Ask HN: Slack shows a preview of private Google Docs?

24 pointstqi5 comments

I've noticed that I can usually see a preview of a google doc shared to Slack even if I don't have access permissions. Is this a bug or intended behavior?

View on HN

Slack generates it's previews based on the Sender's Google Doc permissions, under the assumption that if they're sharing the doc link they're also sharing the doc.

I wonder how Slack would do so. The app could open the Google Doc in the user's browser, take a screen capture (it already can capture the screen for screen sharing purposes) and make a PNG for the preview? Can the whole thing be done off-screen?

And I wonder if the browser-based Slack could do the same...

The drive API already provides a thumbnail image for supported file types, so I’m reasonably sure they’re just consuming and rendering that thumbnail.

It asks you to sign in and auth your Google account after sharing a docs link. So you give them permissions.

If you don’t want this behavior you can revoke Slack’s access.

Unless they’re sharing the doc with the intent that only a subset of the chat room has permission to view.

Permissions like this should inherit rather than clear. And if the software cannot sensibly allow that: deny all.

Reply on news.ycombinator.com