Slack raises $200M at $3.8B valuation for business messaging
techcrunch.com
techcrunch.com
Slack is the only SaaS that has access to, and STORES PERMANENTLY, every important private message, group message, document, commit, internal URLs, .... of your company.
At some point in the future, slack will get hacked. Every sufficiently popular product does. It's only a matter of time. And when it does, the data hosted by slack will be an absolute treasure trove for competitive intelligence, "insider" trading, hacking, and a variety of other bad, bad things.
Not to mention, an arbitrary number of employees at slack can read the internal communications of any company using their product. I'm sure slack has some "security" measures in place to prevent this, but it would only take one rogue employee with the keys to the kingdom to snoop on any data imaginable. This seems incredibly dangerous to me...
I'm not a Slack shill, have never used the product, don't know anyone who works for the company.
But.
Has Facebook ever been hacked to this degree? Has Google ever been hacked to this degree? Has any sufficiently popular social-media/enterprise-knowledge-sharing app been hacked to this degree?
What makes you so completely certain that they will be hacked and that a 'treasure trove' will be available to the supposed hackers?
Seems like unwarranted FUD tbh.
Instagram could have been: http://exfiltrated.com/research-Instagram-RCE.php.
And we don't know how linked instagram and FB are. Is the instagram app signed by facebook? etc.
Yes, security researchers have reached FB servers in the past few months.
> Has Google ever been hacked to this degree?
Yes, by Mainland Chinese agents a few years ago.
I know of similarly large networks that are currently owned.
And almost everybody has an IPMI problem, whether they realize it or not yet.
(Silicon Valley engineer here.)
[1] https://en.wikipedia.org/wiki/Intelligent_Platform_Managemen...
Let's say you have a server, reachable on a certain network address on a LAN.
I can turn on AMT, I can set up server management answerable at the SAME address. network traffic to and from the machine and network is undisturbed.
I can install bios updates, configure aspects of the machine, all kinds of things, just with AMT. I have read in some cases you can configure the machine this way even if its powered off.
How does that affect your everyday company, with orders of magnitude less competence/intelligence per capita....?
My question is this; what company that uses Slack has good enough opsec that Slack is the vuln to be exploited.
Please name one company where Slack could even potentially be the easiest point of entry.
Easiest point of entry? No. Single point of entry? Yes.
That said, I think any hacker would die of boredom reading my company's Slack channels before they hit any nugget of interesting information!
Again and again, the issue is not the encryption algos, it's the bits between the keyboard and chair. People are stupid.
There are very few holdouts that have no privileged corporate information in one SaaS or another - SFDC, github for enterprise, Workday, netsuite, etc...
[1] https://www.washingtonpost.com/world/national-security/nsa-i...
Slack got hacked last year: http://techcrunch.com/2015/03/27/slack-got-hacked/
You're also exposing yourself to a lawsuit.
If it was worth digging through actual trash, I'm sure an electronic dump would be more highly valued.
Isn’t Gmail in roughly the same spot?
Edit: Never mind, others have already mentioned a couple, down the comments - for example, http://www.mattermost.org/
But what if you do need to collaborate on pieces constantly? Bouncing emails back and forth isn't the best. If you don't have an office environment that's conducive to collaborating like that, slack is also a boon here. Doubly so if members of the team are distributed. What if you've got issues with your email where there's a ton of it, and 90% of it is only mildly important? If lots of the people sending out that email instead just sent chats to a channel that you turn off notifications for, you won't see notifications for it and your inbox is cleaner.
Of course it can be disastrous, with channels turning into nothing but a bunch of GIF sharing and other stupid shit. The onus is on the team to keep work channels clean and focused, and have appropriate channels for goofy stuff that people will naturally tend to participate in.
Note that I'm not saying whether or not this ultimately allows work to happen more efficiently. I honestly can't tell if using Slack makes things easier in the long run, but I certainly prefer using it over email if I can.
Seems to work just fine for the linux kernel.
It's a lot better than someone coming over to your desk and poking you.
My policy is that if the email is going to be less than two paragraphs, it's better to send it as a Slack message (or IRC or whatever your team uses). But if you need to elaborate on an idea, or bring someone up to speed on something, then write an email, and make sure it's exhaustive.
I get its uses, but I rarely see those in practice.
We're using Mattermost here and pretty happy with it, it's got missing areas but it does let you self-host pretty easily.
I think most of the perceived hype is generated by Slack itself and its SV valleys. I doubt that more than a handful of Fortune 500 companies even allow its usage.
http://www.businessinsider.com/slack-flaw-lets-you-see-other...
