DEV Community: Vic

Exploiting Slack’s video embeds to achieve e2ee communication

Vic — Sun, 21 Jun 2026 04:56:06 +0000

Introduction

Some time ago, while exploring Slack’s Block Kit reference, I noticed something peculiar: the video block. When I saw that it accepted a video_url, the first thing I thought was: how does it distinguish between any content and an actual video? Would there be any particular requirement or limitation in the embed? Foreign sources?

Yeah, no. There is no runtime check, other than checking the provided video_url is accessible and responds with a 2xx or 3xx code. After those checks, it’s nothing more than a simple iframe.

So, a few days ago I got an idea. What if there was an app that allowed you to encrypt messages with a key pair and send them through Slack?

The idea is simple. Inside your client, using the browser crypto APIs, you create a key pair, encrypt the private key and send it to the server. Then, any time you want to do an operation (sign, encrypt, decrypt), the server will send you back your key and, inside a video block, you will decrypt your key and do the operation.

This way, the server never gets the decrypted key but via the key-pairs, you can encrypt messages for anyone.

Implementation

For this app’s development I chose TypeScript. For no other reason than that I’m used to it and I’m able to iterate fast with it.

During the implementation of the Slack app, I spent a decent amount of time until realizing that video blocks can not be included in ephemeral messages. This behavior is not documented anywhere.

Regarding the encryption, first, I tried writing all the encryption logic myself. Using the subtle crypto API from the browser (which is fully available in the Slack video block).
Shortly I noticed how difficult that was. How many techniques and cases I would need to be aware of.

Fortunately, before suffering more, I found openpgpjs. An amazing library maintained by Proton (yes, the email people) that does all the cryptography operations I need.

I wanted the server to save as little data as possible by storing most of the data in slack metadata fields. I have already done this for other Slack bots.
All the slack messages or views may store a metadata field which is never shown in the client. But, because of the length of encrypted messages, I wasn't able to use this feature.

For serving the iframes, I ended up using a slug system. On each call that needs client interaction, a unique slug which holds the necessary data for the action to be done is stored in a KV db.
When the video embed is loaded, this information is embedded with the iframe client code so all cryptographic operations can be done locally.

As an example, the flow for encrypting a message is simple:

First, the Slack command /e2ee send is executed. A Slack modal opens, requesting the recipients of the message.
After that modal is submitted, a slug is generated, containing: the author private key & the recipients public key.
When clicking on the video block inside Slack, the local-client is loaded with the above information.
The author decrypts their private key via his passphrase (locally).
The author writes the message, encrypts it for the recipients and signs it with his key (locally).
The author sends only the encrypted message.
The server sends envelopes to each one of the recipients of the message.

By the way, while developing this project, I discovered some of the wonders modern nodejs has to offer. Did you know node natively supports .env files now? I didn’t!

Result

You can check out the project right now, the source is at gh:v1ctorio/e2ee-slack, and self-host it for your Slack workspace
in ~5 minutes.

This project ends up being a hack since it doesn’t fully comply with Slack’s design constraints. But it kept me wondering.
With all the flexibility that web technologies give us, wouldn’t it be nice if major services supported fully-featured apps inside their client?

I mean, Discord already does something similar with 'Activities'
or Telegram with 'Mini Apps'. Wouldn’t it be interesting to see more mainstream services adopt this approach?

In case you are not aware of the Anthropic situation

Vic — Sat, 28 Feb 2026 00:26:01 +0000

The Anthropic statement

At 2026-02-26 21:55 UTC, Anthropic releases a public statement in which they speak out regarding the demands of the US Department Of War.

In said statement, they explicitly address two concrete use cases in which they deny to provide their technology:

Mass domestic surveillance. They don't want their products being using to patrol USA citizens and acknowledge that their services could be used to easily arbitrarily profile any citizens data without the need of a warrant.
Fully autonomous weapons. Anthropic acknowledges the utility of partial and fully autonomous weapons in the military, but they affirm that the guardrails present in their technology are not enough to assure the safety of american warfighters and civilians.

