6 ms·
Seriously? What did you expect? The secret sauce is on the client. For example, user pastes in plain text, a youtube url: userXXX: http://youtube.com/cool-vi
by nopacience 9y ago
Seriously?
What did you expect? The secret sauce is on the client.
For example, user pastes in plain text, a youtube url:
userXXX: http://youtube.com/cool-video http://youtube.com/cool-video
Then lets say user2 client reads that message, then it will parse it and check if youtube.com has a plugin enabled. If it does, it will get the thumnail and title and display it in a nicer way than just the URL. But it was initially just a url.
I think you want a HTML chat with javascript. Try making that... and discover that it is not secure to accept and run javascript from unkown users.
So plain text means securer! -- without code that might be evalled.
- dmitriid 9y agoI see you've never used Slack before. Slack doesn't run a "youtube plugin javascript". It does link unfurling [1]. Precisely for this reason: "it is not secure to accept and run javascript from unkown users.". And, of course, it supports unfurling for a lot of things out of the box: links, images, youtube and vimeo videos, spotify playlists etc. That is there in the protocol/API. Your client may then chose to display those unfurled links however it wants. Slack's client presents them more or less exactly the way users may want, consistently across multiple platforms. Neither IRC no XMPP have that. That's why you mistakenly think that the only recourse is to "accept and run javascript from unkown users on the client". And yes. Most users do want a chat with formatting, unfurled links, inline messages, inline video, emoji reactions, multifunctional bots etc. That's why they flock to Slack, not to IRC/XMPP. --- [1] https://api.slack.com/docs/message-link-unfurling#slack_app_unfurling https://api.slack.com/docs/message-link-unfurling#slack_app_...