Photo by Austin Distel on Unsplash
Slack backtracks on a new direct message feature that someone could potentially abuse. The company will no longer let paid users email customized direct messages alongside an invite for someone to chat on the platform. The concern is that someone could use it to send abusive or nasty language to someone else through email notifications.
While you can block abusers' emails on your email client, these invites are forwarded by Slack using the feedback@slack.com address. That means you can't filter out the messages because you might miss important notifications.
Slack initially envisioned Connect DMs as a way for people from different organizations to connect as long as they had their email addresses.
Twitter employee Menotti Minutillo first raised the concern about how this feature can be potentially abused.
well that was easy as shit to abuse
— Menotti Minutillo (@44) March 24, 2021
- send invite with nasty language
- slack emails you w/ the full content of the invite
- can't block the emails because they come from a generic slack address that informs you of invites
- abuser can keep inviting w/ abusive language https://t.co/Mw9W5L251a pic.twitter.com/dWEAD7ccRO
The company released a statement from Jonathan Prince, its vice president of communications and policy, through The Verge:
"After rolling out Slack Connect DMs this morning, we received valuable feedback from our users about how email invitations to use the feature could potentially be used to send abusive or harassing messages. We are taking immediate steps to prevent this kind of abuse, beginning today with the removal of the ability to customize a message when a user invites someone to Slack Connect DMs. Slack Connect's security features and robust administrative controls are a core part of its value both for individual users and their organizations. We made a mistake in this initial roll-out that is inconsistent with our goals for the product and the typical experience of Slack Connect usage. As always, we are grateful to everyone who spoke up, and we are committed to fixing this issue."
Source: Engadget