The open letter

The same day, the "We Will Not Be Divided" open letter is made public. In it, hundreds of Google and OpenAI employees declare their support to Anthropic.

Response from the US

On the next day, 27, the White House twitter account and Donald Trump (POTUS) make a post directing all USA federal agencies to stop using Anthropic's product in a six month period and threaten Anthropic with "major civil and criminal consequences" if they are not supportive during the transition period.

The same day, at 22:14 UTC, Pete Hegseth (US Secretary of War) makes a post calling out Anthropic for trying to "veto power over the operational decisions of the United States military" and designates Anthropic as a Supply-Chain Risk to National Security.

Fumo dashboard

Vic — Thu, 20 Jul 2023 15:27:33 +0000

What I built

A dashboard to manage the Fumo-API

Category Submission:

Most Visually Pleasing

App Link

https://test-fumo-dashboard.nosesisaid.com

https://fumo-mock-api.vicotrio.repl.co

Screenshots

Description

Link to Source Code

https://github.com/v1ctorio/fumos-mui-dashboard

Permissive License

MIT

Background (What made you decide to build this particular app? What inspired you?)

I've had the Fumo-API for a long time and thought about making a dashboard so I can manage the fumos better, Refine helped me to make this process easier.

How I built it (How did you utilize refine? Did you learn something new along the way? Pick up a new skill?)

I used the create-refine-app CLI and the Inferencer feature, which I find very interesting and think I'll use in future projects

How to host RAW images for free

Vic — Tue, 07 Jun 2022 17:39:56 +0000

Hours ago I was searching for a way to host "raw" (with raw I mean an endpoint that returns an image) and most of them like azure blob storage are paid so I searched for free alternatives.

GitHub

Create a new repo
Upload files
Drag your image
On the image page, right-click it and click 'copy image link'

Telegra.ph

To host the images in the telegram server

Go to telegra.ph
Click on the camera icon and choose your image
Right-click the image and 'copy image link'

You also can use the API using for example telegram-uploader.
Here's a snippet of how to use it

const { uploadByBuffer } = require('telegraph-uploader')
const fs = require('fs')

uploadByBuffer(fs.readFileSync('./image.png'), 'image/png')
  .then((result) => {
    console.log(result)
    /* {
         link: 'https://telegra.ph/file/...',
         path: '/file/...',
       } */
  })

Sirv.com

It's a more advanced hosting, it provides benefits like

Custom domain
Folders
Custom name
Custom endpoint but also as it is a professional option it have limitations for the free plan, for example it only allow you to host 500mb for free and have a bandwidth of 2GB.

Thanks for reading :)

The day snippet

Vic — Mon, 06 Jun 2022 17:28:04 +0000

Share here the code snippet to solve the weird error that you thought no one had had ever or the weird utility which you didn't even know that existed in that programming language or library.

Mine is https://split.js.org/

Creating your own URL shortener

Vic — Tue, 31 May 2022 16:30:02 +0000

This is a kind of half-blog half-tutorial of how to create your URL shortener using Redis, go & GitHub copilot.

Introduction

I was searching for a URL shortener service for my domain, there are a lot like bit.ly, short.io, cutt.ly... but most of them are paid or have a lot of limitations like the number of URLs.
So I decided to create my own, to start the project I had to know

Which language I'll use
How do I'm going to store the data For the first one, I decided to use Go. Why? Why not? It's a programming language so it works. For the second one I decided to use MongoDB but this will change shortly. Don't focus on that yet and start coding!

Setting up the workspace

You can download the go cli here but I'm more based than you 😎 so GitHub gave me the Codespaces beta
if you're based like me go to repo.new and create a new repo, make sure to check this box if you want to use Codespaces, after creating the repo click here to create a Codespace .

To init your project run the next command go mod init shortener, this will create a go.mod. Something like a package.json in node or a Gemfile in rust.

