Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

With Firefox on X11, any page can pastejack you anytime (middle button paste)

openwall.com

Post reply on HN
Print view View original

61–70 of 195 posts

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#61

Post by hollerith »

b112 wrote: post #9

You should always paste into an editor first, just copying any text from a webpage is a risk. There are even examples using terminal escape codes, to hide what happened. https://www.reddit.com/r/privacy/comments/rv964x/comment/hr4...

>You should always paste into an editor first

and that editor should not be running "inside" a terminal

-- or rather I don't understand why those that like interacting with their editor via a terminal interface don't create a new protocol that doesn't have the warts and vulnerabilities the current ancient protocol has.

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#62

Post by subtra3t »

yndoendo wrote: post #49
macNchz wrote: post #31

The X “primary selection”/middle click paste behavior this takes advantage of is one of my least favorite Linux features and I have had it disabled for years, so I didn’t even know it had been changed/removed in Wayland. Having a single mouse button (that often has other functionality like autoscroll in Firefox) cause text highlighted in another app to paste in the focused app is super unintuitive to me, and caused a…

I cannot stand any Operating System that does not utilize left-click highlight and middle click paste. This is great secondary buffer to the clipboard Ctrl+C && Ctrl+V. I HATE the middle click scrolling feature that Windows uses, it is not user-friendly and not needed in the age of the scroll-wheel. Another reason you have to pay me to use Windows.

You are not the only user.

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#63

Post by Jasper_ »

voxic11 wrote: post #60
somat wrote: post #25

Earlier quoted context omitted.

Not that it matters, but it does not really put it into a buffer at least not in the sense that there is a place within X11 that is storing your selection. I think that when you paste the primary selection. X11 directs your application to the application that last selected something and you ask it for the selected bit in a specific (usually text) format. More on topic, this works fine within the trusted green zone of…

So in X11 if you select something then close the application then middle click paste into another application nothing will happen?

There are "clipboard managers" that will internally copy the last copied thing as best it can from the clipboard owner, and then when the application exits, will mark its copy as the clipboard owner going forward. If you aren't running a clipboard manager, then yes, nothing will happen.

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#64

Post by lstodd »

voxic11 wrote: post #60
somat wrote: post #25

Earlier quoted context omitted.

Not that it matters, but it does not really put it into a buffer at least not in the sense that there is a place within X11 that is storing your selection. I think that when you paste the primary selection. X11 directs your application to the application that last selected something and you ask it for the selected bit in a specific (usually text) format. More on topic, this works fine within the trusted green zone of…

So in X11 if you select something then close the application then middle click paste into another application nothing will happen?

Yep.

Lose selection === unable to copy. And it's at all times up to source app to decide what it will allow to be copied.

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#65

Post by layer8 »

macNchz wrote: post #31

The X “primary selection”/middle click paste behavior this takes advantage of is one of my least favorite Linux features and I have had it disabled for years, so I didn’t even know it had been changed/removed in Wayland. Having a single mouse button (that often has other functionality like autoscroll in Firefox) cause text highlighted in another app to paste in the focused app is super unintuitive to me, and caused a…

I don’t care about middle-click paste, but having selection auto-copy is also implemented by terminal emulators like Putty on Windows, and I wouldn’t want to miss that.

What’s problematic with the Firefox behavior is that content gets copied (pasted) that wasn’t selected by the user.

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#66

Post by teo_zero »

voxic11 wrote: post #60
somat wrote: post #25

Earlier quoted context omitted.

Not that it matters, but it does not really put it into a buffer at least not in the sense that there is a place within X11 that is storing your selection. I think that when you paste the primary selection. X11 directs your application to the application that last selected something and you ask it for the selected bit in a specific (usually text) format. More on topic, this works fine within the trusted green zone of…

So in X11 if you select something then close the application then middle click paste into another application nothing will happen?

Correct

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#67

Post by layer8 »

SubiculumCode wrote: post #34

The problem is the middle paste option in Firefox. To turn it off do as follow: open a new tab type: about:config Accept the prompt type middlemouse.paste change value “true” to “false” (double click or switch on the rightside) restart firefox --does this solve it?

Why do you bother writing this up without even testing it?

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#68

Post by kevin_thibedeau »

macNchz wrote: post #31

The X “primary selection”/middle click paste behavior this takes advantage of is one of my least favorite Linux features and I have had it disabled for years, so I didn’t even know it had been changed/removed in Wayland. Having a single mouse button (that often has other functionality like autoscroll in Firefox) cause text highlighted in another app to paste in the focused app is super unintuitive to me, and caused a…

It's not a Linux feature. It's an X11 feature that is super intuitive if you've been using it for 30 years. Wayland tried to remove it but it has been begrudgingly allowed because of it's incredible usefulness since it cuts out all keyboard interaction.

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#69

Post by dotancohen »

yndoendo wrote: post #49
macNchz wrote: post #31

The X “primary selection”/middle click paste behavior this takes advantage of is one of my least favorite Linux features and I have had it disabled for years, so I didn’t even know it had been changed/removed in Wayland. Having a single mouse button (that often has other functionality like autoscroll in Firefox) cause text highlighted in another app to paste in the focused app is super unintuitive to me, and caused a…

I cannot stand any Operating System that does not utilize left-click highlight and middle click paste. This is great secondary buffer to the clipboard Ctrl+C && Ctrl+V. I HATE the middle click scrolling feature that Windows uses, it is not user-friendly and not needed in the age of the scroll-wheel. Another reason you have to pay me to use Windows.

A few years ago, after being unable to configure OS-X for highlight-copy and middle-click-paste, I turned in the brand new MacBook and requested a simple laptop to install Debian and KDE on.

I hardly ever touch the mouse, but if I am using it then I'm most likely copying and pasting. Don't make that difficult.

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#70

Post by xigoi »

ndriscoll wrote: post #50
Zetobal wrote: post #2

Who pastes something and executes it without a second look?

Why is it so easy to find people in this industry who don't care that users can't trust their own computers (or, by extension, anything they own with a computer in it, which is quickly becoming everything)? If I select some text and press Ctrl+C, it should copy the text I selected. The user intent is obvious. There's no excuse for the ability to hijack the clipboard to exist in the first place. Web pages shouldn't be…

> Web pages shouldn't be able to modify my selection. Why is there even an API for this?

To make “copy to clipboard” buttons possible.

Post reply on HN