Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

With Firefox on X11, any page can pastejack you anytime (middle button paste)

openwall.com

Post reply on HN
Print view View original

121–130 of 195 posts

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#121

Post by lolinder »

philistine wrote: post #83
wartijn_ wrote: post #55

Earlier quoted context omitted.

What makes that feature "not user-friendly" instead of just a personal preference?

Not OP, but I can say that it is a mode, which is its problem. You enter into the scroll mode and while not difficult per se to exit it can cause confusion. It is also pretty superfluous in the age of the touchpad and the ubiquity of the scroll wheel. Just another example of Microsoft working really hard to make Windows 11 look simpler, but not working on making it meaningfully simpler.

I don't know when middle-click scroll was introduced, but it definitely was before Windows 11, and at least as far back as 7.

Also, "no modes" is both a question of personal preference and a sliding scale. Input-has-focus is a mode, too, but getting rid of that would be an obvious mistake.

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#122

Post by arp242 »

everdrive wrote: post #109

How is this affected by settings in Firefox to prevent sites from reading the clipboard?

It's not. I have that disabled (mostly because I hate how GitHub completely mangles and fucks up anything I paste there) and it still works.

Arguably, it's "working as intended" because middle click is supposed to paste whatever is selected, and the JS did select some text. Fixing this in a way that won't cause UX regressions and can't be by-passed relatively easily might be rather tricky.

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#124

Post by [deleted] »

deathanatos wrote: post #120

… that they blocked the author's extension is like icing on this WTF cake. This is absolutely a bug, and almost certainly a security bug. If you consider pastejacking the clipboard within the threat model that you want to account for, selection-jacking like this is absolutely within it, as it's a superset in terms of bad behavior. (… but browsers have long maligned the primary selection on Linux. Neither Firefox nor…

[deleted]

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#125

Post by lolinder »

yndoendo wrote: post #49
macNchz wrote: post #31

The X “primary selection”/middle click paste behavior this takes advantage of is one of my least favorite Linux features and I have had it disabled for years, so I didn’t even know it had been changed/removed in Wayland. Having a single mouse button (that often has other functionality like autoscroll in Firefox) cause text highlighted in another app to paste in the focused app is super unintuitive to me, and caused a…

I cannot stand any Operating System that does not utilize left-click highlight and middle click paste. This is great secondary buffer to the clipboard Ctrl+C && Ctrl+V. I HATE the middle click scrolling feature that Windows uses, it is not user-friendly and not needed in the age of the scroll-wheel. Another reason you have to pay me to use Windows.

As a counterpoint: I love the middle-click scroll feature and use it on all platforms I can.

When I'm reading a long article, my usual strategy is to middle-click and then move the mouse to a position that causes the page to move in time with my reading speed. The continuous movement is a lot easier for my eyes to track than occasional bursts of scrolling, and I can tweak the scroll speed by subtly adjusting the mouse position. It's a bit like cruise control for scrolling.

I'm not saying you ought to use it, but you're decrying it as "not user-friendly" and "not needed" when what you really mean is "I don't like it" and "I don't use it".

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#126

Post by arp242 »

hollerith wrote: post #61
b112 wrote: post #9

You should always paste into an editor first, just copying any text from a webpage is a risk. There are even examples using terminal escape codes, to hide what happened. https://www.reddit.com/r/privacy/comments/rv964x/comment/hr4...

>You should always paste into an editor first and that editor should not be running "inside" a terminal -- or rather I don't understand why those that like interacting with their editor via a terminal interface don't create a new protocol that doesn't have the warts and vulnerabilities the current ancient protocol has.

Compatibility, basically.

e.g. Vim creating their own protocol is rather pointless if no terminal implements it, and some terminal creating their own protocol is also rather pointless without application support.

Plus there's tons of software out there and it'll take a long time for it all to be rewritten, if that ever happens. e.g. X11 will still be around for a long time as well. So you will need to remain compatible with the current protocol even if you invent something new and better, and in that sense it doesn't really fix anything., at least not right now. It might fix stuff 15 years down the line, maybe, but in-between now and 15 years everything will be more complex by having two protocols.

And all things considered, it's not that bad, IMHO. There's the KiTTY Keyboard protocol to solve some obvious UX issues with keyboard handling, which is a clear improvement and motivation, whereas some exploit vectors that don't really see live exploits isn't really.

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#127

Post by throwawaaarrgh »

Firefox tends to have worse security by default than other browsers so this isn't a surprise to me.

Most browser exploits are delivered by JavaScript, so the safest course of action is to use NoScript judiciously, run the browser in a VM, and pray.

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#128

Post by ndriscoll »

bee_rider wrote: post #102
ndriscoll wrote: post #82

Earlier quoted context omitted.

I have a copy to clipboard button that's standard across all apps and has decades of precedence: Ctrl+c. Some (older?) keyboards even label it! On my phone, if I select text, my browser pops up a menu with "copy" as an option. Why does a web page need to reinvent that wheel? For the 1/10000000 case where it makes sense, how about a "X page wants to modify your clipboard" dialog? This has been a known security vulnera…

Ctrl-c sends the interrupt signal. Remembering that in normal use (terminal) it sends interrupt, except for this one program (Firefox) where it copies would be pretty confusing and annoying.

Incorrect pedantry that ignores decades of established convention with GUI applications aside, the same incorrect behavior happens when you select, right click, and choose "copy". Any normal person would expect that it copies what you selected, and doesn't let the page instead place whatever it wants to into the clipboard.

The user tells their computer to do a simple thing, and the computer adversarially does not do that thing, and instead obeys someone else, intentionally. That should not happen.

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#129

Post by JellyBeanThief »

deathanatos wrote: post #120

… that they blocked the author's extension is like icing on this WTF cake. This is absolutely a bug, and almost certainly a security bug. If you consider pastejacking the clipboard within the threat model that you want to account for, selection-jacking like this is absolutely within it, as it's a superset in terms of bad behavior. (… but browsers have long maligned the primary selection on Linux. Neither Firefox nor…

Oh man. All I've used Linux on was a ThinkPad, and so I quickly discovered that MMB pasted. But I assumed it was just pasting from the clipboard. This explains so many times when what I Ctrl-C'd and what I MMB'd weren't the same and I naively chalked it up to mistyping or a bug in some software or anything else.

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#130

Post by a1369209993 »

snailmailman wrote: post #47
macNchz wrote: post #31

The X “primary selection”/middle click paste behavior this takes advantage of is one of my least favorite Linux features and I have had it disabled for years, so I didn’t even know it had been changed/removed in Wayland. Having a single mouse button (that often has other functionality like autoscroll in Firefox) cause text highlighted in another app to paste in the focused app is super unintuitive to me, and caused a…

It annoys me so much. I’ve tried to disable but none of the methods I’ve seen have worked for me. I use middle click to autoscroll, and to open things in new tabs or to close tabs. Then I try to middle click autoscroll in discord or something (which works in windows!) and I’ll paste in information that I don’t intend to. This is the first I’m hearing about Wayland fixing this. Maybe I’ll give Wayland yet another try…

> I've tried to disable but none of the methods I’ve seen have worked

You can fix this in the latest working firefox version with `about:config > middlemouse.paste = false` (I found this by browsing through about:config, so I'm not sure if it's decumented anywhere), but I'm not sure if that still works in the enshittified versions.

(It doesn't prevent selected text from being middle-pasted into other applications, but all my other disrupted-by-paste applications explicitly don't support middle-click-to-paste (in several cases because I deliberately wrote them that way), so I haven't gotten around to fixing that part yet.)

Post reply on HN