Start coding

Now start coding!

Paste the next code into the main.go file.

package main
import (
    "fmt"
    "net/http"
)

func main() {
    http.HandleFunc("/hello", hello)
    http.ListenAndServe(":8080", nil)
}

func hello(w http.ResponseWriter, r *http.Request) {
    w.Write([]byte("Hello World!"))
}

This will create a http server in the port 8080 and reply to the endpoint /hello with Hello World!.

Redirecting

What a URL shortener does? redirecting the user to another URL.

To do this we will use the next line of code
http.Redirect(w, r, URL, http.StatusFound)

Implementing this to our last code look like this:

package main
import (
    "fmt"
    "net/http"
)

func main() {
    http.HandleFunc("/hello", HandleReq)
    http.ListenAndServe(":8080", nil)
}

func HandleReq(w http.ResponseWriter, r *http.Request) {
    http.Redirect(w, r, "https://www.google.com", http.StatusFound)
}

Reding the url

To read the url we will use the next line of code
r.URL.Path[len("/"):].
Implementing this to our last code look like this:

package main
import (
    "fmt"
    "net/http"
)

func main() {
    http.HandleFunc("/hello", HandleReq)
    http.ListenAndServe(":8080", nil)
}

func HandleReq(w http.ResponseWriter, r *http.Request) {
    key := r.URL.Path[len("/"):]

    http.Redirect(w, r, "https://www.google.com", http.StatusFound)
    fmt.Println(key)
}

Implementing the database

Now that we know how to read the url and redirecting we implement the database.

To do this I thought that using MongoDb is a good idea. Let me save you that suffering, do not use mongo.

For this, we will use Redis instead

Hosting the database

Do you know how to host a redis database? I do not
So for this, I'll use Railway, it lets you create a database in seconds, just go to https://railway.app/new & click Provision redis, then click on Redis -> Connect
There will be a URL like this redis://default:password@host, store this data.

ℹ This tutorial doesn't cover how to create URLs programmatically **yet* so for creating URLs go to data and create keys with the value of the URL where you want to redirect.*

Connecting to the database

For this we will use go-redis, to install it run github.com/go-redis/redis/v8.

To create the client we will use the next code

redis.NewClient(&redis.Options{
        Addr:     server,
        Password: password,
        DB:       0,
    })

For getting data from the database we will use the next code

value, err := db.Get(context.Background(), key).Result()

Implementing this to our last code look like this:

package main

import (
    "fmt"
    "net/http"
    "context"

    "github.com/go-redis/redis"
)
//This define db and context, why? In go if you want to make a global variable you need to define it outside the main function.
var db *redis.Client
var ctx = context.Background()

func main() {
    DataBase()
    http.HandleFunc("/", requestHandler)
    http.ListenAndServe(":"+port, nil)
    fmt.Println("Server started on port:", port)

}

func DataBase() {

    db = redis.NewClient(&redis.Options{
        Addr:     server,
        Password: password,
        DB:       0,
    })

    fmt.Println("Connected to Database")
}

func requestHandler(w http.ResponseWriter, r *http.Request) {
    //This get the key from the URL by wathing the url path and removing the `/`
    key := r.URL.Path[len("/"):]

    //this checks if the key is empty, if it's, return 404
    if r.URL.Path == "/" {
        http.Error(w, "Not Found", http.StatusNotFound)
        return
    }

    //this gets the value from the database
    value, err := db.Get(ctx, key).Result()

    //Go is kind of weir so if you want to know if there's a error you need to check if the value error value is not nil(null)
    if err != nil {
        panic(err)
    }
    //check if there is no URl for the key, if it's true, return 404
    if value == "" {
        http.Error(w, "Not Found", http.StatusNotFound)
        return
    }

    http.Redirect(w, r, value, http.StatusFound)
}

That's it!
Now we have a completely functional URL shortener!

I hope you enjoyed this post, if you have any questions or suggestions ~~feel free to~~ PLEASE comment.