Hacker News Reader

Comment by muglug | Hacker News Reader

I work for Slack, opinions my own.

As far as I can tell, Slack's not trying to hide this news.

Slack communicated about the breach here: https://slack.com/blog/news/slack-security-update

There is no `noindex` tag on that page (check the source).

There is a `noindex` tag on an alternate "en-gb" version of that page: https://slack.com/intl/en-gb/blog/news/slack-security-update

This is to be expected — it's presumably SEO equivalent to specifying a canonical URL.

View on HN

Very doubtful on SEO and/or alternate content. BleepingComputer also notes the August 2022 notice, which is 'noindex' on all versions.

This is most definitely to burry the notices.

Slack communicated the incident on the 31st of December. That day is typically used by politicians to bury bad news, as attention to news is quite low on that day. It might be coincidental, however, the little cynic voice in me is left wondering.

They detected the incident on the 29th of December. I kinda think that regardless of what day they disclosed, from that day to today, people would find various reasons to complain- "to soon to know what happened", "the day before New Years", "the day after New Years", and "too long after the event". In snark I will suggest that's a pessimist voice you're hearing- the cynic in me wonders if there's any time to disclose that won't receive a complaint.

Slack probably has a lot of large - and very demanding - enterprise clients who absolutely require their non-trivial service suppliers to have infosec policies with a maximum of 72-hour notification window for security breaches. And I can guarantee that no company wants to have client-specific notification window policies in place. That way lies road to madness, missed commitments and nasty litigation.

It's a good practice, in all honesty. The time window is for the initial notification, after that there will be subsequent notifications when actual investigations complete.

That's not the standard SEO way of flagging a canonical URL.

Who defines this standard?

You may argue it's not common, but I'd expect a standard to be determined by an authoritative and fairly representative body. Not by HN forum or a private company in isolation.

Sure - there's an RFC - https://www.rfc-editor.org/rfc/rfc6596

Technically the parent’s point still stands - this is an informational RFC, not a standard.

It's also documented in Section 4.6.7 of WHATWG's HTML 5 standard if that makes you happier - https://html.spec.whatwg.org/multipage/links.html#linkTypes

Doesn’t really make me happier or unhappier, was merely making a point that RFCs come in different flavors, only one of which is a “standard” [1]. Not sure why it touched a nerve with so many people.

1. https://www.ietf.org/standards/rfcs/

In practice, all RFCs are standards documents.

There are no standards here - the world of SEO is a weird place of guesswork and testing what works. I think the Google recommendation [1] is still to use rel=canonical however who knows why this noindex is added to alternative duplicate pages - it might be that the SEO person at Slack knows what they are doing.

I think the accusation of foul play is somewhat overblown given there is a version that does not contain noindex.

[1] https://developers.google.com/search/docs/crawling-indexing/...

Forget about all that; you can just check Google to see if the page is indexed. It is.

Using this query:

site:slack.com inurl:/blog/news/slack-security-update

https://www.google.com/search?q=site%3Aslack.com+inurl%3A%2F...

There explicitly is a standard here, which is used by Google, Yahoo and Bing - see appendix A of RFC 6596.

I understand that, but what I’m saying is that SEO itself is often based on what actually works. This noindex of non canonical resources is likely to be that not an attempt to hide things from Google.

That article is NOT listed on news site https://slack.com/intl/en-gb/blog/news Yes, your direct link works, but the article is not listed.

https://slack.com/blog/news

Not gonna guess why, but if you play with the region in the footer:

English (US): it's listed

English (UK): not listed

English (India): not listed

Reply on news.ycombinator.com