There are a number of high profile companies that have gotten hacked as well, some of which had REAL damage done as a result.
Running On-Prem is no safeguard for hacks, and you are trading one set of vulnerabilities for another set.
Following that same line of reasoning, services like AWS shouldn't be used either, as they also provide a new threat vector for attacks.
////
This is from Mattermost's web site:
> Mattermost is written in Golang and React and runs as a single Linux binary with either MySQL or Postgres.
For an on prem solution, you've now taken on the responsibility for maintaining at least a few linux machines. Including patching, hardware failure etc. Next comes the database, including performance tuning, security configuration and patching. Finally when updates to Mattermost software itself, ensuring you stay up to date with that.
If Messaging is somewhat critical, you'll need to ensure you have fail-over/fault tolerance in your architecture.
You'll also want to make sure when you patch, you do a rolling patch, so you don't accidently break messaging.
Plus you'll want to backup your message data and run through DR protocols.
This will be in addition to maintaining all the other corporate IT internal systems a company may use.
Think about it this way: Slack's entire business revolves around secure company communication. That's just a blip on High Profile Co's list of priorities.
Slack maintains a bug bounty program. What's the likelihood that High Profile Co is doing the same for their messaging app?
I think the parent poster's point is, concentrating all of these user accounts into one location makes it a more enticing target. Robbing a bank is more enticing than robbing a liquor store. To strech the analogy a bit, and support your point, Banks are better at securing the money.
So, to be explicit, in house maybe not as secure as slack, but the possible rewards are just your company's value. If 1000 companies are all in the slack pool, slack ought to be 1000 times better than a single company alone. Because the reward for a hack is so outsized.
* There's no API to set retention settings or defaults
* There's no API to audit retention settings for private channels
* Non-admin users can change retention settings for DMs and private rooms
* There's no way to enforce that private rooms and DMs get a maximum retention setting
https://spideroak.com/articles/press-release-semaphor-to-giv...
This made me laugh: "Semaphor is not slack about privacy."
At the end of the day the vendor's priorities were aligned with ours, they want to sell hosted mail/docs/etc service and having people with bad experience (even one) really limits them. So I think Slack would also be similarly aligned with maintaining their security and the security of their clients for exactly similar reasons.
The issue that Schneir pointed out about protecting your data when you're SaaS provider goes chapter 7 on you, that one is still real. And while there are people with cash hoards who could do it, I've yet to see someone spend money to buy a SaaS company so that they could get access to the data of a competitor. Although to be honest I did wonder a bit about Yammer. Killing a potential competitor (Whatsup, Instagram) sure, but actual industrial espionage would seem to be an unlikely outcome. (Would make for a fun story though, if you're reading Charlie :-)
Targeted towards international NGOs operating in rough areas, but works for other business too.
Not free though. Seems security comes at a premium.
I don't think this problem isn't solvable. Public crypto could help alleviate some of the pain. For instance, what you say holds true for most Google services (Gmail, search data, hangouts, data from Android), Github (private repos), Amazon (credit card data, purchase data), Uber/Lyft (travel data) or basically any popular WWW service with wide enough adoption. Nothing peculiar to Slack.
I wonder if the concerns you raised could be done away with if they started using crypto similar to ones used by Telegram or say, Signal by Open Whisper Systems.
Re: Data Retention: Slack could provide a TTL field and that would help solve that.
Gmail (at least free Gmail for individuals) won't have end-to-end encryption because their business model is to scan your email and serve you relevant ads.
But Slack, I don't see why not. I would like to try Slack on my team, but sending all of our unencrypted internal communications to a third-party is a bad idea. even if nothing bad happens, it's a bad idea.
They have taken a great business and is pumping it up way beyond it's natural growth trajectory and is ignoring what I consider the most important advice for 99% of businesses": Be patient for growth not for profit as Clayton Christensen is saying.
I was sceptical, but Quip's combination of chat and group-editable documents feels actually much better for dev teams than Slack, which ends up very unstructured.
(I have no association with Quip at all, but recently had the chance to use it in a Slack-like context.)
Quip has chatrooms that work like Slack (or IRC, or any other group chat in the history of the Internet).
So what's the different use case?
(I don't see Quip having such an advantage -- although Quip seems like a perfect fit for Microsoft's product portfolio... Hmm...)
Positioning can definitely hurt a product.
Quip is the Evernote killer.
That said, this was a year ago, maybe it's better now?
Like you said, we are willing to pay, but for about $7 per user we aren't getting much more than the free plan...
