News for hackers. Stuff that matters.
Re:US Cybercom says mass exploitation of Atlassian Confluenc... by pletnes on Monday September 06, 2021 @08:34AM (#28433055)
There are many jira alternatives out there, from what I can tell. Why are they not disrupted already, if it’s such a low hanging fruit? (Honest question - I don’t have any personal preference)
Re:US Cybercom says mass exploitation of Atlassian Confluenc... by cogman10 on Monday September 06, 2021 @08:40AM (#28433108)
Atlassian products are vast, integrated, and support all the crazy draconian processes that every insane project manager wants to implement.

You can't easily dump Jira if you are using Jira, confluence, bitbucket, and whatever their CI/CD product is called (bamboo?)

Re:US Cybercom says mass exploitation of Atlassian Confluenc... by closeparen on Monday September 06, 2021 @05:14PM (#28438169)
Not just product managers. All kinds of enterprise processes decompose nicely into tickets. Arbitrary workflows, transitions, validations, custom fields, filters, and reports make it one of the most successful “no code” tools behind Excel, and then the REST API is comprehensive and well documented. At my company JIRA bots are compelling and cheap alternatives to new web UIs for internal tooling needs, surprisingly often.
Re:US Cybercom says mass exploitation of Atlassian Confluenc... by nerdponx on Monday September 06, 2021 @11:49AM (#28434876)
How many PMs actually use those features? In my organization, for example, I don't see any reason why we should prefer Atlassian over Taiga, other than familiarity and inertia.
Re:US Cybercom says mass exploitation of Atlassian Confluenc... by riffraff on Monday September 06, 2021 @01:41PM (#28436100)
There's a ton of things you can do in Jira, and different organizations use different things. It's like excel or word, in that sense.
Re:US Cybercom says mass exploitation of Atlassian Confluenc... by yourapostasy on Monday September 06, 2021 @03:27PM (#28437053)
> How many PMs actually use those features?

It isn't the set of features that makes them sticky. It is the 10% of features the lead PM can't live without, and the slightly-overlapping-but-different 10% of features the team PM's can't live without, and the slightly-overlapping-but-different 10% of features the developers can't live without, and the roll-up report features the leadership team can't live without... There has been some research into this phenomena [1]. I'm not aware of a handy term for the phenomena, would surely appreciate someone pointing me to it, and the industry recognizing it and building for it, though.

Internally in my head I call it "multiplexing feature sets". Though I never say that aloud and just give the long-winded explanation if I have to bring it up in meetings.

> ...I don't see any reason why we should prefer Atlassian over Taiga, other than familiarity and inertia.

In large-organization dynamics, never underestimate the familiarity and inertia factors. I regularly see vendors screw this up so badly. Account management teams of even large organization vendors (so they should be taking action upon this, but apparently are not) regularly have no clue what kind of massive red flag it takes to push their decade(s)-entrenched product from "man we wish this could be better" to "you really need to fix this, or we need to start looking elsewhere".

How do you tell when a customer is just kvetching and presenting empty threats, or is laying it on the line to you? Easy: the customer is happy to share with you specific details of how the product shortcomings/defects are impacting line of business processes and the business impact (ask for this under the cover of learning what the critical business impact is so your support teams can devise the most appropriate tactical technical solution for immediate partial/total relief), and is eager for live working sessions with the customer's engineers.

And understand this: rarely will a customer reveal they have switched away until it is practically finished. They want to maintain what little interim support quality they have left, until they can step off. If your account management practices engage "all hands on deck" priority support when you get wind of a competitor in the wheelhouse, then you've lost before you even started. That's why the reveal is always a shock to vendors, and always a done deal when it is shared.

The time to understand that your product and product support consumption experience for a particular set of customer needs is horribly broken is when you notice a customer requesting product support leadership engagement more than 2-3 times in a year. If you aren't tracking those engagement touch points, then I guarantee you are losing license sales. They just don't show up in the sales metrics.

[1] https://www.sciencedirect.com/science/article/pii/S187770581...

