Hacker News Reader

Comment by p49k | Hacker News Reader

I'm really surprised that the most secretive tech company in the world uses a third party, non-encrypted, non-self-hosted app for internal communication.

View on HN

Why is the assumption that Apple will be able to secure an online messaging service better than a company whose entire purpose it is to do so?

It's not about just technical competency, but also about trust. Does Apple trust Slack to the degree that they're basically happy letting them in on all of their secrets? Currently the answer seems to be yes, which is somewhat surprising. Somehow Apple does not trust their own employees, but trusts unrelated third-party service providers.

Yes? Apple has thousands of vendors and suppliers, some of them their direct competitors (e.g. Samsung). A lot of them are in countries where Apple can't even enforce NDAs and protect their IP in fair courts. Trust is a fundamental aspect of doing business at that level.

Their most successful product by far, the iPhone, was built by teams where the hardware people had no idea what the software looked like, and the software people had no idea what the hardware looked like. That's how secretive Apple has historically been.

This is why it's surprising to read that they rely on the same 3rd party communications service many of us use daily.

Consider your keyboard. It could be uploading everything you type somehwere. Stealing all your passwords and secrets. But heres the thing, such surveillance could be detected. You could check for radio emissions. You could crack it open. You probabaly wont, but you might. And your vendor will keep this in mind.

When you upload all your data to someone else and hope they don't peek that doesn't apply anymore. If you have a hunch something is not right you can't do shit about it. And your vendor will keep this in mind.

non-self-hosted? how do you know? I have worked at 2 different FAANGs, and both use self hosted versions of Slack. Why? because most people prefer it over other internal tools. Is it secure, I dunno. Is it the best options? Probably not.

"By default, Slack encrypts data at rest and data in transit for all of our customers." https://slack.com/trust/security

It was clear to me on first read that the comment was referring to end-to-end encryption. It's 2021 - encryption schemes wherein somebody else has the keys are decreasingly relevant.

edit: Apparently Slack does indeed facilitate end-to-end encryption using a key management service, as described by the reply to my comment below.

Slack has enterprise key management (EKM) where the owner of the account controls the keys.

https://slack.com/enterprise-key-management

Ahh, I hadn't heard of this!

Agreed. I worked at one of the major US banks and they would never allow the use of slack.

Reply on news.ycombinator.com