g3rv4

I was even thinking about shipping an app that tweaked the Slack app for you, but after this experience (and since I don’t really use it) it’s not worth the effort.

I was able to attach a debugger on any app that I’ve tried.

I’ll share how to do it in an upcoming blogpost... all you need is asar and open the debugger after a reasonable timeout.

I’d really like to give zulip a try... unfortunately, I don’t have voice or vote over that decision on my company.

Also, I love the company too much to resign over a such a small thing that can be fixed with a 20kb extension.

I’m not being a good platform partner basically because they make it impossible for me to be one.

I’d love to avoid reverse engineering their minified code and use well documented APIs. Unfortunately, that’s not possible nor planned (as they told me on a tweet I linked on the post).

<3 thanks :) yes, it’s particularly hard because I’ve never disappointed anyone before :P

I get it... but literally, there are THOUSAND extensions already injecting javascript on their site.

are they going after all of them? if that's the case, I'd understand.

oh, yeah... that's something I want to look into

We use bonfire, which is the same tool the community at Stack Overflow uses to interact.

I don't know and I also don't want to figure it out :)

Because... I have lots of things to work on, lots of things I want to build, lots of people I want to talk with.

None of them involve talking with a lawyer in a different country over something that's really not that important in my life.

<3

yup

I guess... I'm sorry? and I'll try to do better next time, I promise.

this was a bunch of Tampermonkey scripts... but I don't want to ignore their cease and desist. I... just don't do it.

changing the name is not an issue... however, if I have to take it down, that's moot.

they don't want people injecting javascript on their website. That's all there's to it. I'm not sending anything anywhere. I'm not storing anything. I'm not profiting from it.

lol... it rings a bell

There are two problems with this approach:

1. I don't want to get involved in that, even if I'm based in Uruguay and they'd have a hard time suing me.

2. What they could do is put resources to detect the extension and block it. We could start a mouse and cat game that they'd win... I don't have their resources to invest in it. After all, all I wanted was to solve Slack for me, and that would make it harder.

now that they got all that money, I wouldn't be surprised if they killed the web app and moved away from Electron to do native apps that are harder to be messed with.

I wish it was so easy... I don't get to decide what tools my company uses unfortunately

probably... I certainly didn't want to hide anything

no, it can't be stopped technically. But I know I don't want to mess with them.

yeah, I'll keep on using it myself (and I would have built it just for that).

It's a shame they won't let me share it / take ideas / implement a way for US to control our experience.

yeah! if you have a library that does it, you could inspect when a message is created and call the library when the message is rendered.

PRs are welcome :)

somebody on Slack is already aware of the possibility: https://twitter.com/SlackHQ/status/1033279901888065536

I guess that if they consider it a vulnerability, they're going to do the check on the server side... I really hope they don't though.

If they do, I'll fix it on the extension (so only people with the extension would see the markdown links as real links).

Also: to answer your question... yes, there's an undocumented way of sending them. And yes, the client escapes `<https://url.com|the title>` to `&lt;https://url.com|the title&gt;`.

The format is the same format used by bots to generate links.

oh, an attacker could do [https://nicely-looking-url.com](https://shady-site.com). I see your point.

however, anybody with a bit of javascript knowledge can do it. I guess we need to keep educating people about the importance of checking urls?

oh, pop-out threads would be nice. I share your frustration :( and that's what compelled me to take a first stab at solving some issues.

nice! yeah, the problem with dynamically loading the script is that an attacker could inject anything... and they could easily steal your slack token.

But that sounds like an amazing thing for me to use locally :)

I'd love to give zulip a try

why use it at all? you may not be the one who chooses what tool your team uses for communication.