Re:US Cybercom says mass exploitation of Atlassian Confluenc... by sufyanadam on Tuesday September 07, 2021 @11:30AM (#28446031)
What are these features that PMs can't live without, that they don't get with an alternative such as, say, Pivotal Tracker?
Re:US Cybercom says mass exploitation of Atlassian Confluenc... by Aeolun on Tuesday September 07, 2021 @08:56AM (#28444139)
I think that the larger and more dystopian organisations cannot do better than Jira to fulfill their needs.
Re:US Cybercom says mass exploitation of Atlassian Confluenc... by pidminusone on Monday September 06, 2021 @02:48PM (#28436727)
GitLab has wikis, CI/CD and sprint / issue / project management features. We use it at $DAY_JOB and while not perfect it's a pretty great offering.
Re:US Cybercom says mass exploitation of Atlassian Confluenc... by nicoburns on Monday September 06, 2021 @08:55AM (#28433189)
Clubhouse (soon to be renamed Shortcut) covers the first two. Github covers the latter two. It's easier to switch than ever.
Re:US Cybercom says mass exploitation of Atlassian Confluenc... by hirako2000 on Monday September 06, 2021 @10:23AM (#28433938)
No it's not easy to switch. Engineeting Organisations have invested a lot in the Jira eco system, that includes custom workflows that are understood only by a few to be able to alter them, users are productive right now with jira and nobody wants them less productive even just for a while learning another task manager. Here again the integration effort to migrate would scare any leader who would be blame for the impact on so many teams deliverables. The effort is enormous and error prone to take all the data in there, move it elsewhere, rebuild the workflow and integration configuration, while keeping track of lack of feature parity to write down an explanation before everyone complains and pre empting their request to at least provide a work around what they used to be able to do with 3 clicks. Confluence slips right in because it integrates very well with jira. Just embed a confluence page into a task, and just mention a jira task within a confluence page and you get a seamless experience. Yes we could use another wiki , and a good one as confluence is a calamity. But convenience is what organisations are after. Perfect is the enemy of the good they will say. I don't have a love for atlassian products, but they tend to do their job very well compared to the majority of the competition. You will always find one product that compares, or even is superior but overall, their product works. So here we are.

If they get plagued by further security vulnerabilities then companies handling sensitive data will concede to migrate, but it won't be simple by any means.

If you believe changing people's habits is easier than ever, it's rather the opposite. Workers are less and less inclined to learn any other way . The alternative has to be order of magnitude better than what they are using, otherwise they will resist the change. The fact is atlassian provide good to great products overall.

Re:US Cybercom says mass exploitation of Atlassian Confluenc... by nicoburns on Monday September 06, 2021 @10:53AM (#28434255)
> "Just embed a confluence page into a task"

Except that confluence and JIRA are both so slow that you'll still be there 2 minutes later waiting for it to load. Perhaps not everybody's experience is so bad? I don't understand how anyone could consider these products convenient given how ridiculously slow they were.

We used to do refinement meetings over video call (I guess everyone is these days) inputting into JIRA, and we'd literally spend 3/4's of the call waiting for JIRA to catch up with the words I'd typed. There's bad engineering, and then there's making writing a sentence text box lag with times measures in seconds.

Re:US Cybercom says mass exploitation of Atlassian Confluenc... by nwatson on Monday September 06, 2021 @11:30AM (#28434660)
We use the cloud version, I've edited huge Confluence pages and it's typically very snappy. Jira likewise. Could be an under-resourced on-premise deployment?
Re:US Cybercom says mass exploitation of Atlassian Confluenc... by jhardy54 on Monday September 06, 2021 @12:45PM (#28435521)
I think they’re talking about the front-end, not the server. FWIW both Confluence and Jira are abysmally slow on my machine (new MBP) on the cloud version.
Re:US Cybercom says mass exploitation of Atlassian Confluenc... by wutwutwutwut on Monday September 06, 2021 @01:28PM (#28435961)
I use both Jira and Confluence (cloud version) on a 6 year old Dell laptop and have no performance issues.

Maybe I'm closer to their servers. Or you're using Safari.

Re:US Cybercom says mass exploitation of Atlassian Confluenc... by jhardy54 on Monday September 06, 2021 @06:43PM (#28438945)
Nope, I’m using Chrome / Firefox and it’s a common enough problem that Atlassian sluggishness has been a running joke on multiple teams I’ve been on.

Maybe I should measure it and post somewhere, I thought it was a well-known problem but maybe there’s something different about our setups.

