Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Don't touch my clipboard

alexanderell.is

Post reply on HN
Print view View original

31–40 of 322 posts

Re: Don't touch my clipboard

#31

Post by cortesoft »

smt88 wrote: post #12
jawns wrote: post #5

There used to be a time when we could hope that browsers would put users first and disable dark patterns like these. Now, there are so many advertisers that use Tynt and related services to muck with copy/paste that it wouldn't surprise me if the major browsers are incentivized to leave this alone and let users suffer.

> disable dark patterns like these Clipboard access isn't guaranteed to be a dark pattern, though. It's an API that the browser supports. I dislike clipboard access 99% of the time, but it's actually useful in a few UIs (like copying keys in AWS). Should it really be up to the browser to determine that an API is always a dark pattern? Honestly, most of the worst dark patterns of the web are enabled by regular , , and…

Is it really useful in AWS? Why is it needed?

Re: Don't touch my clipboard

#32

Post by oefrha »

sigotirandolas wrote: post #23
SanchoPanda wrote: post #3

My favorite demo on this subject: https://github.com/dxa4481/Pastejacking

Actually my terminal emulator (xfce4-terminal) added a preview + confirmation dialog a few months ago for copy-pastes including newlines (i.e. which will execute a command instantly). I thought that it was to avoid accidental mistakes, but it makes even more sense that it is to avoid this.

> copy-pastes including newlines (i.e. which will execute a command instantly)

You should enable bracketed paste mode in your shell. IMO it’s much better UX than a confirmation dialog.

https://cirw.in/blog/bracketed-paste

Re: Don't touch my clipboard

#33

Post by tkgally »

prestemon wrote: post #10

Most importantly, https://emdash.fan/ is the best emdash site on the internet.

My go-to site for copying special symbols is Wikipedia, which is, of course, well-behaved:

Dashes https://en.wikipedia.org/wiki/Dash

Diacritics https://en.wikipedia.org/wiki/Diacritic

Precomposed Latin characters https://en.wikipedia.org/wiki/List_of_precomposed_Latin_char...

Currency symbols https://en.wikipedia.org/wiki/Currency_symbol

Japanese typographic symbols https://en.wikipedia.org/wiki/List_of_Japanese_typographic_s...

etc.

Re: Don't touch my clipboard

#34

Post by totetsu »

brobot182 wrote: post #2

Is there a chrome plugin that prevents this?

I just modified a userscript to disable this. (running with tampermonkey) https://stackoverflow.com/a/26160412 I changed the document.addEventListener to 'copy'. It seems to stop the site from running its own code. [edit] This seems to be a more fully functioned script. https://greasyfork.org/en/scripts/14146-%E7%BD%91%E9%A1%B5%E...

Re: Don't touch my clipboard

#35

Post by thought_alarm »

I've been using a simple Javascript whitelist/blocker for the last 4 years or so (a dead-simple Safari content blocker for iOS and Mac I wrote myself; syncs over iCloud just to give me something to do) and I honestly don't know how anyone can stand the wide-open web without something similar.

Using the web with free Javascript privileges is an utterly appalling experience. I can't stand it for more than 5 seconds.

Re: Don't touch my clipboard

#36

Post by sigotirandolas »

jawns wrote: post #5

There used to be a time when we could hope that browsers would put users first and disable dark patterns like these. Now, there are so many advertisers that use Tynt and related services to muck with copy/paste that it wouldn't surprise me if the major browsers are incentivized to leave this alone and let users suffer.

In Firefox this behaviour has been closed as WONTFIX for >10 years [1] and actually accepted for more like 20 years [2].

[1] https://bugzilla.mozilla.org/show_bug.cgi?id=504748

[2] https://bugzilla.mozilla.org/show_bug.cgi?id=39098#c23

Re: Don't touch my clipboard

#37

Post by cortesoft »

smichel17 wrote: post #14

The wrongest thing about this, from my perspective, is that my browser fires off a js 'copy' event when I press control-c. There are times when I've found it helpful that a browser can copy text to my clipboard when I click a button, but I can't think of a single time when I want a site to react to my attempt to copy text off if it. Is there any way to configure my user agent (Firefox) not to do this? A hack is ok.

I think the wrongest thing is that this is a clear attack vector... make a site with helpful Linux shortcuts, then replace every copy with "curl malicious script and run it, plus a newline to make it run immediately"

Re: Don't touch my clipboard

#38

Post by 0zymandiass »

thought_alarm wrote: post #35

I've been using a simple Javascript whitelist/blocker for the last 4 years or so (a dead-simple Safari content blocker for iOS and Mac I wrote myself; syncs over iCloud just to give me something to do) and I honestly don't know how anyone can stand the wide-open web without something similar. Using the web with free Javascript privileges is an utterly appalling experience. I can't stand it for more than 5 seconds.

I don't suppose you've open sourced that somewhere?

My work has switched to iPhones, and I really miss NoScript when using Safari

Re: Don't touch my clipboard

#39

Post by oefrha »

cortesoft wrote: post #37
smichel17 wrote: post #14

The wrongest thing about this, from my perspective, is that my browser fires off a js 'copy' event when I press control-c. There are times when I've found it helpful that a browser can copy text to my clipboard when I click a button, but I can't think of a single time when I want a site to react to my attempt to copy text off if it. Is there any way to configure my user agent (Firefox) not to do this? A hack is ok.

I think the wrongest thing is that this is a clear attack vector... make a site with helpful Linux shortcuts, then replace every copy with "curl malicious script and run it, plus a newline to make it run immediately"

> plus a newline to make it run immediately

I already mentioned this in another comment, but everyone should enable bracket paste mode in their shell to defend against this.

https://cirw.in/blog/bracketed-paste

Re: Don't touch my clipboard

#40

Post by josephg »

0zymandiass wrote: post #27
ebg13 wrote: post #24

Earlier quoted context omitted.

I'm pretty sure this breaks copying from google docs.

I can highlight and ctrl+c without issue in their Writer clone. Never tried any others. I've only ever seen that setting fix sites that try to prevent you from copying.

I’ve used clipboard events for legitimate uses - for example I use them in this pseudo Turing sandpit / visual programming system to move, copy and export content: https://steam.dance/ (you can hold shift for a selection box and once selected you can copy, etc).

But I wouldn’t be surprised if stuff like this is the exception rather than the rule. I feel like most news sites and blogs are improved with JavaScript disabled.

Post reply on HN