News for hackers. Stuff that matters.
Re:US Cybercom says mass exploitation of Atlassian Confluenc... by cogman10 on Monday September 06, 2021 @08:40AM (#28433108)
Atlassian products are vast, integrated, and support all the crazy draconian processes that every insane project manager wants to implement.

You can't easily dump Jira if you are using Jira, confluence, bitbucket, and whatever their CI/CD product is called (bamboo?)

Re:US Cybercom says mass exploitation of Atlassian Confluenc... by closeparen on Monday September 06, 2021 @05:14PM (#28438169)
Not just product managers. All kinds of enterprise processes decompose nicely into tickets. Arbitrary workflows, transitions, validations, custom fields, filters, and reports make it one of the most successful “no code” tools behind Excel, and then the REST API is comprehensive and well documented. At my company JIRA bots are compelling and cheap alternatives to new web UIs for internal tooling needs, surprisingly often.
Re:US Cybercom says mass exploitation of Atlassian Confluenc... by nerdponx on Monday September 06, 2021 @11:49AM (#28434876)
How many PMs actually use those features? In my organization, for example, I don't see any reason why we should prefer Atlassian over Taiga, other than familiarity and inertia.
Re:US Cybercom says mass exploitation of Atlassian Confluenc... by riffraff on Monday September 06, 2021 @01:41PM (#28436100)
There's a ton of things you can do in Jira, and different organizations use different things. It's like excel or word, in that sense.
Re:US Cybercom says mass exploitation of Atlassian Confluenc... by yourapostasy on Monday September 06, 2021 @03:27PM (#28437053)
> How many PMs actually use those features?

It isn't the set of features that makes them sticky. It is the 10% of features the lead PM can't live without, and the slightly-overlapping-but-different 10% of features the team PM's can't live without, and the slightly-overlapping-but-different 10% of features the developers can't live without, and the roll-up report features the leadership team can't live without... There has been some research into this phenomena [1]. I'm not aware of a handy term for the phenomena, would surely appreciate someone pointing me to it, and the industry recognizing it and building for it, though.

Internally in my head I call it "multiplexing feature sets". Though I never say that aloud and just give the long-winded explanation if I have to bring it up in meetings.

> ...I don't see any reason why we should prefer Atlassian over Taiga, other than familiarity and inertia.

In large-organization dynamics, never underestimate the familiarity and inertia factors. I regularly see vendors screw this up so badly. Account management teams of even large organization vendors (so they should be taking action upon this, but apparently are not) regularly have no clue what kind of massive red flag it takes to push their decade(s)-entrenched product from "man we wish this could be better" to "you really need to fix this, or we need to start looking elsewhere".

How do you tell when a customer is just kvetching and presenting empty threats, or is laying it on the line to you? Easy: the customer is happy to share with you specific details of how the product shortcomings/defects are impacting line of business processes and the business impact (ask for this under the cover of learning what the critical business impact is so your support teams can devise the most appropriate tactical technical solution for immediate partial/total relief), and is eager for live working sessions with the customer's engineers.

And understand this: rarely will a customer reveal they have switched away until it is practically finished. They want to maintain what little interim support quality they have left, until they can step off. If your account management practices engage "all hands on deck" priority support when you get wind of a competitor in the wheelhouse, then you've lost before you even started. That's why the reveal is always a shock to vendors, and always a done deal when it is shared.

The time to understand that your product and product support consumption experience for a particular set of customer needs is horribly broken is when you notice a customer requesting product support leadership engagement more than 2-3 times in a year. If you aren't tracking those engagement touch points, then I guarantee you are losing license sales. They just don't show up in the sales metrics.

[1] https://www.sciencedirect.com/science/article/pii/S187770581...

