5 ms·

Show HN: Use Slack Emoji on GitHub

48 points by schniz 4y ago

steventey 4y ago
This is absolutely brilliant.
Kikobeats 4y ago
It works like a charm, just :wow:
javivelasco 4y ago
Just beautiful
awinter-py 4y ago
> All you need is to have the Single Emoji browser extension, which connects to your Slack workspace and enables you to use your favorite Emoji on your favorite tools, by making the smallest patches possible to how these tools work. Nothing too fancy, nothing too suspicious. all you need is to connect random javascript to a major channel for social engineering and then run it inside major channel for software supply chain risk
- netsharc 4y ago
  Back during the Yahoo and MSN chat days (remember Windows executables?), there were also "Download custom smiley packs" ads all over the Internet. I never tried them because they were probably malware. I have the same skepticism for this extension, or how easy extensions auto-updates can turn it into one. Are the other responses in here non-ironic?
  - schniz 4y ago
    Hey there! I plan to open source this soon so the source will be available and you can read it. It is really doing nothing but adding the emoji to GitHub. But I understand that the shadiest people say they are legit, so I’ll prioritize open sourcing the extension so others can review it :) sounds good?
    - jrockway 4y ago
      That is a nice thing to do, but I think people will still be hesitant because there is no way to know whether that code you open-sourced is actually what's in the Chrome Store, or that the Chrome Store listing won't change ownership in the future. (Chrome extensions auto-update, so it's easy to ship users code that does something "new and exciting", and when dealing with software supply chain risk, "new and exciting" is something many people don't want.) I get that you just wanted to make something cool, and it is very cool, but people are also right to be paranoid here. Compare the value between having a certain tiny image in your PRs versus being able to check code into any organization's Git repo as a trusted engineer at that organization, and how much someone would pay you on the black market for either of those things.
      - hirsin 4y ago
        Not to mention that even the data being requested and stored is also organizationally sensitivite if leaked. Everyone's got some problem customer emoji or frustration with their cloud provider in there, which maybe wouldn't look great externally.
  - TeMPOraL 4y ago
    FWIW, I suspect Telegram animated stickers (or whatever it's called these days) may be Turing-complete.
    - notpushkin 4y ago
      I don't think they are. TGS is basically a subset of Lottie, which looks too simple to be able to do arbitrary computations: https://github.com/lottie-animation-community/docs/blob/main/Lottie_Specification.md https://github.com/lottie-animation-community/docs/blob/main...
- eyelidlessness 4y ago
  I mean, you’re not wrong, but I’d bet the Venn diagram of… - people who use both a Web Extensions-supporting browser and Slack - people who install extensions with permissions to run arbitrary JS on every page - people who install or use Slack bots/etc with excessive access to Slack data … is likely very nearly a circle. The emoji use case isn’t one for which I’d personally take that combination of risks. But I can imagine a wide variety of more appealing/risk worthy and likely even higher risk “use [CLOUD_SERVICE_FOO_RESOURCES] seamlessly in GitHub” use cases where I’d pause to at least consider it.
