Hacker News Reader

Comment by comesee | Hacker News Reader

I dont see any legal reason why you can't publish the extension under a different name. Your extension is under no legal obligation to follow their acceptable use policy, only the users that use your extension.

View on HN

There are two problems with this approach:

1. I don't want to get involved in that, even if I'm based in Uruguay and they'd have a hard time suing me.

2. What they could do is put resources to detect the extension and block it. We could start a mouse and cat game that they'd win... I don't have their resources to invest in it. After all, all I wanted was to solve Slack for me, and that would make it harder.

Could they really sue you for creating a chrome extension that modifies their webpage? That would be a very dark day for the internet. I can't imagine there's any legal basis for that, but it would be very interesting to hear a lawyer's opinion.

Well done on what you have achieved, keep fighting the good fight!

I dont think they can, or all the adblockers would have been removed already.

Any extension that Interacts with pages. I have so many of them. Vimium injects itself onto every page.

(Goes without saying, but IANAL) It's my understanding that in the US you can be sued by anyone for anything. That doesn't mean the case has merit, but it does mean you're obligated to defend yourself or lose by default. This is often the mechanism by which patent/copyright trolls put pressure on their 'mark.'

It sounds like the plugin author isn't located in the US, so this may be moot, but countries colonized or invaded by European countries or the US often have similar legal systems.

I doubt they'd win in a fair fight, but I also doubt the plugin author can afford to put up a fair fight.

I don't know and I also don't want to figure it out :)

IANAL -- but I've been on the receiving end of a MegaCorp's C&D for alleged violations of the Copyright Act, the CFAA, and other things.

The biggest thing is Terms, which will almost always exclude any tampering of any kind, client or server side. These agreements are usually upheld in the US. So that's hurdle #1.

The CFAA isn't really obviated by client-side modifications, because the CFAA allows essentially arbitrary definition of "unauthorized access" and "exceeding authorized access". If they tell you to cease and desist, most judges won't believe that you can reasonably claim that you didn't know your access was unauthorized. The CFAA makes unauthorized computer and network access illegal.

There's a third barrier here, which is copyright law. The "RAM Copy doctrine" is the dominant interpretation, and it states that even the temporary copies that exist within RAM are sufficiently tangible to qualify for copyright protection, meaning you either need a license from the rightsholder or you need to prove fair use just to load the content.

The only way I can see that that wouldn't affect client-side applications would be if they access everything through a proxy without ever actually loading the copyrighted content directly, i.e., by injecting and accessing the DOM through the browser. But you'd still have to convince the judge that the extension itself is not infringing on the work it alters, which seems unlikely -- it would likely be considered a derivative work.

Again, I'm not a lawyer. Maybe all this is wrong. You shouldn't rely on it. But the situation is not as dreamy as people think. BigCos keep this bully pulpit relatively quiet because it makes it easy for them to crush upstart competitors who may offer a "move your profile from $X" feature. With the data locked up, the users never move.

> What they could do is put resources to detect the extension and block it. We could start a mouse and cat game that they'd win... I don't have their resources to invest in it. After all, all I wanted was to solve Slack for me, and that would make it harder.

Honestly, if they do that they're idiots and, longer term, slack is a dying product: they'd be much, and I mean MUCH, better served by investing those resources in improving the product.

change it to 'SlackSucks'. Make it change the logo to a toilet or some sticks of ram that are on fire. It's now a parody.

You could still continue development on Github, and allow users to install the extension themselves. I believe this is the approach that some paywall bypass extensions take[0]

[0]: https://github.com/arthurpham/wsjUnblock

that’s def something I’d like to try if they are ok with it

On a side note, cool to see Uruguayans at the top of HN. Sorry it's under this circumstances.

Congrats on your Stackoverflow job :)

You wouldn't happen to have any recommendations for hiring web-devs here in Uruguay for a small startup? It's CRAZY HARD.

GO 🇺🇾! nope, I’ve never worked for a Uruguayan company ¯\_(ツ)_/¯

Whilst it is true that the extension has no legal obligation to follow the acceptable use policy, users do have to follow the policy and the courts would argue this extension coerces users to break the policy. The legal precedent is Blizzard vs Bossland [1] which Bossland lost in the UK courts [1], US courts [2] and German courts [3]

[1] https://www.bristows.com/news-and-publications/articles/bris...

[2] https://www.bbc.co.uk/news/technology-39490317

[3] http://gameslaw.org/bots-and-buddies-the-blizzard-v-bossland...

I'd say a large part of blizzard winning this case was the intent of the software. The interfering software was intended to facilitate cheating.

I think it would be unlikely to have won, had the software been made to streamline the game or make it run faster.

I agree with you there, to win the case there would have to be some economic reason for Slack to not want users to use this extension.

The reason they state is "Injecting javascript into Slack via Chrome extension can have an impact on the privacy and security of our customers and our product. Furthermore, this can create reliability issues when we ship product updates." If they can prove that is true then the case stands up but if BetterSlack doesn't impact security, privacy or reliability then the case would probably be dismissed.

There's some excellent analysis of this sort of case here https://ir.law.fsu.edu/cgi/viewcontent.cgi?article=1101&cont...

If it alters the DOM, it impacts security, and in a very significant way, since DOM security is in a sense the most important security barrier between untrustworthy content and all the messages a user has access to on a Slack.

Sure, it "impacts" security. But as we are discussing above, it would need to be shown to "negatively" impact security. I don't think you could win on the basis of "it's not recommended to do that, but we can't see any examples of it actually causing security problems."

One of Chrome Web Store’s terms is that a developer is not allowed to publish an extension that “knowingly violates a third party’s terms of service.”[1] So even if the author has the 1st Amendment right to publish the extension on his own website, Google will likely take it down from the Chrome Web Store.

[1]: https://developer.chrome.com/webstore/terms

What if it's a greasemonkey script?

greasemonkey doesn't target specific website. It's a generic approach.

The user script typically does, though.

Many userscripts target specific websites and change both their appearance and behavior. Userscripts are often indexed, distributed and ranked like browser extensions are, as well.

I'd love to hear more about this from someone with legal expertise.

It makes no sense for them to claim that every extension published on the Chrome store needs to comply with their acceptable use policy...

If that were true, then wouldn't 1Password and any other extension that uses a content script also be considered unacceptable?

Great question. What matters is the outcome, not the mechanism. It is the modification of the functionality of Slack’s product which is at issue. Most extensions don’t do that in any substantial manner.

Furthermore, in a civil suit what needs to be demonstrated are actual damages to their business. (It’s not enough to just show that the ToS were violated). There’s no possibility of that for most browser extensions.

Reply on news.ycombinator.com