Live data from Hacker News

Bye bye BetterSlack

g3rv4.com

131–140 of 392 posts

Re: Bye bye BetterSlack

#131

Earlier quoted context omitted.

I've been contemplating putting The Lounge in front of my IRC servers. How well does it scale? i.e. how many web users can you support with {n} amount of memory/cpu? I've used cgiirc, but it isn't pretty and some people want pretty and client-less.

I'm not sure, to be honest. I would be interested in hearing what you discover if you investigate this yourself.

Certainly! I will keep notes on my setup and performance.

Re: Bye bye BetterSlack

#132
post #43
post #28

While I completely understand your decision to pull it; both their decision to flex their legal arm and your decision to not stand your ground are equally disappointing.

I guess... I'm sorry? and I'll try to do better next time, I promise.

Although you owe me nothing, if this were possible, an apology wouldn't be necessary.

Re: Bye bye BetterSlack

#133
post #116

Earlier quoted context omitted.

> to do native apps that are harder to be messed with As someone who messes with native apps: this really isn't true, at least in my experience. Native apps tend to follow platform paradigms, which usually make them reasonably well designed and structured–sometimes more so than web applications. Usually adding functionality is simply a matter of finding the class that manages the component, rather than digging thorou…

are you thinking about opensource? I don't think it would be opensource

You do it the same way exploit writers do. Attach a debugger to the process, find the memory address of the resource you want to modify, overwrite the address with the address of the modified resource you want to execute. You could also just use the debugger to force the program to execute functions with arguments you specify, that way you don't have to worry about mucking with the memory.

Re: Bye bye BetterSlack

#134
post #74
post #11

I wonder how much longer Slack’s web client is going to remain a first class product? Clearly, it was a good way to drive adoption, but seems that at this point they want ever more control.

> I wonder how much longer Slack’s web client is going to remain a first class product? It never was? The Android client takes 10 seconds to start, runs my device hot and the UI is so bad that the first time I tried to respond to a thread I couldn't figure out how to get out of the thread view. The desktop client uses 1GB of memory gobbles my CPU and takes 20 seconds to start. The "least bad client", the web client s…

>They did corner the market so clearly they must be doing something, but really I just can't see it. I'm completely stumped.

I've been wondering about this for a while now. Slack feels more like "just good enough" in terms of UX than anything special. It's just a chat application with terribly slow clients but somehow everyone is using it.

Re: Bye bye BetterSlack

#137
post #133
post #116

Earlier quoted context omitted.

are you thinking about opensource? I don't think it would be opensource

You do it the same way exploit writers do. Attach a debugger to the process, find the memory address of the resource you want to modify, overwrite the address with the address of the modified resource you want to execute. You could also just use the debugger to force the program to execute functions with arguments you specify, that way you don't have to worry about mucking with the memory.

Usually you'd create a dynamic library that interposes a function, so you don't have to much around with using a debugger. This way you have a persistent modification that's much more resilient to changes caused by app updates. Exploit writers generally have different goals: their thing only really needs to work once, and only with the current configuration, since usually the bug they're relying on gets patched in the next version.

Re: Bye bye BetterSlack

#138
post #123

> Injecting javascript into Slack via Chrome extension can have an impact on the privacy and security of our customers and our product. So can taking screenshots of messages. If injecting JS can possibly affect the security of your platform then that's a vulnerability you should fix, not send a C&D to some developer about.

Hard to solve that if the browser allows that via the extensions mechanism.

If your security depends on people not using browser features, maybe don’t use a browser then. Ultimately, if your security depends on the client being unmodified, you basically lost. You can make it harder for an attacker, but that’s the problem DRM tries to solve (and consistently fails to)

Re: Bye bye BetterSlack

#139

Earlier quoted context omitted.

A disclaimer would not work. Disclaimers might work where there is a risk that the user will violate the acceptable use policy but this cease and desist letter has effectively said that all users will violate the acceptable use policy therefore the disclaimer would be quickly dismissed by any court of law. As a slightly bad analogy imagine a disclaimer that customers of a fairground ride might experience back pain. I…

Sort of. It’s fine to have a disclaimer which says “this will void your warranty”, just look at smartphone jailbreaking. He’s not breaking Slack’s terms of service - his users are. But then the next logical step is to argue that he’s inducing a breach of contract by his users, which seems to be the case.

In any case, it probably is not worth likely legal costs and effort should the other party take legal action. It is one thing to theorize about legal implications, quite another to risk livelihood etc to put it to test. Defending against action takes time and money which amounts to loss in many cases even when you are successful in court.

Re: Bye bye BetterSlack

#140
except to the extent such restrictions are prohibited by applicable law

...and here is the key. AFAIK reverse-engineering for interoperability is protected in the EU. IANAL.

As a long-time user (and developer) of web filtering proxies and related software, I also say you should fight this, because it otherwise sets a bad precedent.

Viewing the source code of a webpage is not a crime, nor is changing bits in the memory of the hardware you own.

Also, I know it's too late for that now, but sometimes it's better to be pseudoanonymous when releasing software that you think is somewhat in the gray area.

Post reply on HN