Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Use Slack Emoji on GitHub

single-emoji.vercel.app

Post reply on HN
Print view View original

21–30 of 32 posts

Re: Show HN: Use Slack Emoji on GitHub

#21

Post by TeMPOraL »

netsharc wrote: post #6
awinter-py wrote: post #5

> All you need is to have the Single Emoji browser extension, which connects to your Slack workspace and enables you to use your favorite Emoji on your favorite tools, by making the smallest patches possible to how these tools work. Nothing too fancy, nothing too suspicious. all you need is to connect random javascript to a major channel for social engineering and then run it inside major channel for software supply…

Back during the Yahoo and MSN chat days (remember Windows executables?), there were also "Download custom smiley packs" ads all over the Internet. I never tried them because they were probably malware. I have the same skepticism for this extension, or how easy extensions auto-updates can turn it into one. Are the other responses in here non-ironic?

FWIW, I suspect Telegram animated stickers (or whatever it's called these days) may be Turing-complete.

Re: Show HN: Use Slack Emoji on GitHub

#22

Post by [deleted] »

awinter-py wrote: post #5

> All you need is to have the Single Emoji browser extension, which connects to your Slack workspace and enables you to use your favorite Emoji on your favorite tools, by making the smallest patches possible to how these tools work. Nothing too fancy, nothing too suspicious. all you need is to connect random javascript to a major channel for social engineering and then run it inside major channel for software supply…

[deleted]

Re: Show HN: Use Slack Emoji on GitHub

#23

Post by TeMPOraL »

awinter-py wrote: post #16
madeofpalk wrote: post #14

Earlier quoted context omitted.

> - people who use both a Web Extensions-supporting browser and Slack This is just basically everyone using Slack, as Firefox, Chrome, and Safari support web extensions API > - people who install extensions with permissions to run arbitrary JS on every page I would bet that most people who use Chrome or Firefox install extensions that can run arbitrary JS on every page, like ad blockers, full page screenshot, or “nif…

yes -- browser permission model needs to be much more granular would be great if something like ublock is only able to disable dom elements, not insert them, for example, and has strong guarantees about not doing IO users are much more able to audit permissions than to audit changing code but permissions need to be 'shaped like' APIs or else they are too broad to provide power + safety together

It should start with access permissions being limited to user-specified (even if prefilled) list of sites/domains. There are extensions clearly meant for a single page (e.g. improving the UX), or a class of pages. I never install them, because even if those pages are not critical, the permission request is always scoped to "all data, every site", which means that e.g. this nice plugin decluttering YouTube could also exfil data from my bank's webapp.

Re: Show HN: Use Slack Emoji on GitHub

#24

Post by awinter-py »

TeMPOraL wrote: post #23
awinter-py wrote: post #16

Earlier quoted context omitted.

yes -- browser permission model needs to be much more granular would be great if something like ublock is only able to disable dom elements, not insert them, for example, and has strong guarantees about not doing IO users are much more able to audit permissions than to audit changing code but permissions need to be 'shaped like' APIs or else they are too broad to provide power + safety together

It should start with access permissions being limited to user-specified (even if prefilled) list of sites/domains. There are extensions clearly meant for a single page (e.g. improving the UX), or a class of pages. I never install them, because even if those pages are not critical, the permission request is always scoped to "all data, every site", which means that e.g. this nice plugin decluttering YouTube could also…

pretty sure chrome provides this? or at least whatever build of chromium I am on, at least for local-unbundled extensions

Re: Show HN: Use Slack Emoji on GitHub

#25

Post by petepete »

schniz wrote: post #13
vallanceroad wrote: post #10

Does this work for others not running the browser extension (or outside of your Slack organisation)? Also, Emoji has been part of Unicode for more than a decade...

Yes, your custom emojis will turn into images anyone can see. See: https://github.com/Schniz/fnm/issues/847#issuecomment-131372...

Oh hi. Unrelated to this tool but I use fnm every day and it's fantastic.

First time I used it it ran so quickly I thought it wasn't working properly.

Thanks for your hard work.

Re: Show HN: Use Slack Emoji on GitHub

#26

Post by 3np »

Given enough users, you'll have interesting statistics and metrics forming. What are you going to do with this? Might visitor IPs (viewers of Emoji inlined on GH, that is) be processed/retained?

Re: Show HN: Use Slack Emoji on GitHub

#27

Post by hirsin »

jrockway wrote: post #17
schniz wrote: post #8

Earlier quoted context omitted.

Hey there! I plan to open source this soon so the source will be available and you can read it. It is really doing nothing but adding the emoji to GitHub. But I understand that the shadiest people say they are legit, so I’ll prioritize open sourcing the extension so others can review it :) sounds good?

That is a nice thing to do, but I think people will still be hesitant because there is no way to know whether that code you open-sourced is actually what's in the Chrome Store, or that the Chrome Store listing won't change ownership in the future. (Chrome extensions auto-update, so it's easy to ship users code that does something "new and exciting", and when dealing with software supply chain risk, "new and exciting"…

Not to mention that even the data being requested and stored is also organizationally sensitivite if leaked. Everyone's got some problem customer emoji or frustration with their cloud provider in there, which maybe wouldn't look great externally.

Re: Show HN: Use Slack Emoji on GitHub

#28

Post by andrenotgiant »

3np wrote: post #26

Given enough users, you'll have interesting statistics and metrics forming. What are you going to do with this? Might visitor IPs (viewers of Emoji inlined on GH, that is) be processed/retained?

No, Github proxies and caches images through an intermediary (probably for privacy reasons amongst other things.)

Re: Show HN: Use Slack Emoji on GitHub

#29

Post by 3np »

andrenotgiant wrote: post #28
3np wrote: post #26

Given enough users, you'll have interesting statistics and metrics forming. What are you going to do with this? Might visitor IPs (viewers of Emoji inlined on GH, that is) be processed/retained?

No, Github proxies and caches images through an intermediary (probably for privacy reasons amongst other things.)

I stand corrected, you're right! So seems to be 0 privacy concerns for viewers, here.

GH also seems to use the data-canonical-src attribute to reference the original URI.

Re: Show HN: Use Slack Emoji on GitHub

#30

Post by notpushkin »

TeMPOraL wrote: post #21
netsharc wrote: post #6

Earlier quoted context omitted.

Back during the Yahoo and MSN chat days (remember Windows executables?), there were also "Download custom smiley packs" ads all over the Internet. I never tried them because they were probably malware. I have the same skepticism for this extension, or how easy extensions auto-updates can turn it into one. Are the other responses in here non-ironic?

FWIW, I suspect Telegram animated stickers (or whatever it's called these days) may be Turing-complete.

I don't think they are. TGS is basically a subset of Lottie, which looks too simple to be able to do arbitrary computations: https://github.com/lottie-animation-community/docs/blob/main...
Post reply on HN