Slack Security Incident
Let's ignore the rather awkward self promotion, and the fact that 2FA would have prevented this specific incident.This is the important part, which everyone should think about:> What would have been way worse — immeasurably worse — is if our team had used Slack for anything other than what we did use it for, which was discussing outages of our own product. Had my cofounder and I discussed our company's cap table, or business partnerships, or compensation agreements, or ongoing legal matters over Slack; or had our team traded API keys, or security-sensitive matters; or had we controlled mission-critical infrastructure via Slack-powered "bots"; we'd be sweating bullets to this day that our important company secrets were out in the open, about to resurface at the worst possible time.I see Slack being used for everything at a lot of companies.There are a lot of interesting things in the chat history everywhere: SSH/API keys, logins and passwords, sensitive internal documents, chatops bots that would let one take control of the infrastructure, and worst of all - juicy office affair gossip.Combine this with often lax user management (forgetting to disable old accounts, inviting people to channels they shouldn't be in, ...).Most companies overlook this and don't even have a policy for what's OK to post on Slack, and what isn't. Not even to dream of any kind of enforcement.I'ts a big security problem, even without Slack getting compromised, and should be on the radar for CTOs.