#slackbots

Build Your Own Custom SlackBot with Node.js

This text was peer reviewed by Dan Prince and Matthew Wilkin. Because of all of Pre Alpha Technology’s peer reviewers for making Pre Alpha Technology content material the perfect it may be!

Slack has a sure attraction and large fan following in each developer and non-developer tech communities. Its slick consumer-interface, idea of groups and channels to maintain communication separate and…

By sharing their Slackbot’s code, developers made it possible for the public to gain internal access to their company’s documents and conversations.

  Developers at major businesses who build apps for the instant-messaging platform Slack have unwittingly exposed key information like chat logs, direct messages, and passwords by recklessly sharing their programs in public.

The affected businesses include a major auditing firm, payments companies, a global advertising agency, and healthcare providers, according to research by Detectify, a security company that discovered the problem.

Developers have been including authentication devices called tokens, used to build Slack apps such as chat bots, when they publish their programs on GitHub, a popular code-sharing platform. “Using the tokens it’s possible to eavesdrop on a company. Outsiders can easily gain access to internal chat conversations, shared files, direct messages and even passwords to other services if these have been shared on Slack,” Detectify wrote in a blog post explaining the vulnerability ...

To make it easy for developers to build bots and other apps, Slack, like other popular platforms, issues them with a tool called tokens so that it can identify and authenticate a particular bot or app. These tokens just look like a string of letters and numerals, like:

xoxp-746925472-2946592639562856439 xoxb-123456789-123456789-123456789-123456

These tokens should be kept private, but developers sometimes skip a crucial step in securing them when they share their code in public. Instead of writing the actual tokens in their code, developers should hide those credentials behind an “environment variable,” which allows them to share the code without exposing any sensitive data.

It turns out that lots of developers building Slack apps didn’t do that. Searching for a Slack token by its prefix on GitHub immediately yielded a half dozen examples. That’s exactly what Detectify did, and it found 1,500 tokens on the platform ... 

But it’s not simply about careless programmers, says Rickard Carlsson, Detectify’s chief executive. He says that Slack gives tokens a relatively high default level of access, meaning that developers probably didn’t realize just how much data could be extracted from their malicious use. “If you create a small funny bot, you don’t expect that someone can then scrape your credentials and use them to hack your accounts. It’s an awareness problem,” he said.

Maluuba, a startup that makes AI software, shows how its Slackbot answers questions pertaining to Game of Thrones.

  Maluuba, a Canadian startup, posted a YouTube video on Friday showing its artificial-intelligence software reading the synopsis for the fifth season of “Game of Thrones’” and immediately knowing all of the show’s plot lines. It’s the equivalent to a human, let’s call him “John” for this example, who knows nothing about the show, has never seen it, takes one look at a Wikipedia page and instantaneously knows everything that’s happening.

“Who stabbed Jon Snow?” the Maluuba engineer asks the AI software. “Night’s Watch,” the software answers, not long after first being introduced to the HBO hit show. Ask Siri the same thing on your iPhone and she’ll either tell you she has no idea what you’re talking about or point you to a list of Bing search results.

For the fields of machine learning and artificial intelligence, this is a major breakthrough. Maluuba could soon make many of your smart devices more useful. For example, this type of technology could one day help humans sift through documents quickly to find the small bits of buried information they need by simply typing a question in conversational English.

Not sure who trained Arya Stark in season 5? Just ask the Maluuba bot. Having trouble setting up your new sound system so you can hear every gory sword stab in Game of Thrones perfectly? Feed the owner’s manual into the AI and ask it your specific question. Curious if George R. R. Martin will ever finish writing the last Game of Thrones book? Just kidding — not even artificial intelligence can help us solve that mystery ...

Maluuba makes the artificial intelligence software used by numerous products around the world, including Siri-like voice assistants on some phones and smart home products. The company began working on this project six months ago, starting by feeding children’s books to its bot and asking it multiple choice questions. The “Game Of Thrones” demo shows the bot can now process larger chunks of text and answer more difficult, open-ended queries.

The theory is that teaching AI how to read documents and learn concepts the same way that humans do will ultimately yield AI-powered products that are more useful than the ones we have today.