users will need to demand it -- but I wonder if many users know enough to ask.

Gmail (at least free Gmail for individuals) won't have end-to-end encryption because their business model is to scan your email and serve you relevant ads.

But Slack, I don't see why not. I would like to try Slack on my team, but sending all of our unencrypted internal communications to a third-party is a bad idea. even if nothing bad happens, it's a bad idea.

Is there a open source, self hosted product like Slack?

Edit: Never mind, others have already mentioned a couple, down the comments - for example, http://www.mattermost.org/

We use http://rocket.chat . Its open source, offers a slack compatible api, multi-user video chatting, screen sharing and has mobile/desktop applications.

Has it been reliable ? We are testing with a few users but curious how it works at any kind of scale ?

There's a deluge of them. Pick your poison:

http://alternativeto.net/software/slack/?license=opensource

Security company SpiderOak (not affiliated) seems to be working on a "zero knowledge" end-to-end encrypted hosted Slack competitor. I'm no security expert and I don't know whether these claims actually hold up. You can read more here:

https://spideroak.com/articles/press-release-semaphor-to-giv...

This made me laugh: "Semaphor is not slack about privacy."

Agreed and particularly unsettling given the NSA's precedents; how do we know Slack isn't simply siphoning data to them via secret frontdoor collaboration or unknown backdoor (or combination thereof [1]).

[1] https://www.washingtonpost.com/world/national-security/nsa-i...

Not just the NSA. They can send it to any other organization they want.

Yup, the self-host is def a blocker for a lot of orgs. HipChat even has a self-host solution.

We're using Mattermost here and pretty happy with it, it's got missing areas but it does let you self-host pretty easily.

What are the biggest areas where Slack > Mattermost? It seems pretty complete? Does it also use an Electron-based Desktop application?

Mostly in integrations. Quite a few of the Mattermost ones are roll-your-own(albeit with Slack API-compat).

> so many high profile corporations

I think most of the perceived hype is generated by Slack itself and its SV valleys. I doubt that more than a handful of Fortune 500 companies even allow its usage.

Back in October 2014 it included at least some teams at MS, Apple, and big news organizations like NY Times, Wall Street Journal, etc. While it may not be 100% deployed, I'd bet that a lot of F500 companies have at least a few divisions that are all over it.

http://www.businessinsider.com/slack-flaw-lets-you-see-other...

I've only heard anecdotally, but I wouldn't be surprised if many Fortune 500 companies' employees are using Slack without being "allowed".

I'm sure Apple is not keeping the schematics for the A8 on Slack. There is so much corporate communication info which would be of no value whatsoever to a competitor, and it would take a lot of work to troll through a data dump looking for a few nuggets, which might not even represent the company's actual plans (just some maverick's ramblings).

You're also exposing yourself to a lawsuit.

A lot can be gleaned and infered from seemingly ordinary internal communication. Why do you think people used to go dumpster diving at their competitor's offices?

If it was worth digging through actual trash, I'm sure an electronic dump would be more highly valued.

Plus, it's all probably subject to discovery if you get sued, even assuming it doesn't get hacked.

Just like any form of business communication tool, self hosted or not. Not sure what your point is?

Just like Gmail for Business?

Yeah, but I think there's a difference between email and chat in terms of how much discretion you habitually exercise when writing, so it's likely that it's more dangerous to you in court.

Try Balboa. End to end encrypted. Has video calls too. Also has faster file transfer speed.

Targeted towards international NGOs operating in rough areas, but works for other business too.

Not free though. Seems security comes at a premium.

any SaaS company suffers the potential chance of a rogue employee, certain google employees could snoop around people's emails if they wanted, etc.