We are an entirely remote company, and we found that videochat during our standups really helps. Currently we are paying $5 a month per user for Google apps and only using a very small portion of it (basically just the video chatting), and they allow up to 25 people which is perfect for us.
we routinely have meetings with 15-30 people and we use Sococo[1] for all our audio and video. The office layout is also really nice. Everything else we've tried for video hasn't cut it, in comparison.
Note that Sococo will try to push you to their new browser based product. Last time we tried it, it was far worse than the 'classic' version we still use. But they don't really show 'classic' on their website anymore.
That sounds horrible.
You get the occasional feedback screech or something, but for the most part we aren't animals and we all know how to mute our mic's. And the added benefit of a face means you can get more body-language which helps prevent the "talking over" that happens on conference calls.
Plus the way we have it setup now we can all "mute" one another, so if someone is causing an issue and doesn't know it (or stepped away for a second) we can instantly mute them and move on.
https://blog.discordapp.com/upcoming-feature-preview-friends...
One of my biggest complaints is the lack of easy to manage private channels. There's a super complex and powerful permissions system quite obviously based on mumble, but if I want to make a quick private channel to talk to two people, it's easier to make a whole new server than just another channel.
In comparison to a free plan sure but in what real business is $7/user/mo too expensive for anything? That's less than an hour's minimum wage[1].
[1]: Technically it's quite a bit less as min wage in the U.S. is $7.25 and that doesn't include corporate payroll tax or medicare/social-security matching
The whole Open Source community? Volunteer driven, donation funded projects? Non-Profit charities, mostly composed out of volunteers?
None of those are businesses. Maybe I should have clarified but I meant a business as one where employees work for an organization that derives value from their work (say $A), the organization pays the employees some form of compensation ($B), and the expectation is that the value derived by each employee is more than the compensation (i.e $A > $B).
In that model I don't see many places where ($A - $B) < $7.
But they still require history, easy to use chat systems, easy integration into Dev systems, etc.
That's what was better about IRC: you can self-host and get all of slacks features for very cheap.
Not everyone is KDE e.V.
The network effect leads to lots of open source projects having to choose slack – which, in turn, means they end up having to pay, without having revenue.
I never see the slack app in my top battery users; I saw the hipchat app in the top battery users all the time before I uninstalled the app. I don't leaving it running for work, but not at the expense of 10-15% of my battery.
It could be similar to people complaining that Reddit or Imgur is down or unstable, but that mostly happens to Americans. So Europeans get the benefit of an overbuilt infrastructure, because the companies try to scale to the load generated by Americans.
Trying out their hosted Jira solution recently felt quite a bit like a throwback to the 90s.
I'm not going to trust them again, sorry.
(We ended up using Youtrack instead. A lot faster, a lot cheaper, but less flexible.)
I don't find our self-hosted Jira slow or a throwback to the 90s. It also cost $10. But these things are opinions. :)
Recently hipchat released a major UI rewrite, and now there's no way to turn off autocorrect. It's almost useless for developers discussing code, if every technical term you type gets replaced with the first non-technical word that is "close enough."
(Happy April 1st!)
I generally avoid Reddit these days, except occasionally dipping into the VR sub-reddits. The level of stupidity, entitlement, and general melodrama is ludicrous.
It's like when you're subjected to the nonsense of a person who's become accustomed to being the smartest person in a dumb room.
HN is just a smarter room. Like Reddit 10 years ago. We should defend that.
(I just lament a slight lack of light-heartedness!)
I think that's the point of the question?
Not that this is a dig against you or Asana; it's just that this is how the world works.
However, great products are worth paying for. If/when they start to charge or you exceed the free tiers' limits, you'll have to make difficult choices based on what they're worth to your business.
Slack's clients also have persistence, as in shows the most recent history of communication.
Not everyone uses screen/tmux with irc (though they should).
That said, if all you need is simple team communication, IRC works great
No.
Is investing at Slack today at a 3.8B valuation a good investment? Maybe, maybe not. But it doesn't seem crazy to me. That's all I'm saying. They already make a lot of money, they're growing fast, and they're in a potentially very large market.
Only time will tell how far they get.
They're in a shrinking market. It's not like they "discovered" chat. They slapped a good interface over IRC and centralized everything on their servers. Everyone and their dog is now writing chat apps, including existing big enterprise companies. So while slack got a large initial boost from developer-driven teams, other companies with existing large userbases are now catching up (and fast).
Slack is one part decent app five parts hype. It's not worth anywhere near 3.8B, and it now has immense shoes to fill because it apparently thinks it's worth that much.
