Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Don't touch my clipboard

alexanderell.is

Post reply on HN
Print view View original

241–250 of 322 posts

Re: Don't touch my clipboard

#241

Post by dredmorbius »

majewsky wrote: post #232
dredmorbius wrote: post #152

Earlier quoted context omitted.

If you're using Readline (most Bash or similar shells do), then C-x C-e will invoke the editor, and you can paste the output into that. Pray for no escape, bang, or control sequences. (Alternatively: "r! cat -D" will read into a vim session.) Examine the output, trim the unwanted / dangerous bits, and run (or save to a file/script). Since I run what are ... generously ... considered "bash one-liners" all the time, th…

> :r! cat -D Alternatively, call a utility that can read the clipboard directly. For Xorg: :r! xsel -b For Wayland: :r! wl-paste

That depends on whether or not the clipboard is directly accessible or not. When invoking an editor remotely via SSH, for example, it's not. Though there's often the ability to past into the controlling terminal locally.

I do this frequently on Android via Termux, ssh'ing to remote hosts.

Re: Don't touch my clipboard

#242

Post by superkuh »

anigbrowl wrote: post #127
superkuh wrote: post #119

You're giving sites permission to do this when you browse the web with browser that automatically executes whatever code it is sent. They're not forcing you, you're going there and you're asking for it and doing it yourself. There's an easy solution. Stop. Don't run JS by default.

- This bathtub has a hole in it - Just throw it and the baby away, problem solved

It's not the first time this would be required and done. You probably remember Flash. Once Flash was kicked out Javascript took over it's duties. Only you can't just simply block all JS or expect sites to work without it. JS is worse than Flash now.

Re: Don't touch my clipboard

#243

Post by paxdoxemus »

stassats wrote: post #186
stefco_ wrote: post #51

It's not just a browser thing. Apple Books does this with their e-books, which is infuriating if you're working with a coding book and just want to copy-paste stuff into your editor/terminal. You get something like: “ghci> putStrLn (pretty 10 value)” Excerpt From: Bryan O’Sullivan, John Goerzen, and Donald Bruce Stewart. “Real World Haskell.” Apple Books. When you only copied: ghci> putStrLn (pretty 10 value) Note th…

I solved the Apple Books problem with an automator script, using the "Copy to Clipboard" action. Then it can be assigned a shortcut in Keyboard preferences. https://imgur.com/a/sG2isap

This was really helpful, thanks for sharing!

Re: Don't touch my clipboard

#244

Post by alkonaut »

dredmorbius wrote: post #237
alkonaut wrote: post #224

Earlier quoted context omitted.

> The clipboard should not, nor should applications be able to, alter the copied content from the visibly-selected content. This might feel intuitively right, but it severly limits the usefulness of the clipboard. It then becomes a basic plain text clipboard Try opening an rich text editor (e.g. https://quilljs.com/playground/ ) and selecting two words of which one is bold. Hit Ctrl+C. What is now on the clipboard? W…

If you want to pass rich text or spreadsheet cell formulae, display those before selecting . Which puts the onus on the application to provide that functionality. That preserves the functionality, respects the "copy visibly-selected content" directive, and makes clear just what is being saved to the clipboard, making sneak attacks more difficult. Argument that the clipboard behaves in a way that is demonstrably prone…

Not sure I follow, how should the argument display the rich text (markup/formatting instructions) before the selection?

The displayed/selected content might be

Foo Bar

but the content I want on the clipboard could be

Foo Bar

but I never want to see the markup, only the formatted text. I don’t want to make a two step function where I need to reveal a textual description of the content and select that. The markup might be a base64 encoded piece of binary gibberish in the case of a visual diagram for example.

Re: Don't touch my clipboard

#245

Post by bzbarsky »

smichel17 wrote: post #14

The wrongest thing about this, from my perspective, is that my browser fires off a js 'copy' event when I press control-c. There are times when I've found it helpful that a browser can copy text to my clipboard when I click a button, but I can't think of a single time when I want a site to react to my attempt to copy text off if it. Is there any way to configure my user agent (Firefox) not to do this? A hack is ok.

There's the "dom.event.clipboardevents.enabled" preference, which you can set to false in about:config.

I don't know whether that's planned to stick around or whether it was added when the clipboard event support was still experimental and will be removed at some point. But I suspect the former, for precisely the reasons in this thread.

Note that disabling these events will likely break "smart" copy/paste in things like Google Sheets, which is one reason it's not disabled by default....

Re: Don't touch my clipboard

#246

Post by bzbarsky »

na85 wrote: post #76
maple3142 wrote: post #72

Earlier quoted context omitted.

> I can't think of a single time when I want a site to react to my attempt to copy text off if it. I think it is needed for some complex web app to handle copying non-text content. Such as images in wysiwyg editor, Google Sheets/Slides...

So trade those apps not working for immunity from JavaScript clipboard hijacking? I'd be 110% fine with that trade and nothing of value to me would be lost. Is it possible in Firefox? Anyone know?

It's possible. See https://news.ycombinator.com/item?id=22356697

Re: Don't touch my clipboard

#247

Post by [deleted] »

smichel17 wrote: post #14

The wrongest thing about this, from my perspective, is that my browser fires off a js 'copy' event when I press control-c. There are times when I've found it helpful that a browser can copy text to my clipboard when I click a button, but I can't think of a single time when I want a site to react to my attempt to copy text off if it. Is there any way to configure my user agent (Firefox) not to do this? A hack is ok.

[deleted]

Re: Don't touch my clipboard

#249

Post by dredmorbius »

alkonaut wrote: post #244
dredmorbius wrote: post #237

Earlier quoted context omitted.

If you want to pass rich text or spreadsheet cell formulae, display those before selecting . Which puts the onus on the application to provide that functionality. That preserves the functionality, respects the "copy visibly-selected content" directive, and makes clear just what is being saved to the clipboard, making sneak attacks more difficult. Argument that the clipboard behaves in a way that is demonstrably prone…

Not sure I follow, how should the argument display the rich text (markup/formatting instructions) before the selection? The displayed/selected content might be Foo Bar but the content I want on the clipboard could be Foo Bar but I never want to see the markup, only the formatted text. I don’t want to make a two step function where I need to reveal a textual description of the content and select that. The markup might…

That would be unsupported functionality.

You cannot both have transparent copy capability and copy hidden content without revealing it.

Copying visual content would be subject to different requirements and limitations. But for text: what you see is what you get. If you're copying glyphs alone, those are what are copied. If you want formatting, you'll need to have the source application reveal that.

Re: Don't touch my clipboard

#250

Post by dan_hawkins »

belltaco wrote: post #52
stefco_ wrote: post #51

It's not just a browser thing. Apple Books does this with their e-books, which is infuriating if you're working with a coding book and just want to copy-paste stuff into your editor/terminal. You get something like: “ghci> putStrLn (pretty 10 value)” Excerpt From: Bryan O’Sullivan, John Goerzen, and Donald Bruce Stewart. “Real World Haskell.” Apple Books. When you only copied: ghci> putStrLn (pretty 10 value) Note th…

Wonder if an author will rename themself sudo rm -rf / with the proper escape codes.

`rm -rf ~` is disastrous enough on macOS with a bonus of not having to authentiacate sudo.
Post reply on HN