Live data from Hacker News

Don't touch my clipboard

alexanderell.is

151–160 of 322 posts

Re: Don't touch my clipboard

#152
post #88
post #39

Earlier quoted context omitted.

> plus a newline to make it run immediately I already mentioned this in another comment, but everyone should enable bracket paste mode in their shell to defend against this. https://cirw.in/blog/bracketed-paste

I always just type "#" first before pasting... That way it is just a comment I can inspect before running

If you're using Readline (most Bash or similar shells do), then C-x C-e will invoke the editor, and you can paste the output into that.

Pray for no escape, bang, or control sequences.

(Alternatively: "r! cat -D" will read into a vim session.)

Examine the output, trim the unwanted / dangerous bits, and run (or save to a file/script).

Since I run what are ... generously ... considered "bash one-liners" all the time, that key sequence is locked into my muscle memory. It's a convenient way to invoke an editor immediately and run code from it.

Re: Don't touch my clipboard

#153

Earlier quoted context omitted.

No, iBooks inserting them around commands is the problem.

Inserting ASCII quotes instead would result in exactly the same problem.

Not exactly the same. Since anything inside ASCII quotes is typically considered a valid string in most programming languages, if you delete everything after the final quotation mark you have a syntactically valid program. It won't do what you want, but it's not a syntax error.

So unicode quotes and ASCII quotes are not exactly the same in this scenario.

Re: Don't touch my clipboard

#154

I can read & write a language that I don't have a keyboard for (I use a standard US 101 key layout), so I work around this by cut & pasting single characters around to fix up the missing accent characters. Usually even a partially fixed word is enough for the spell checker to kick in and correct the rest, making this surprisingly fast. The thing that annoyed me recently is that if I cut & paste a single character in…

> I work around this by cut & pasting single characters around to fix up the missing accent characters.

Let me save you some time in the future. You did not identify the OS and language/script you have trouble with, so my answer has to be kinda generic.

First have a look whether your OS keyboard settings or a third party provides an en_US-101 compatible logical layout that adds more accented characters (typically accessed with right Alt¹) or extra modifier keys² (in addition to acute, grave, tilde), then install it and memorise the characters you need. Oftentimes, this is easy because it's mnemonic, e.g.

    AltGr+l → ł
    AltGr+d → ð
    AltGr+o → ø
    dead_tilde N → Ñ
    dead_double_acute o → ő
    dead_circumflex dead_hook O → Ổ
If that's not sufficient or too cumbersome, look into compose key³. That system is user extensible, more powerful because it provides not just accented characters, and to the most part has better mnemonics; e.g.:

    compose U G → Ğ
    compose " y → ÿ
    compose a e → æ
    compose t , → ț
    compose v z → ž
    compose I . → İ
    compose u o → ů
    compose c | → ¢
    compose . . → …
¹ http://enwp.org/AltGr_key ² http://enwp.org/Dead_key ³ http://enwp.org/Compose_key

Re: Don't touch my clipboard

#155

Earlier quoted context omitted.

Millions of people use applications with these kinds of features. A few more examples: the Scratch educational programming tool, website builders such as Webflow, diagram editors, image editors, etc. The list goes on and on. The browser is no longer just a document viewer... That ship has sailed, and overall it is a good thing. We can mitigate the risk of clipboard hijacking without burning down the house. By the way…

A decent workaround would be to have 2 clipboards. The regular untouched one and the special one. Then when you paste, apps which only take plain text will grab the regular one and apps which accept formatted copying will grab the special clipboard but also provide a "paste as plain text" so the user gets what they want every time.

Those apps are surely already doing that - I don't think there's a way of copying arbitrary structured data to the web's abstraction of the clipboard. It doesn't address the problem the op raised - that browsers can sniff the copy event.

Re: Don't touch my clipboard

#156

Earlier quoted context omitted.

