Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

With Firefox on X11, any page can pastejack you anytime (middle button paste)

openwall.com

Post reply on HN
Print view View original

141–150 of 195 posts

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#141

Post by snailmailman »

a1369209993 wrote: post #130
snailmailman wrote: post #47

Earlier quoted context omitted.

It annoys me so much. I’ve tried to disable but none of the methods I’ve seen have worked for me. I use middle click to autoscroll, and to open things in new tabs or to close tabs. Then I try to middle click autoscroll in discord or something (which works in windows!) and I’ll paste in information that I don’t intend to. This is the first I’m hearing about Wayland fixing this. Maybe I’ll give Wayland yet another try…

> I've tried to disable but none of the methods I’ve seen have worked You can fix this in the latest working firefox version with `about:config > middlemouse.paste = false` (I found this by browsing through about:config, so I'm not sure if it's decumented anywhere), but I'm not sure if that still works in the enshittified versions. (It doesn't prevent selected text from being middle-pasted into other applications, bu…

Yeah I’ve got it disabled in Firefox. And now that I’m looking into it more I’m seeing an option in VSCode, which is the other main place I keep pasting when trying to scroll.

But this “feature” is enabled globally across XServer and is so deeply engrained that there is no global off switch. I must find workarounds for every application in order to make my middle mouse click function as I would expect.

For an OS where everything else is so customizable this baffles me.

I so frequently encounter problems where I proofread something (or my compiler finds it for me) and I find weird words or sentence fragments that I inserted on accident while navigating a document.

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#142

Post by dgl »

_flux wrote: post #74
b112 wrote: post #9

You should always paste into an editor first, just copying any text from a webpage is a risk. There are even examples using terminal escape codes, to hide what happened. https://www.reddit.com/r/privacy/comments/rv964x/comment/hr4...

My Tilix/zsh combination just pastes the content as a multi-line entry to the terminal. If the clipboard contains control codes (e.g. arrow up) they are entered verbatim (as if I had used the quoting function ^V to enter them). So I suppose we're not very far from this not being a problem in general. Though I understand this also works via control codes. I hope Tilix is smart enough to filter them out from the clipbo…

See my reply in the thread: https://www.openwall.com/lists/oss-security/2023/10/20/2 — not all terminals get this right.

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#143

Post by lolinder »

redwall_hp wrote: post #138
macNchz wrote: post #31

The X “primary selection”/middle click paste behavior this takes advantage of is one of my least favorite Linux features and I have had it disabled for years, so I didn’t even know it had been changed/removed in Wayland. Having a single mouse button (that often has other functionality like autoscroll in Firefox) cause text highlighted in another app to paste in the focused app is super unintuitive to me, and caused a…

Yeah, I absolutely hate it. MacOS is the only system with sane handling of copying and pasting, because it doesn't have that obnoxious thing and it doesn't overload the ctrl key. Command+C doesn't interfere with ctrl+C in terminals. Copying should always be deliberate, not something that blasts out your clipboard when you click in the wrong place and select something unintentionally. And middle click is for opening t…

> not something that blasts out your clipboard when you click in the wrong place and select something unintentionally

This isn't helped by the fact that the mainstream desktop OSes don't have proper clipboard managers bundled by default. Accidentally copying something isn't as big a deal when you have the most recent 200 items you've copied in an easily searchable widget.

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#144

Post by kibwen »

deathanatos wrote: post #120

… that they blocked the author's extension is like icing on this WTF cake. This is absolutely a bug, and almost certainly a security bug. If you consider pastejacking the clipboard within the threat model that you want to account for, selection-jacking like this is absolutely within it, as it's a superset in terms of bad behavior. (… but browsers have long maligned the primary selection on Linux. Neither Firefox nor…

> browsers have long maligned the primary selection

Not just browsers, users also rightfully malign the primary selection. I highlight text for all sorts of reasons (including because I already have something that I want to paste).

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#145

Post by chungy »

delecti wrote: post #131
lolinder wrote: post #121

Earlier quoted context omitted.

I don't know when middle-click scroll was introduced, but it definitely was before Windows 11, and at least as far back as 7. Also, "no modes" is both a question of personal preference and a sliding scale. Input-has-focus is a mode, too, but getting rid of that would be an obvious mistake.

Middle-click scroll has been around as long as I can remember having middle-click. At least as far back as Windows XP.

Windows 95 had it.

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#146

Post by t-3 »

oasisaimlessly wrote: post #113
codedokode wrote: post #105

Earlier quoted context omitted.

Having two clipboards is a bad decision. Also, trackpad doesn't have middle button.

Yep; I often wish there were three buffers! All trackpads I've tried support middle click via a three-finger tap.

Many also support click/tap areas, in which you define physical regions of the touchpad to correspond to button clicks.

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#147

Post by elric »

itvision wrote: post #26

This has been known for at least a decade or two already. And a much worse attack exists: you copy e.g. shell code from the page, and instead of what you see, you paste something evil in your terminal.

I don't see how the copy issue is worse. It relies on an explicit user action: selecting text in a browser window, and then copy/pasting that into a terminal. This requires three intentional steps.

Pages stealing your current middle-mouse-paste selection, however, only requires selecting text in another place, and it seems like the only way to defend against this is by not selecting text. Which, at least for me, is not really feasible.

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#148

Post by chungy »

macNchz wrote: post #31

The X “primary selection”/middle click paste behavior this takes advantage of is one of my least favorite Linux features and I have had it disabled for years, so I didn’t even know it had been changed/removed in Wayland. Having a single mouse button (that often has other functionality like autoscroll in Firefox) cause text highlighted in another app to paste in the focused app is super unintuitive to me, and caused a…

Conversely, the selection buffer and middle click paste are features I consider so essential to my workflow that I cannot stand any system that lacks them.

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#149

Post by elric »

nativeit wrote: post #134

This might be too controversial to say here, but I have no strong opinions on middle-click behavior one way or another.

TIL that middle-click pasting is a controversial feature. I guess people really can argue over anything.

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#150

Post by kstenerud »

macNchz wrote: post #31

The X “primary selection”/middle click paste behavior this takes advantage of is one of my least favorite Linux features and I have had it disabled for years, so I didn’t even know it had been changed/removed in Wayland. Having a single mouse button (that often has other functionality like autoscroll in Firefox) cause text highlighted in another app to paste in the focused app is super unintuitive to me, and caused a…

A colleague of mine once destroyed a customer's system with a middle mouse button fat finger.

He was copying a listing all of the executables in various locations on the machine he'd created using ls -l, into a text document (logged in as root). Unfortunately, he accidentally middle-clicked while moving the mouse to the text editor, and it pasted everything into the shell.

Since it was mostly symlinks in the standard /bin /sbin /usr/bin /usr/sbin etc, the shell dutifully redirected garbage into each destination binary, rendering the OS unusable.

Post reply on HN