  - madeofpalk 4y ago
    > - people who use both a Web Extensions-supporting browser and Slack This is just basically everyone using Slack, as Firefox, Chrome, and Safari support web extensions API > - people who install extensions with permissions to run arbitrary JS on every page I would bet that most people who use Chrome or Firefox install extensions that can run arbitrary JS on every page, like ad blockers, full page screenshot, or “nifty” discount-coupon-code extensions.
    - awinter-py 4y ago
      yes -- browser permission model needs to be much more granular would be great if something like ublock is only able to disable dom elements, not insert them, for example, and has strong guarantees about not doing IO users are much more able to audit permissions than to audit changing code but permissions need to be 'shaped like' APIs or else they are too broad to provide power + safety together
      - TeMPOraL 4y ago
        It should start with access permissions being limited to user-specified (even if prefilled) list of sites/domains. There are extensions clearly meant for a single page (e.g. improving the UX), or a class of pages. I never install them, because even if those pages are not critical, the permission request is always scoped to "all data, every site", which means that e.g. this nice plugin decluttering YouTube could also exfil data from my bank's webapp.
- layer8 4y ago
  But it gives you custom emoji!
- bakugo 4y ago
  Millions of developers run random javascript on their computers on a daily basis. It's called npm. How is this any less trustworthy?
  - TeMPOraL 4y ago
    It isn't, but those millions of developers are why software supply chain security is a topic now (and why it causes me no ends of headaches, even though I do C++!).
- deleted 4y ago
  [deleted]
deleted 4y ago
[deleted]
vallanceroad 4y ago
Does this work for others not running the browser extension (or outside of your Slack organisation)? Also, Emoji has been part of Unicode for more than a decade...
- schniz 4y ago
  Yes, your custom emojis will turn into images anyone can see. See: https://github.com/Schniz/fnm/issues/847#issuecomment-1313724397 https://github.com/Schniz/fnm/issues/847#issuecomment-131372...
  - petepete 4y ago
    Oh hi. Unrelated to this tool but I use fnm every day and it's fantastic. First time I used it it ran so quickly I thought it wasn't working properly. Thanks for your hard work.
    - Raed667 4y ago
      second this, it pains me when people install `nvm` not knowing `fnm` exists and is sooooo fast
      - schniz 4y ago
        thank you! happy that you find it useful
keybored 4y ago
Just :pinched_fingers:
codetrotter 4y ago
Hey, if you make a similar extension for HN we could start using emojis in comments :pepe_dab: It’ll be like BetterTTV but for HN :catjam: :meow_party:
3np 4y ago
Given enough users, you'll have interesting statistics and metrics forming. What are you going to do with this? Might visitor IPs (viewers of Emoji inlined on GH, that is) be processed/retained?
- andrenotgiant 4y ago
  No, Github proxies and caches images through an intermediary (probably for privacy reasons amongst other things.)
  - 3np 4y ago
    I stand corrected, you're right! So seems to be 0 privacy concerns for viewers, here. GH also seems to use the data-canonical-src attribute to reference the original URI.