Re:US Cybercom says mass exploitation of Atlassian Confluenc... by hirako2000 on Monday September 06, 2021 @08:25PM (#28439545)
I have seen on premise issues , infrastructure can be the problem, or config. Jira cloud can also be a problem,but nothing one can do about it other than sending a ticket. I think they know what they are doing wrong with certain "low value" subscriptions.
Re:US Cybercom says mass exploitation of Atlassian Confluenc... by cutemonster on Monday September 06, 2021 @10:52PM (#28440374)
Is Safari slow when using Jira?
Re:US Cybercom says mass exploitation of Atlassian Confluenc... by jdmichal on Tuesday September 07, 2021 @07:42AM (#28443501)
I use the cloud version also. While Jira doesn't have any issues, editing Confluence pages can be a right pain. It is constantly "losing my connection" and prevents editing until it's happy again. There's no connection issues present, unless they're at Atlassian's end.

Watching the network tab, all I see is a requests to `bayeux-sync1` endpoint that take 5 seconds or longer. There's always one of these requests hung when it enters this unresponsive mode. I suspect this is some part of the syncing system for multiple editors. Which, if true, makes it particularly hilarious to me that the entire point of this system would be to sync multiple edits, yet it won't let me keep editing while it's waiting...

Re:US Cybercom says mass exploitation of Atlassian Confluenc... by Cederfjard on Monday September 06, 2021 @09:23AM (#28433395)
> Clubhouse (soon to be renamed Shortcut) covers the first two.

Even taking the following into account?

>> Atlassian products are vast, integrated, and support all the crazy draconian processes that every insane project manager wants to implement.

Re:US Cybercom says mass exploitation of Atlassian Confluenc... by nicoburns on Monday September 06, 2021 @09:35AM (#28433491)
Well if your organisation wants crappy project management tools and processes then there's nothing to be done. But there are plenty of alternatives out there for those who seek them.
Re:US Cybercom says mass exploitation of Atlassian Confluenc... by kayodelycaon on Monday September 06, 2021 @10:06AM (#28433751)
There aren’t good integrated replacements. Any system that lacks a wysisyg interface for text is not a viable option. If copy and paste from Word doesn’t keep some of the formatting, forget it.

Our support board has customized forms. These forms create tickets that can seamlessly be moved to our scrum board once they are vetted. We use JQL to manage a lot of the boards we use. We have custom workflows for different ticket types. We use the comprehensive access controls to grant partial access to users based on custom roles.

None of this rigidly enforces our workflows (aside form access control). Instead, it streamlines sharing information across departments.

When it comes to a company wiki system, Confluence is extremely hard to beat. (I’ve use so many wiki systems. Dokuwiki is my goto.)

All of these systems use a single user account. We use single sign-on, but we don’t have a large IT department to manage the dozens of services we access every day.

Re:US Cybercom says mass exploitation of Atlassian Confluenc... by gurkendoktor on Monday September 06, 2021 @01:39PM (#28436076)
> There aren’t good integrated replacements

I think even that would be a good attack vector against Atlassian: For them, "integration" means adding links from one product to the other. If I were to pay for an integrated suite of tools, the least I would expect is that their bloody markup languages are consistent. But because Atlassian just buys random products and then doesn't seem to ever change a single thing about them, that's not going to happen.

Re:US Cybercom says mass exploitation of Atlassian Confluenc... by laurent92 on Monday September 06, 2021 @02:06PM (#28436362)
That’s false: Confluence went from Wikimarkup in 2008 to wysiwyg in 2010 (to big uproars); and they are uniformizing all their cloud products under the new ADF editor.
Re:US Cybercom says mass exploitation of Atlassian Confluenc... by gurkendoktor on Monday September 06, 2021 @02:46PM (#28436712)
Thanks, that's good to hear. A quick Google search makes it sound like it will finally be possible to use `backticks` for code everywhere.
Re:US Cybercom says mass exploitation of Atlassian Confluenc... by rtpg on Monday September 06, 2021 @09:53AM (#28433624)
It is actually possible to want bespoke tools to do certain things. And honestly? Confluence is slow, but at least it has all the features I could want and it works.