Re:US Cybercom says mass exploitation of Atlassian Confluenc... by sufyanadam on Tuesday September 07, 2021 @11:30AM (#28446031)
What are these features that PMs can't live without, that they don't get with an alternative such as, say, Pivotal Tracker?
Re:US Cybercom says mass exploitation of Atlassian Confluenc... by Aeolun on Tuesday September 07, 2021 @08:56AM (#28444139)
I think that the larger and more dystopian organisations cannot do better than Jira to fulfill their needs.
Re:US Cybercom says mass exploitation of Atlassian Confluenc... by pidminusone on Monday September 06, 2021 @02:48PM (#28436727)
GitLab has wikis, CI/CD and sprint / issue / project management features. We use it at $DAY_JOB and while not perfect it's a pretty great offering.
Re:US Cybercom says mass exploitation of Atlassian Confluenc... by nicoburns on Monday September 06, 2021 @08:55AM (#28433189)
Clubhouse (soon to be renamed Shortcut) covers the first two. Github covers the latter two. It's easier to switch than ever.
Re:US Cybercom says mass exploitation of Atlassian Confluenc... by hirako2000 on Monday September 06, 2021 @10:23AM (#28433938)
No it's not easy to switch. Engineeting Organisations have invested a lot in the Jira eco system, that includes custom workflows that are understood only by a few to be able to alter them, users are productive right now with jira and nobody wants them less productive even just for a while learning another task manager. Here again the integration effort to migrate would scare any leader who would be blame for the impact on so many teams deliverables. The effort is enormous and error prone to take all the data in there, move it elsewhere, rebuild the workflow and integration configuration, while keeping track of lack of feature parity to write down an explanation before everyone complains and pre empting their request to at least provide a work around what they used to be able to do with 3 clicks. Confluence slips right in because it integrates very well with jira. Just embed a confluence page into a task, and just mention a jira task within a confluence page and you get a seamless experience. Yes we could use another wiki , and a good one as confluence is a calamity. But convenience is what organisations are after. Perfect is the enemy of the good they will say. I don't have a love for atlassian products, but they tend to do their job very well compared to the majority of the competition. You will always find one product that compares, or even is superior but overall, their product works. So here we are.

If they get plagued by further security vulnerabilities then companies handling sensitive data will concede to migrate, but it won't be simple by any means.

If you believe changing people's habits is easier than ever, it's rather the opposite. Workers are less and less inclined to learn any other way . The alternative has to be order of magnitude better than what they are using, otherwise they will resist the change. The fact is atlassian provide good to great products overall.

Re:US Cybercom says mass exploitation of Atlassian Confluenc... by nicoburns on Monday September 06, 2021 @10:53AM (#28434255)
> "Just embed a confluence page into a task"

Except that confluence and JIRA are both so slow that you'll still be there 2 minutes later waiting for it to load. Perhaps not everybody's experience is so bad? I don't understand how anyone could consider these products convenient given how ridiculously slow they were.

We used to do refinement meetings over video call (I guess everyone is these days) inputting into JIRA, and we'd literally spend 3/4's of the call waiting for JIRA to catch up with the words I'd typed. There's bad engineering, and then there's making writing a sentence text box lag with times measures in seconds.

Re:US Cybercom says mass exploitation of Atlassian Confluenc... by nwatson on Monday September 06, 2021 @11:30AM (#28434660)
We use the cloud version, I've edited huge Confluence pages and it's typically very snappy. Jira likewise. Could be an under-resourced on-premise deployment?
Re:US Cybercom says mass exploitation of Atlassian Confluenc... by jhardy54 on Monday September 06, 2021 @12:45PM (#28435521)
I think they’re talking about the front-end, not the server. FWIW both Confluence and Jira are abysmally slow on my machine (new MBP) on the cloud version.
Re:US Cybercom says mass exploitation of Atlassian Confluenc... by wutwutwutwut on Monday September 06, 2021 @01:28PM (#28435961)
I use both Jira and Confluence (cloud version) on a 6 year old Dell laptop and have no performance issues.

Maybe I'm closer to their servers. Or you're using Safari.

Re:US Cybercom says mass exploitation of Atlassian Confluenc... by jhardy54 on Monday September 06, 2021 @06:43PM (#28438945)
Nope, I’m using Chrome / Firefox and it’s a common enough problem that Atlassian sluggishness has been a running joke on multiple teams I’ve been on.

Maybe I should measure it and post somewhere, I thought it was a well-known problem but maybe there’s something different about our setups.

Re:US Cybercom says mass exploitation of Atlassian Confluenc... by hirako2000 on Monday September 06, 2021 @08:25PM (#28439545)
I have seen on premise issues , infrastructure can be the problem, or config. Jira cloud can also be a problem,but nothing one can do about it other than sending a ticket. I think they know what they are doing wrong with certain "low value" subscriptions.
Re:US Cybercom says mass exploitation of Atlassian Confluenc... by cutemonster on Monday September 06, 2021 @10:52PM (#28440374)
Is Safari slow when using Jira?
Re:US Cybercom says mass exploitation of Atlassian Confluenc... by jdmichal on Tuesday September 07, 2021 @07:42AM (#28443501)
I use the cloud version also. While Jira doesn't have any issues, editing Confluence pages can be a right pain. It is constantly "losing my connection" and prevents editing until it's happy again. There's no connection issues present, unless they're at Atlassian's end.