Millions of people use applications with these kinds of features. A few more examples: the Scratch educational programming tool, website builders such as Webflow, diagram editors, image editors, etc. The list goes on and on. The browser is no longer just a document viewer... That ship has sailed, and overall it is a good thing. We can mitigate the risk of clipboard hijacking without burning down the house. By the way…

A decent workaround would be to have 2 clipboards. The regular untouched one and the special one. Then when you paste, apps which only take plain text will grab the regular one and apps which accept formatted copying will grab the special clipboard but also provide a "paste as plain text" so the user gets what they want every time.

There are already (at least) two clipboards in many platforms.

X11/Xorg has the primary and secondary selections.

MacOS has ... whatever it's got.

A key problem with this is that the feature is covert, latent, poorly discoverable, and causes unexpected behaviours. Even presumably advanced users (myself, you, other HN readers) are poorly aware of this. Imagine trying to explain to your nontechnical Aunt Tilly or Uncle Kamlesh about these "different clipboards which treat what you've copied differently and access through this funky interface"?

Re: Don't touch my clipboard

#157

Just want to share that there's also good reasons for employing this technique. Eg if you select text in Slack that has emojis or formatting, it tries to put plain-text into the clipboard that would produce said emojis and formatting when pasted back into Slack. This is great, and every chat app does does formatted stuff should do this. I'd hate it if browser vendors would attempt to block this and as a result, break…

Except that your example is only “great” because Slack is reimplementing text input- another thing that maybe should just be handled by the system. Is it great that Slack also has its own autocorrect and doesn’t know about the system autocorrect?

I'm not sure how autocorrect is related.

How would you let text input with emojis and formatting and code blocks be "handled by the system"? I agree that on most platforms, emojis are a solved problem (although the UX could be better), but the rest isn't.

Sure, like all chat apps, what Slack does is a workaround around system limitations. But the limitations are there, and they need the "copy" event to make their hack work end to end.

Re: Don't touch my clipboard

#158
post #42

Earlier quoted context omitted.

You can turn off JavaScript. This has the added benefit of disabling most tracking and advertising.

As well as disabling most of the internet. It makes more sense to turn off the bad apis individually and block known tracking domains.

We've been through the blacklisting argument numerous times: spam, viruses, adware, malware, spyware, browser adblocking, etc.

It ... ultimately doesn't scale. The black-hat namespaces are too large, and treating as TOFU eventually proves untenable.

Advanced features -- anything beyond rendering basic HTML, and I'd be quite prepared to argue for a very limited subset of that -- should be expressly prohibited unless enabled.

The trick is to make enabling reasonably painless and consequence-free (e.g., enable into a sandbox). There are still the problems of users gratuitously enabling anything and everything (especially when prompted through website notifications, pop-ups, phishing and vishing social engineering attacks, etc.), as well as the problem of largely invisible second and higher-order effects.

But the key is to cut down on the effectiveness of such methods, to impose costs on websites for employing them, and to make black-hat attacks through these too expensive by reducing the herd susceptibility to the attacks (the unbocking would have to occur on a one-at-a-time case-by-case basis, e.g., it's expensive and has limited scalability).

I don't think we'll actually see this for another 5-10 years (my usual sane-suggestion take-up lead time, it seems), but It Would Certainly Be Nice To See.

Re: Don't touch my clipboard

#159
post #99

Earlier quoted context omitted.

Ok but those are standard, valid characters like any others. Why are they ‘horrid’?

Because for some reason terminals are stuck in the 70ies and don't accept those characters as quotes. Anything but ASCII trips them up. Seems such an obvious interface to innovate, but it seems to run into terminal wizards sense of purity.

That seems like an obviously bad solution. That is like writing [a(b{c]d}e) except that the quote characters look even more similar.

Re: Don't touch my clipboard

#160

Earlier quoted context omitted.

> I can't think of a single time when I want a site to react to my attempt to copy text off if it. Any time you're not interacting with HTML text is a time it could be useful.

Specifically, things like copying a cell of data in Google Sheets for example.

Copying from HTML tables is already sane.
Post reply on HN