Live data from Hacker News

With Firefox on X11, any page can pastejack you anytime (middle button paste)

openwall.com

51–60 of 195 posts

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#52
post #5

I am surprised that Firefox freely allows access to the clipboard. I'm using Brave and there's an explicit permission for it that is disallowed by default.

I am using Brave on Linux where I do all my work as well that might by why "copy to CB" on websites do not work for me anymore. I think they did. But there is nothing asking me for permission or anything. I recently was on a website where it just did not work and I needed to manually copy pasta.

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#53
post #31

The X “primary selection”/middle click paste behavior this takes advantage of is one of my least favorite Linux features and I have had it disabled for years, so I didn’t even know it had been changed/removed in Wayland. Having a single mouse button (that often has other functionality like autoscroll in Firefox) cause text highlighted in another app to paste in the focused app is super unintuitive to me, and caused a…

I love middle click paste, in combination with ctrl+c/ctrl+v paste it's a second clipboard, which allows to do one kind of refactoring in between doing some other refactoring in code (as just one example). I didn't know wayland doesn't support that either, one more thing to add to the list of things it doesn't support like screenshots, xclip, mouse/keyboard automation, etc...

Wayland supports screenshots. I drive it daily and use that feature many times per day.

Can't talk about the others as I don't use them.

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#54
post #31

The X “primary selection”/middle click paste behavior this takes advantage of is one of my least favorite Linux features and I have had it disabled for years, so I didn’t even know it had been changed/removed in Wayland. Having a single mouse button (that often has other functionality like autoscroll in Firefox) cause text highlighted in another app to paste in the focused app is super unintuitive to me, and caused a…

Meanwhile it is one of my favorite ever features that speeds up many tasks during my average workday. :-) It takes a bit of care though especially if there are prod-impacting sessions open.

> It takes a bit of care though especially if there are prod-impacting sessions open.

That’s why I felt it was a bad default.

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#55
post #31

The X “primary selection”/middle click paste behavior this takes advantage of is one of my least favorite Linux features and I have had it disabled for years, so I didn’t even know it had been changed/removed in Wayland. Having a single mouse button (that often has other functionality like autoscroll in Firefox) cause text highlighted in another app to paste in the focused app is super unintuitive to me, and caused a…

I cannot stand any Operating System that does not utilize left-click highlight and middle click paste. This is great secondary buffer to the clipboard Ctrl+C && Ctrl+V. I HATE the middle click scrolling feature that Windows uses, it is not user-friendly and not needed in the age of the scroll-wheel. Another reason you have to pay me to use Windows.

What makes that feature "not user-friendly" instead of just a personal preference?

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#57

Earlier quoted context omitted.

I love middle click paste, in combination with ctrl+c/ctrl+v paste it's a second clipboard, which allows to do one kind of refactoring in between doing some other refactoring in code (as just one example). I didn't know wayland doesn't support that either, one more thing to add to the list of things it doesn't support like screenshots, xclip, mouse/keyboard automation, etc...

it doesn’t not support it, it doesn’t set this unexpected behaviour as default

Whether it's unexpected or not depends on the user, you could as well say ctrl+v pasting in windows is unexpected if you don't know this shortcut. Middle click paste in linux is a standard feature this OS has always had

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#58

You guys have a middle button? Maaaan. :) Edit: did y'all miss the smiley at the end of my comment?

When you don't have a middle button, mouse chording (left+right at the same time) is usually configured to simulate the middle button (for instance, the Emulate3Buttons option in the classic X server configuration). Once you get used to it, it's nearly as convenient as clicking a physical middle mouse button.

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#59
post #31

The X “primary selection”/middle click paste behavior this takes advantage of is one of my least favorite Linux features and I have had it disabled for years, so I didn’t even know it had been changed/removed in Wayland. Having a single mouse button (that often has other functionality like autoscroll in Firefox) cause text highlighted in another app to paste in the focused app is super unintuitive to me, and caused a…

Meanwhile it is one of my favorite ever features that speeds up many tasks during my average workday. :-) It takes a bit of care though especially if there are prod-impacting sessions open.

> It takes a bit of care though especially if there are prod-impacting sessions open.

"Other than that, Mrs. Lincoln, how was the play?"

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#60
post #25
post #19

Earlier quoted context omitted.

There are guardrails around access to the clipboard (and the post talks about the circumstances around it) but this exploit takes advantage of the fact that simply selecting text on X11 puts it in the primary selection buffer. The code just tells Firefox to select the text.

Not that it matters, but it does not really put it into a buffer at least not in the sense that there is a place within X11 that is storing your selection. I think that when you paste the primary selection. X11 directs your application to the application that last selected something and you ask it for the selected bit in a specific (usually text) format. More on topic, this works fine within the trusted green zone of…

So in X11 if you select something then close the application then middle click paste into another application nothing will happen?
Post reply on HN