Watching the network tab, all I see is a requests to `bayeux-sync1` endpoint that take 5 seconds or longer. There's always one of these requests hung when it enters this unresponsive mode. I suspect this is some part of the syncing system for multiple editors. Which, if true, makes it particularly hilarious to me that the entire point of this system would be to sync multiple edits, yet it won't let me keep editing while it's waiting...

Re:US Cybercom says mass exploitation of Atlassian Confluenc... by Cederfjard on Monday September 06, 2021 @09:23AM (#28433395)
> Clubhouse (soon to be renamed Shortcut) covers the first two.

Even taking the following into account?

>> Atlassian products are vast, integrated, and support all the crazy draconian processes that every insane project manager wants to implement.

Re:US Cybercom says mass exploitation of Atlassian Confluenc... by nicoburns on Monday September 06, 2021 @09:35AM (#28433491)
Well if your organisation wants crappy project management tools and processes then there's nothing to be done. But there are plenty of alternatives out there for those who seek them.
Re:US Cybercom says mass exploitation of Atlassian Confluenc... by kayodelycaon on Monday September 06, 2021 @10:06AM (#28433751)
There aren’t good integrated replacements. Any system that lacks a wysisyg interface for text is not a viable option. If copy and paste from Word doesn’t keep some of the formatting, forget it.

Our support board has customized forms. These forms create tickets that can seamlessly be moved to our scrum board once they are vetted. We use JQL to manage a lot of the boards we use. We have custom workflows for different ticket types. We use the comprehensive access controls to grant partial access to users based on custom roles.

None of this rigidly enforces our workflows (aside form access control). Instead, it streamlines sharing information across departments.

When it comes to a company wiki system, Confluence is extremely hard to beat. (I’ve use so many wiki systems. Dokuwiki is my goto.)

All of these systems use a single user account. We use single sign-on, but we don’t have a large IT department to manage the dozens of services we access every day.

Re:US Cybercom says mass exploitation of Atlassian Confluenc... by gurkendoktor on Monday September 06, 2021 @01:39PM (#28436076)
> There aren’t good integrated replacements

I think even that would be a good attack vector against Atlassian: For them, "integration" means adding links from one product to the other. If I were to pay for an integrated suite of tools, the least I would expect is that their bloody markup languages are consistent. But because Atlassian just buys random products and then doesn't seem to ever change a single thing about them, that's not going to happen.

Re:US Cybercom says mass exploitation of Atlassian Confluenc... by laurent92 on Monday September 06, 2021 @02:06PM (#28436362)
That’s false: Confluence went from Wikimarkup in 2008 to wysiwyg in 2010 (to big uproars); and they are uniformizing all their cloud products under the new ADF editor.
Re:US Cybercom says mass exploitation of Atlassian Confluenc... by gurkendoktor on Monday September 06, 2021 @02:46PM (#28436712)
Thanks, that's good to hear. A quick Google search makes it sound like it will finally be possible to use `backticks` for code everywhere.
Re:US Cybercom says mass exploitation of Atlassian Confluenc... by rtpg on Monday September 06, 2021 @09:53AM (#28433624)
It is actually possible to want bespoke tools to do certain things. And honestly? Confluence is slow, but at least it has all the features I could want and it works.

People are like”use the shiny thing” forgetting the existing thing has, you know, stuff I actually use.

Re:US Cybercom says mass exploitation of Atlassian Confluenc... by Cederfjard on Monday September 06, 2021 @10:05AM (#28433745)
Thanks, I got you. But you didn’t really address the point of the person you responded to, then, which was that part of why this space hasn’t been disrupted to a larger degree is that Atlassian products are entrenched in many companies, and that a lot of people do want that complexity (disagree with that as you or I might).
Re:US Cybercom says mass exploitation of Atlassian Confluenc... by gurkendoktor on Monday September 06, 2021 @01:45PM (#28436143)
> ... and that a lot of people do want that complexity (disagree with that as you or I might).

As much as I love to hate Atlassian, I feel like complaining about Atlassian is like techies complaining about management in general. Every single anecdote is both terrible and true, but it's not quite as easy as it seems to do it better.