48 points by schniz 4y ago

steventey 4y ago

This is absolutely brilliant.

Kikobeats 4y ago

It works like a charm, just :wow:

javivelasco 4y ago

Just beautiful

awinter-py 4y ago

> All you need is to have the Single Emoji browser extension, which connects to your Slack workspace and enables you to use your favorite Emoji on your favorite tools, by making the smallest patches possible to how these tools work. Nothing too fancy, nothing too suspicious. all you need is to connect random javascript to a major channel for social engineering and then run it inside major channel for software supply chain risk

netsharc 4y ago
Back during the Yahoo and MSN chat days (remember Windows executables?), there were also "Download custom smiley packs" ads all over the Internet. I never tried them because they were probably malware. I have the same skepticism for this extension, or how easy extensions auto-updates can turn it into one. Are the other responses in here non-ironic?
- schniz 4y ago
  Hey there! I plan to open source this soon so the source will be available and you can read it. It is really doing nothing but adding the emoji to GitHub. But I understand that the shadiest people say they are legit, so I’ll prioritize open sourcing the extension so others can review it :) sounds good?
  - jrockway 4y ago
    That is a nice thing to do, but I think people will still be hesitant because there is no way to know whether that code you open-sourced is actually what's in the Chrome Store, or that the Chrome Store listing won't change ownership in the future. (Chrome extensions auto-update, so it's easy to ship users code that does something "new and exciting", and when dealing with software supply chain risk, "new and exciting" is something many people don't want.) I get that you just wanted to make something cool, and it is very cool, but people are also right to be paranoid here. Compare the value between having a certain tiny image in your PRs versus being able to check code into any organization's Git repo as a trusted engineer at that organization, and how much someone would pay you on the black market for either of those things.
    - hirsin 4y ago
      Not to mention that even the data being requested and stored is also organizationally sensitivite if leaked. Everyone's got some problem customer emoji or frustration with their cloud provider in there, which maybe wouldn't look great externally.
- TeMPOraL 4y ago
  FWIW, I suspect Telegram animated stickers (or whatever it's called these days) may be Turing-complete.
  - notpushkin 4y ago
    I don't think they are. TGS is basically a subset of Lottie, which looks too simple to be able to do arbitrary computations: https://github.com/lottie-animation-community/docs/blob/main/Lottie_Specification.md https://github.com/lottie-animation-community/docs/blob/main...
eyelidlessness 4y ago
I mean, you’re not wrong, but I’d bet the Venn diagram of… - people who use both a Web Extensions-supporting browser and Slack - people who install extensions with permissions to run arbitrary JS on every page - people who install or use Slack bots/etc with excessive access to Slack data … is likely very nearly a circle. The emoji use case isn’t one for which I’d personally take that combination of risks. But I can imagine a wide variety of more appealing/risk worthy and likely even higher risk “use [CLOUD_SERVICE_FOO_RESOURCES] seamlessly in GitHub” use cases where I’d pause to at least consider it.
- madeofpalk 4y ago
  > - people who use both a Web Extensions-supporting browser and Slack This is just basically everyone using Slack, as Firefox, Chrome, and Safari support web extensions API > - people who install extensions with permissions to run arbitrary JS on every page I would bet that most people who use Chrome or Firefox install extensions that can run arbitrary JS on every page, like ad blockers, full page screenshot, or “nifty” discount-coupon-code extensions.
  - awinter-py 4y ago
    yes -- browser permission model needs to be much more granular would be great if something like ublock is only able to disable dom elements, not insert them, for example, and has strong guarantees about not doing IO users are much more able to audit permissions than to audit changing code but permissions need to be 'shaped like' APIs or else they are too broad to provide power + safety together
    - TeMPOraL 4y ago
      It should start with access permissions being limited to user-specified (even if prefilled) list of sites/domains. There are extensions clearly meant for a single page (e.g. improving the UX), or a class of pages. I never install them, because even if those pages are not critical, the permission request is always scoped to "all data, every site", which means that e.g. this nice plugin decluttering YouTube could also exfil data from my bank's webapp.
layer8 4y ago
But it gives you custom emoji!
bakugo 4y ago
Millions of developers run random javascript on their computers on a daily basis. It's called npm. How is this any less trustworthy?
- TeMPOraL 4y ago
  It isn't, but those millions of developers are why software supply chain security is a topic now (and why it causes me no ends of headaches, even though I do C++!).
deleted 4y ago
[deleted]

deleted 4y ago

[deleted]

vallanceroad 4y ago

Does this work for others not running the browser extension (or outside of your Slack organisation)? Also, Emoji has been part of Unicode for more than a decade...

schniz 4y ago
Yes, your custom emojis will turn into images anyone can see. See: https://github.com/Schniz/fnm/issues/847#issuecomment-1313724397 https://github.com/Schniz/fnm/issues/847#issuecomment-131372...
- petepete 4y ago
  Oh hi. Unrelated to this tool but I use fnm every day and it's fantastic. First time I used it it ran so quickly I thought it wasn't working properly. Thanks for your hard work.
  - Raed667 4y ago
    second this, it pains me when people install `nvm` not knowing `fnm` exists and is sooooo fast
    - schniz 4y ago
      thank you! happy that you find it useful

keybored 4y ago

Just :pinched_fingers:

codetrotter 4y ago

Hey, if you make a similar extension for HN we could start using emojis in comments :pepe_dab: It’ll be like BetterTTV but for HN :catjam: :meow_party:

3np 4y ago

Given enough users, you'll have interesting statistics and metrics forming. What are you going to do with this? Might visitor IPs (viewers of Emoji inlined on GH, that is) be processed/retained?

andrenotgiant 4y ago
No, Github proxies and caches images through an intermediary (probably for privacy reasons amongst other things.)
- 3np 4y ago
  I stand corrected, you're right! So seems to be 0 privacy concerns for viewers, here. GH also seems to use the data-canonical-src attribute to reference the original URI.