People are like”use the shiny thing” forgetting the existing thing has, you know, stuff I actually use.

Re:US Cybercom says mass exploitation of Atlassian Confluenc... by Cederfjard on Monday September 06, 2021 @10:05AM (#28433745)
Thanks, I got you. But you didn’t really address the point of the person you responded to, then, which was that part of why this space hasn’t been disrupted to a larger degree is that Atlassian products are entrenched in many companies, and that a lot of people do want that complexity (disagree with that as you or I might).
Re:US Cybercom says mass exploitation of Atlassian Confluenc... by gurkendoktor on Monday September 06, 2021 @01:45PM (#28436143)
> ... and that a lot of people do want that complexity (disagree with that as you or I might).

As much as I love to hate Atlassian, I feel like complaining about Atlassian is like techies complaining about management in general. Every single anecdote is both terrible and true, but it's not quite as easy as it seems to do it better.

Re:US Cybercom says mass exploitation of Atlassian Confluenc... by manigandham on Monday September 06, 2021 @09:47AM (#28433580)
This is the primary failing of many tech people/companies. You can't compete by just building a "better" technical product.

Everything from sales to support to customizations and integrations matter to companies, especially as they grow and develop their own teams and management structures which require the software mold into their workflows. Whether the management processes are the best is a different conversation, but being able to support any scenario is why Jira and Confluence are so successful.

It's the same reason why Salesforce has dominated CRMs even with so many "modern" alternatives around.

Re:US Cybercom says mass exploitation of Atlassian Confluenc... by Aeolun on Tuesday September 07, 2021 @09:02AM (#28444228)
> being able to support any scenario is why Jira and Confluence are so successful

It’s incidentally also exactly why they’re often horrid to work with.

Re:US Cybercom says mass exploitation of Atlassian Confluenc... by marcinzm on Monday September 06, 2021 @09:03AM (#28433256)
Because Jira is flexible and has the needed features and integrates with most things you care about. To the point where everyone in the org can tolerate it. Alternatives tend to focus on one group of users and the rest HATE the product.

I've tried a lot of these products and in the end come back to Jira because it works better on average for everyone.

Re:US Cybercom says mass exploitation of Atlassian Confluenc... by Bahamut on Monday September 06, 2021 @01:42PM (#28436108)
This comment nails it - anyone who has had to investigate other offerings that satisfy the needs of project management, design, and engineering will quickly find that all the other options out there are total garbage in comparison to Jira, which is why Jira remains at the top of the totem pole for what it does.

As an engineer & former manager, there are definitely things I didn't like about Jira like slowness, but everything else I investigated/used were worse in multiple significant ways.

Re:US Cybercom says mass exploitation of Atlassian Confluenc... by marcinzm on Monday September 06, 2021 @02:00PM (#28436308)
My current company tried Monday. The engineers begged for Jira after that.
Re:US Cybercom says mass exploitation of Atlassian Confluenc... by cmorgan31 on Monday September 06, 2021 @02:30PM (#28436565)
There's a worse world - one where you have on prem Jira, Monday, Paper, O365, Confluence, Github, and internal api documentation all out of alignment with the other. I'm begging to just end my misery.
Re:US Cybercom says mass exploitation of Atlassian Confluenc... by matwood on Monday September 06, 2021 @03:26PM (#28437046)
The other thing about jira is it’s configurability. I look for replacements every so often and all will require us to change our process. We have adapted jira to our exact process like I’m sure many teams have.
Re:US Cybercom says mass exploitation of Atlassian Confluenc... by mumblemumble on Monday September 06, 2021 @10:33AM (#28434041)
The thing about products that occupy the kind of niche that Jira does is, the people using the product are not the people making the purchasing decision. They rarely even talk to each other.

If you come to a venue like Hacker News, you'll mostly be getting opinions of the people who actually use the product. These opinions do not reflect the interests and priorities of the people who decide which product to buy.

