Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Pastejacking

github.com

Post reply on HN
Print view View original

151–160 of 246 posts

Re: Pastejacking

#151

Post by SFJulie »

olalonde wrote: post #147
SFJulie wrote: post #129

I was like why does not it works! Then I remembered I had no script enabled, and then I remembered I don't trust JS and browsers by default, they are like OS in my OS that are way complex to be audited and they have access to way too much sensitive things (files, display, keyboard, network).

"When you’re a NoScript user and haven’t told anyone in 10 minutes" https://pbs.twimg.com/media/CWQbRunUAAAK8f6.png

Education is repetition :)

Weirdly enough, I don't think noScript is the solution (it is heavy, unpractical and I dare not look the code).

I am pretty awry of the evolution of the DOM + JS interaction and the new features brought in browsers that looks like both a cancer and instabilities to come.

Re: Pastejacking

#152

Post by ccozan »

ggsp wrote: post #123
dawnerd wrote: post #28

Earlier quoted context omitted.

I had to implement this kinda code when I worked for Demand Media and it certainly worked. Whats funny is you don't need any fancy new apis to make it work. We were doing some pretty basic tactics actually. Only real way to prevent it is disable javascript.

Or inspect and copy from there?

Best solution. Also works for websites that block right click, and other similar tricks, to "protect" the content.

Re: Pastejacking

#153

Post by chrismonsanto »

joombaga wrote: post #75
ricardobeat wrote: post #21

Earlier quoted context omitted.

And who provided you with the hash?

For distro packages? Any number of alternate download sources. But I agree with your greater point; hashes are better used as a guard against file corruption than fuckery.

If the program you want to install is included in your distribution's packages then this whole discussion is moot. We are talking about ways of installing from third-party sources.

Re: Pastejacking

#155

Post by rplnt »

This was disabled by default in (classic) Opera (since it was a weird microsoft addition). Was surprised how many sites do this when I switched browsers.

At the same time, it's better than those times when you had flash buttons to copy link. So I think it should be allowed to change clipboard on user's action (can it be detected?). But there certainly shouldn't be an event to change clipboard that is fired after the user copies something (selection copy, keyboard shortcut, browser ui, ..).

Re: Pastejacking

#156

Post by drodgers »

nathancahill wrote: post #110
zbuttram wrote: post #2

The author noted that iTerm on MacOS notifies when a paste that's about to happen contains a newline. Cmder on Windows does this as well, it's a nice feature even outside of the security concerns.

Didn't get a confirmation on iTerm 2.1.4, Firefox 46.0.1, OSX 10.11 (latest stable everything). Not sure if I missed something.

Yeah, it's only in the beta/nightly builds at this point. I switched to the beta just for that feature; it's great.

Re: Pastejacking

#157

Post by gcb0 »

freaking Adobe flash.

in it's feature creep it added clipboard access.

then web site developers thought it's a crucial feature. even github used a flash element to allow easy copy of repo url. as if anyone using git can't copy. then some moron added that to the browser, and every other moron followed.

morons. copying flash...

Re: Pastejacking

#159

Post by pdkl95 »

> Note the newline character gets appended to the end of the line.

As others have already pointed out, an API for interacting with the clipboard is a terrible idea that should be removed from the browser.

However, this particular problem of pasting multi-line strings into the terminal is already a solved problem if you use rxvt-unicode. The standard package includes the perl plugin "confirm-paste"[1][2]. Enable it in ~/.Xresources

    URxvt.perl-ext-common: default,confirm-paste
confirm-paste passes single line pastes normally, but asks for a y/n confirmation before sending a multi-line paste to the shell.

[1] urxvt-confirm-paste(1)

[2] http://cvs.schmorp.de/rxvt-unicode/src/perl/confirm-paste?vi...

Re: Pastejacking

#160

Post by TeMPOraL »

woodman wrote: post #116
ashitlerferad wrote: post #108

Earlier quoted context omitted.

Sounds like a pretty unethical way to make money.

I'm sure that those involved have very interesting rationalizations, but I don't think that it should be viewed from an ethics perspective. Expecting people to behave against their own self interest in the short term, for the good of strangers in the long term, will always end in disappointment. This is actually a pretty simple case of poorly stated objectives being cleverly met by people who are completely self inte…

> I know this sounds kind of "well what did you expect wearing something like that"

Which is a perfectly rational question/argument.

> Expecting people to behave against their own self interest in the short term, for the good of strangers in the long term, will always end in disappointment.

I agree. This is a systemic problem, and appeals to ethics won't work (and the advertisers won't change their metrics because of them) - one needs to attack the economic incentives underlying their current strategies.

Post reply on HN