For comparison: Atlassian is estimating $440+ revenue for their fiscal year, and has a market cap of $5.5B.
You 'raised' 200M.
Microsoft/Google are heavily invested on large enterprises. These big giants can pull off a product like Slack and sell to all the big clients. Microsoft already sells communicator to large corps. They can switch that to Microsoft-Slack version and bundle it with their office products taking the large (90% revenue) out of Slack pocket.
Slack has to go really big to hit enterprises hard or they will be just serving small medium businesses which will have churn burn and less LTV.
One nice thing about slack is that writing these integrations are very, very simple.
I think Slack is on its way to really challenging apps like skype and gotomeeting for the enterprise use-cases.
Edit: downvoters, where am I wrong?
I guess if OP believes slack IS substantially different from irc, then nevermind, but that should be their call to make.
Yes, that's where slack comes in. Except, instead of "install some software" you just "create an account" and log in and. Oh, that's it. Create a room, invite friends, or whatever. Post, DM people, scroll back, add rss feeds etc. It all just works. Nice android app too.
Not that i'm trying to sell slack; i can take it or leave it. I'm sure there are alternatives to that. But I have literally no idea why in 2016 anyone would want to subject themselves to irc (plus whatever other crap you have to install/configure to make it bearable).
Although I'm not trying to discount what you want for chat... Everything you just desribed is super easy for me to do with IRC. I can customize it to look however I want, and just connect with the protocol. That's why I "subject myself to irc". All the commands you have trouble remembering, are customizeable, and muscle-memory for me.
> Now I can use a browser.
hmmm... that sounds like the opposite of what I want. To each their own I guess.
> Not that i'm trying to sell slack
Not at all. I asked for a comparison, and that's what you provided. I guess I just don't have any personal interest in it over IRC. Cheers!
There are plenty of old school ways to share/synchronise files among a group of people. You could run an FTP server and a bunch of automated scripts etc. Or you can just install Dropbox for your non-technically minded users and it just works. The interface is nice and mobile app support is great. Slack is similar in that regard.
1. Send messages to people that are offline. 2. Easily see unread messages in a channel. 3. Markdown formatting. 4. @everyone/@channel notifications (not to be abused). 5. Simple Github integration (and other apps). 6. Mobile notifications (in fact, just the overall state of "mobile")
I'm sure every single one of these could be added to irc via bot or something like that. The beauty of slack is that I can set up a slack team and do all of the above without having to really muck around with that. Much lower operational overhead.
I love IRC, but the features don't compare. You might be able to implement some/most/all of the missing features, but they're not available out of the box.
Presumably this was part of the pitch (build on-premise version, hire the good salespeople from MS and Oracle, profit).
It makes no sense.
Is that that insane for a successful startup? I think that comes out at 2.4%/week which is a bit lower than YC tends to aim for.
It says they're at 2.7M active users, which they frame as a lot for an enterprise app, so that probably means 10-100K companies - that seems huge for a company growing 3.5X user growth.
That said, if I had the money and was invited to participate in this round I would have. More so than any other software I have seen, Slack has organic buy-in from everybody outside I.T. Once introduced is spreads like wildfire throughout any company I have heard about. Unlike much (most) software introduced to them Slack has an easy to see value for them, has almost no setup barriers, and is usable with little to no training.
All of the objections in this discussion are from an I.T. perspective ("you can just use self-hosted IRC for free") or a compliance perspective (having worked many years in the financial services industry I understand that there are compliance requirements but those are always written by lawyers and often their understanding of the security tradeoffs between self-hosted, with company employed security professionals, and the cloud, with vendor employed security professionals, are dubious at best).
I sometimes feel that programmers would write Excel from scratch in order to add two plus two.
But it's also the fact that while it's easy to get started, the value and dependence on Slack increases rapidly by your team's investment in using it.
Slack takes no time at all to do an initial team setup so you can just get started and as mentioned nothing needs to be learned to dive right in. Users are rewarded for discovering new things and further rewarded by cool points for sharing the tricks and secrets they uncover with others.
The ability to search and find a file or a key part of a conversation that happened a year ago faster than you could an email. This feature only gets better the more your conversations happen in Slack — you'll never lose anything again.
In terms of features, many of the best customizations involve apps working with Slackbot and Zapier. Setting up these custom features takes time and tweaking to get them exactly perfect — switching costs you won't want to deal with a year from now once they've become part of your routine.
It's highly unlikely we'll ever see an on-prem Slack.