Re:US Cybercom says mass exploitation of Atlassian Confluenc... by phreack on Monday September 06, 2021 @08:47AM (#28433143)
I wish I knew the answer as well. I believe many managers trained in the art of building software without knowing how to build software are too married to doing processes in a very specific way that's very tightly coupled to Jira, and feel safe and at home with the added complexity it provides, so they vouch for it. But that's just a theory from personal experience.
Re:US Cybercom says mass exploitation of Atlassian Confluenc... by marcinzm on Monday September 06, 2021 @09:06AM (#28433279)
Jira is as complex as you make it and you can't solve people issues with technology. So another solution won't solve your manager problem. That said, the UI is an abomination that will one day summon the elder gods to reap us all.
Re:US Cybercom says mass exploitation of Atlassian Confluenc... by cogman10 on Monday September 06, 2021 @09:11AM (#28433309)
Yeah, I've never seen the Jira code, but I've dealt with the API. It is VERY clear the software is a chaotic mess based on the API.
Re:US Cybercom says mass exploitation of Atlassian Confluenc... by Cederfjard on Monday September 06, 2021 @09:28AM (#28433432)
I mean, if the problem you have is that Jira lets you set up overly complex workflows, then a more limited solution that forces a simpler way of working could have a positive effect? I do agree that you don’t HAVE to make things more complicated than necessary in Jira, but obviously some do that anyway.
Re:US Cybercom says mass exploitation of Atlassian Confluenc... by marcinzm on Monday September 06, 2021 @12:11PM (#28435141)
If the manager wants a complex workflow then they will make one outside the project management software if needed. Except now you'll need to manually track everything as a developer.
Re:US Cybercom says mass exploitation of Atlassian Confluenc... by da39a3ee on Monday September 06, 2021 @09:53AM (#28433629)
Taking away configuration options from most Jira project managers I’ve come across would be a very helpful first step.
Re:US Cybercom says mass exploitation of Atlassian Confluenc... by marcinzm on Monday September 06, 2021 @12:16PM (#28435197)
Then they'll just have the same requirements outside the software and it'll be on the developers to manually track it. Then communicate it in hour long standup meetings or something. Or bother engineers every few hours to communicate them directly. Complex corporate processes predate Jira and exist in places where the only tracking is Excel documents.
Re:US Cybercom says mass exploitation of Atlassian Confluenc... by brundolf on Monday September 06, 2021 @02:13PM (#28436409)
I used Clubhouse at a past job and it was great. I can understand why companies may not be able to move off of Jira, but I can't understand why one would start using it in today's world.
Re:US Cybercom says mass exploitation of Atlassian Confluenc... by nickspicer1993 on Monday September 06, 2021 @09:27AM (#28433428)
I think it already has been disrupted but no company is going to switch task management software without a really good reason. But I can't imagine and fresh companies are choosing Jira over Clubhouse, Asana, Trello or what I hope to be my company at some point! https://tahsk.com
Re:US Cybercom says mass exploitation of Atlassian Confluenc... by edoceo on Monday September 06, 2021 @12:20PM (#28435243)
My new companies aren't. Gitlab is the new hotness
Re:US Cybercom says mass exploitation of Atlassian Confluenc... by nickspicer1993 on Monday September 06, 2021 @01:46PM (#28436152)
Yeah I've heard a lot of people using Gitlab as you don't need to mess around with any integration and it's all in one place which is really nice. I find actually managing the issues super lacking and frustrating personally though.
Re:US Cybercom says mass exploitation of Atlassian Confluenc... by thrwn_frthr_awy on Monday September 06, 2021 @10:40PM (#28440283)
fwiw Trello is owned by Atlassian.
Re:US Cybercom says mass exploitation of Atlassian Confluenc... by chousuke on Monday September 06, 2021 @10:44AM (#28434156)
The thing about Jira is that it provides much more than just tickets. It's really not even bad at what it does as far as user workflows go, it's just really easy to misconfigure due to lackluster administrative tooling.

I work with a Jira instance that has something like 20 years of history and over half a million tickets. Migrating just the tickets and their comments might be possible, but migrating all the other metadata and every service and automation we've integrated into the workflows (some of which we depend on to be able to work at all) would take months of work if a suitable alternative even exists in the first place.

If it were just tickets and some CI integrations, migrating away from Jira would be trivial, but that's not where all the value is.

Re:US Cybercom says mass exploitation of Atlassian Confluenc... by benhurmarcel on Monday September 06, 2021 @09:56AM (#28433649)
There aren’t that many if your requirements include on-prem and being flexible enough to not be only for software development using agile.