It's insane to me how many "security conscious" companies use Slack purely out of convenience.<p>The fact is, it's an enormous, centralized application written in PHP (not <i>always</i> a bad thing, but certainly not a language that keeps you from shooting yourself in the foot), with a massive target painted on its back.<p>How is it acceptable to you to use a chat solution hosted by a third party? Why not use an alternative you can host yourselves? It's just a matter of time before there's a huge incident.
Umm... why do people always assume "hosting it yourself" is more secure and not less? Do you have Slack's security expertise and budget? In my experience when small to mid-size companies attempt to manage security themselves they do a passable job but are convinced they are doing an excellent job - until they get hacked.<p>Larger companies usually have the budget, tools and expertise. But even then there are lots big companies with mediocre security too.
Hosting shit yourself != more secure, and only someone with a highly naive view of their capabilities as an organization would make that assessment. Facebook is written in PHP too, but you don't see that being a huge secure vulnerability, do you?<p>Slack has an entire security organization dedicated exclusively to securing its stuff. My security team is focused on securing our operational systems.<p>Do you run your own bank? How could you outsource something so critical (literally all your money and financial details!) to a 3rd party who doesn't even let you audit their stuff?! It's just a matter of time before there's a huge incident.<p>Do you run your own electrical generation facility? How could you outsource something so critical to a 3rd party? I bet they don't even have an SLA!<p>etc. etc.
The usual answer is "the self-hosted options are worse to use and make people hate them". Mattermost is a prime example, it's really clunky and uncomfortable to use. I like Rocket Chat and have hosted an instance of it myself, but it's shot through with inconsistencies and annoyances that Slack just doesn't have.<p>The notion that self-hosted is more secure is curious, though. Slack's security team is almost <i>certainly</i> better than yours, for most--not all, but most--values of "yours". You might be the rare exception (I'm certainly not, and I build reasonably secure systems by habit, if only because I don't have the time or money to focus solely on <i>a chat service</i>), but I doubt it.
TLDR we chose Mattermost over Slack because of security. <a href="https://www.mattermost.com" rel="nofollow">https://www.mattermost.com</a><p>We recently evaluated many chat systems for a large tech consulting project that includes security needs.<p>Slack was the frontrunner because of ubiquity, ease of use, plentiful third-party integrations, openness to free areas, and helpful in-person meetings with the Slack staff.<p>We picked Slack for our informal connections with external developers for non-confidential discussions.<p>For our own teams' use, I really like Ryver. The security is better (IMHO), the team-oriented features are stronger, and the billing is much clearer. The Ryver team is fully open to discussions about how to grow the platform and improve the security.<p>Ultimately the security team chose self-hosted Mattermost. We liked the combination of intranet deployability, plus a ramp toward security compliance capabilities that we do need for a few projects.
The most successful software apps in the world are built with PHP. Facebook, Wikipedia, Slack, WordPress, Flickr, Yahoo. Users don't care about your tech.
It's not just the setup of a self-hosted solution, but maintenance, and otherwise. If you look at the enterprise space, bigger and bigger companies are becoming comfortable with cloud-hosting of services. Growth of companies like Okta demonstrate that shift. As far as it being acceptable, I think there are a few things to consider:<p>1. The Slack model is such that your staff could start using it without even getting permission from the top. This is the Slack strategy for sales. It comes into companies from the bottom, so companies are more responding to the fact that their employees are using it vs bringing it in from the top.<p>2. Yes there are risks with cloud products, but risk is a cost consideration so you look at cost impact to the company of a breach and you compare that to a self-hosted high maintenance solution. This is a much more difficult calculation and it really depends on the size of your company, the value of the information Slack will be holding, etc. It's also possible Slack could be seen as more secure because an internal system breach may not include a complete Slack hosted breach. It could be seen as data segregation and diversification.<p>3. Slack is not the only company that is making inroads here. Slack is known well in the tech industry, but less-so in other industries. Microsoft is a giant because Skype for Business is huge, and there's many others.
Well that's a loaded question... this could easily be rephrased as "How do your companies align the need for security with the use of cloud hosted services like Slack?"<p>But then again, that assumes an honest question and not an agenda...
You should assume that chat logs can become public at anytime, if you host it yourself or not. Don't put sensitive/embarrassing unencrypted information in chat or email. People forget this is still data at rest.
I have an analogy.<p>Why would a zebra have evolved to have black and white stripes? You could see a zebra from <i>miles</i> away due to how it stands out! Yet.. when it's in a <i>herd</i> of zebra, it's hard to pick any individual one out, and that's why the pattern works.<p>And so it goes with using services like Slack, Gmail, S3, etc. My account on its own may not be the most secure thing ever but it's hidden in such a large pool of data - much of it far more valuable than mine - that the safety of the herd becomes relevant.
Because they care about convenience as well, and that value outshines the elusive "lack of security". You'll probably end up with much less secure option if you try to host one yourself, unless you're really dedicated to the chat app, in which case you have your priorities wrong. You should be focused on your own product.
>> It's just a matter of time before there's a huge incident.<p>I suppose that's correct. When (or maybe if, but probably when) Slack gets breached/hacked/owned it's going to be <i>huge</i> because a <i>huge</i> number of people are going to lose something that they didn't want to lose.<p>When I'm self hosting something and that thing gets breached/hacked/owned it's going to be <i>huge</i> for <i>me</i> because I and/or my company are going to lose something that we didn't want to lose.<p>I don't believe I can keep my stuff much safer than the big guys, though the point about Slack having a massive target is a good one. Maybe that makes it less secure?<p>I really don't know what's better for us in the case.
I think the point is much "do I trust a third party service ?" not regarding the techs involved.<p>I read a story from a blogger [1] who was visiting an Airbus facility for an A350 presentation and when he came back in plane, his neighbor, an Airbus sensitive contractor, was editing internal documents on a Chromebook using google doc. Yep. No fear.<p>[1] <a href="https://korben.info/vous-proteger-de-lespionnage-industriel-cest-bien-vous-assurer-que-vos-partenaires-le-sont-aussi-cest-mieux.html" rel="nofollow">https://korben.info/vous-proteger-de-lespionnage-industriel-...</a>
It seems like Quip, the document service, should be a much bigger concern:<p>Based on their security practices document, they seem to store documents <i>unencrypted</i> on their servers. It's encrypted in transit, sure, but not in storage? I was shocked when I found out.<p><a href="https://help.salesforce.com/servlet/servlet.FileDownload?file=0150M000003kuXGQAY" rel="nofollow">https://help.salesforce.com/servlet/servlet.FileDownload?fil...</a><p>At least Slack encrypts data at rest <a href="https://slack.com/security" rel="nofollow">https://slack.com/security</a>
Have you tried Semaphor from SpiderOak? We provide a secure Slack alternative designed using our No Knowledge architecture--meaning that we (SpiderOak) know nothing about the encrypted data you store on our servers.
This approach allows a third party to host the data, making it way more convenient from an operations standpoint.
Slack provides convenience, but it severely lacks in security.
A selection of reasons I have heard.<p>- Because self hosted HipChat / IRC / XMPP / is not cool enough.<p>- Because we are all supposed to use Lync / Skype for Business, but it sucks on OSX / Linux / in general.<p>- Because we are a small team, and maintaining a chat server is too much for us.<p>- Because we don't know (or want to know) how Slack works.<p>- Because shiney, such giffy, such memes.<p>- Because its free.<p>- Because my software engineers don't know how to connect to IRC<p>There is varying levels of good and bad reasons in there. (personally I am still a irrsi / IRC person, but I fully acknowledge I am not in the majority anymore)