Join the discussion
Write your take first — we'll ask for email only when you're ready to publish.
- Hacker News
- Atlassian has gone from a trusted enterprise-partner to a complete shit-show in just 18 months. This surprises nobody. There will be classes taught in how to fuck up a good business and Atlassian will be the prime example.
Regards, /someone who migrated 3500 users from Atlassians products recently due to their "cloud only"-bullshit.
by khanan - I can't remember a time in which Atlassian was trusted.by gherkinnn
- Any recommendations for alternatives for just Confluence and JIRA?
I've been looking at switching to Notion and Linear, but just haven't had the time to complete evaluation.
by kevcampb - if you track their 5 year stock price you'll find the market fully agrees with you. It was $458 in 2021 and is $112 now.
The market caught on quickly that Atlassian's software fits into the group of software like Oracle or SAP that no one uses by choice and only uses because it was forced on them.
by chollida1 - I started to consider it a show show way earlier than 18 months ago. Jira is so terrible to use that it is hard to phantom how they are able to be paid for their productby gbalduzzi
- You'd have to look at their profit numbers. They have a huge captive base of customers, like Adobe it might take decades for things to get bad enough and alternatives to arise before their profitability is impacted. And the executives who benefit will have cashed out long before then.by yborg
- At the risk of sounding like the hipster who liked your favorite band first, I didn't trust Atlassian long before the last 18 months. Much like Microsoft Word, I think JIRA peaked about a decade after launch and since then it's mostly been unnecessary UI changes and features I either don't care about or actively do not want.
P.S. I protest their software's revisionist autocorrection to Jira. It was JIRA when I started using it and forevermore it shall be.
by tomwheeler - To be fair to Atlassian - their products did suck quite a bit before 18 months ago as well. Just now they still do, but with ai!by git-nebulous
- They were not trustworthy years ago already. Using Atlassian products, one has had to look out for disastrous announcements about their customer data usage way before 18 months ago, especially, if running a business inside the EU, and at least trying to adhere to data protection laws.by zelphirkalt
- It's nice they force rovo now for document/version diff's. Because you need to burn down the rainforest for those. (sarcasm ... for obvious reasons)by consp
- Related: A few days ago, Jira opted everyone in by default to "Contribute in-app data to improve Atlassian apps for everyone"by hughw
- > Rovo's URL retrieval tool is insecure: there are no protections against opening a URL that has been dynamically created by the agent. Here, Rovo is manipulated to append sensitive data to an attacker's URL. When Rovo calls the insecure tool to open the URL, the attacker's site logs the request, including the appended sensitive data.
- I find it difficult to be impressed by "prompt injection" attacks that require the victim to enter the malicious prompt themselves --- like, really? If you tell Rovo to exfiltrate your data, it'll do it?
Obviously, there should be URL protection rules to control what it can access, but this requires a very specific and unlikely set of circumstances to exploit.
by ohaodha - Are people so obsessed with AI that they can't find it reasonable that it won't do obviously bad things if asked? Not even with a confirmation or warning? We trust AI to literally build products and fix our most critical bugs, but we can't expect it to tell when it's being asked to do something malicious? Imagine if we felt this way about QA when trying DROP TABLES; in search bars. "Oh, well of course it broke the database, the user asked it to!"by strunz
- It's more interesting if I attach a file to a JIRA ticket that we both have access to and via some query you send to the AI (that returns my malicious ticket) it causes data exfiltration of tickets that you have access to but I do not have access to. I think that's more compelling as an example than the one they provide.by kevsim
- > Note: This attack succeeds even if an organization has disabled web search for Rovo. This is because the web search setting fails to remove the tool for opening the search results.
Wow, great work Atlassian. The web search setting does not disable web search.
by mvdtnz - Rovo is funny. It downloads everything it can do Atlassian servers for "analysis". And you're pretty much screwed if you link it to Google Docs or Sharepoint. How do I know this? "Why is an AWS IP downloading all our docs?" question I got about a month ago.
- > The victim uploads a file to Rovo that contains a hidden prompt injection
Yeah this attack is possible on all modern agentic systems.
* Access to your private data
* Exposure to untrusted content
* The ability to externally communicate in a way that could be used to steal your data
(https://simonw.substack.com/p/the-lethal-trifecta-for-ai-age...)
And blocking it wholesale reduces usefulness of the agent so it is a tradeoff.
by hahahaa - It's been over a year and the trifecta holds true. The term 'prompt injection' has been round since May 2022 [0]. No amount of "but the future will fix it" has fixed it.
These breaches will continue for as long as nobody cares about security and everybody is infected with the LLM brainworm.
by gherkinnn - ~every ai vulnerability write up boils down to "just ask it do to the thing", but with fancier terms like "indirect prompt injection".
- I can’t get over how bad “Rovo” is. Somehow more aggressive and useless than Microsoft putting “Copilot” everywhere.
It’s objectively worse than using something like Cowork + MCP, AND they injected it into every single page on JIRA and Confluent which has made web browsing way slower while all the junk is loading.
by pram - I hate it, they've just gone and smooshed a bunch more AI crap into Jira too in the last few days.
Useless buttons to "suggest subtasks" and "improve issue" and offer to write the description. Absolutely useless nonsense, I wish I could turn it all off and there is an issue on their bug tracker with that request (turning it off as an individual user), and it has many votes, but at the moment you can only disable it globally as admin.
by stephen_g - "has made web browsing way slower while all the junk is loading" describes all web development since the 90sby Schlagbohrer
- When it was new I tried something fairly easy, or so I thought
"Label all stories in the current project that contain "foo" with label "bar
It failed
by paradox460 - Rovo makes for an INCREDIBLE time reading jira tickets and confluence pages. Someone wrote YES in all caps in a page ? Rovo will helpfully tell you (after loading for 5 seconds) that YES stands for Yassified Entertainment Setting, a new option added to the app in January 2024.
Whenever I feel like I'm bad at software development, I look at Atlassian and I feel good.
- Have you seen the markdown agent instructions they provide in their new agentic `twg` cli? 70k tokens one average, there are more than one...
Rovo is the worse Ai I have used, I suggested they stop trying and let us have model choice. Save money and don't do things out of their skill sets
by verdverm - I just asked it to do a summary or a status page for my staff so I can share the high level details. Somehow it retrieved a version of the page from two weeks ago and summarised that. When I said, this is old, it happily said, yep, I'll do a summary of the current page. I kinda feel there may be people in between the box and some lame LLM.by mianos
- >I can’t get over how bad “Rovo” is. Somehow more aggressive and useless than Microsoft putting “Copilot” everywhere.
You're looking at it the wrong way. Think about how much better it is than the joke of a search tool that's slightly to the left of it's icon.
- Rovo has my favorite example of AI misfeature. Just checked, it's still there in Cloud Confluence. In Edit mode for a page, you can select a range of text and a menu will pop up, with Ask Rovo being a drop down on it. There's a few good options... Improve Formatting, translation options, Make Shorter...
... but it also has Make Longer. Yes, a built-in feature to type some text in, and the use the mighty power of AI to bloat it.
Naturally, you can repeat this process several times on the same text, for your own little personal demonstration of what model collapse looks like in real time.
by jerf - Worth reminding everyone of previous discussion when Atlassian opted-in all customers by default for their data to be used for model training.
https://news.ycombinator.com/item?id=47833247
This goes live on August 17. If you haven't switched it off your company IP will be used to train their future models.
by kevcampb