Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

With Firefox on X11, any page can pastejack you anytime (middle button paste)

openwall.com

Post reply on HN
Print view View original

171–180 of 195 posts

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#171

Post by hollerith »

arp242 wrote: post #126
hollerith wrote: post #61

Earlier quoted context omitted.

>You should always paste into an editor first and that editor should not be running "inside" a terminal -- or rather I don't understand why those that like interacting with their editor via a terminal interface don't create a new protocol that doesn't have the warts and vulnerabilities the current ancient protocol has.

Compatibility, basically. e.g. Vim creating their own protocol is rather pointless if no terminal implements it, and some terminal creating their own protocol is also rather pointless without application support. Plus there's tons of software out there and it'll take a long time for it all to be rewritten, if that ever happens. e.g. X11 will still be around for a long time as well. So you will need to remain compatib…

There are dozens of toolkits for authoring GUIs, which are much more complicated than the protocol we are talking about and consequently much more work, so, no I don't see why the Vim project cannot take on the work of defining a new protocol and maintaining a client that speaks the protocol.

The hairiest Emacs Lisp code I know about is the code for responding to mouse actions, e.g., clicking and dragging, and most Vim users don't even want to use a pointing device to interact with Vim IIUC. (In contrast, 80% of Emacs users who responded to a survey do not interact with Emacs through a terminal interface.)

For example, the old scripting language Tcl has its own GUI toolkit named Tk that has a pretty good reputation.

>And all things considered, it's not that bad

It seems bad enough to me to be worth re-architecting.

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#172

Post by dllthomas »

An interesting thing about X11 pasting is that the way it's implemented (a request to the server to send a request event to the owner of the selection in question) the place you're pasting from can actually see who is requesting the info and could make decisions based on that (even prompting for verification). I always thought that would be a great security feature for a password manager, though I don't know if any actually do it.

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#173

Post by suby »

snailmailman wrote: post #141
a1369209993 wrote: post #130

Earlier quoted context omitted.

> I've tried to disable but none of the methods I’ve seen have worked You can fix this in the latest working firefox version with `about:config > middlemouse.paste = false` (I found this by browsing through about:config, so I'm not sure if it's decumented anywhere), but I'm not sure if that still works in the enshittified versions. (It doesn't prevent selected text from being middle-pasted into other applications, bu…

Yeah I’ve got it disabled in Firefox. And now that I’m looking into it more I’m seeing an option in VSCode, which is the other main place I keep pasting when trying to scroll. But this “feature” is enabled globally across XServer and is so deeply engrained that there is no global off switch. I must find workarounds for every application in order to make my middle mouse click function as I would expect. For an OS wher…

Agreed, I had a hell of a time switching to Linux in part due to the difficulty in disabling this feature everywhere. I simply hate it and do not want it. It doesn't bother me if other people like it, it doesn't even bother me if it's on by default, but why is it nearly impossible to disable? It's baffling.

We're having a conversation in this thread about whether or not the feature is good, but it shouldn't matter. People who like the behavior and people who don't should be able to live side by side, without one affecting the other. The issue is that the feature should not be forced.

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#174

Post by naruhodo »

torgard wrote: post #81
SubiculumCode wrote: post #34

The problem is the middle paste option in Firefox. To turn it off do as follow: open a new tab type: about:config Accept the prompt type middlemouse.paste change value “true” to “false” (double click or switch on the rightside) restart firefox --does this solve it?

No, that's only for pasting specifically. It's copy that's an exploit vector. To disable it, set clipboard.autocopy to false.

That doesn't do anything.

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#175

Post by arp242 »

hollerith wrote: post #171
arp242 wrote: post #126

Earlier quoted context omitted.

Compatibility, basically. e.g. Vim creating their own protocol is rather pointless if no terminal implements it, and some terminal creating their own protocol is also rather pointless without application support. Plus there's tons of software out there and it'll take a long time for it all to be rewritten, if that ever happens. e.g. X11 will still be around for a long time as well. So you will need to remain compatib…

There are dozens of toolkits for authoring GUIs, which are much more complicated than the protocol we are talking about and consequently much more work, so, no I don't see why the Vim project cannot take on the work of defining a new protocol and maintaining a client that speaks the protocol. The hairiest Emacs Lisp code I know about is the code for responding to mouse actions, e.g., clicking and dragging, and most V…

But GUI toolkits work very different; ProgA can link against GTK, ProgB against Qt, ProgC against Tk, and that all just peacefully coexist without problems (short of perhaps some UI inconsistencies). None of these toolkits have to even be aware that the others exist for it all to work; there is no shared protocol (other than the system itself: X11, whatever Windows has, etc. – and look at how long s/X11/Wayland/ is taking, and there is considerable disagreement whether Wayland is even an improvement in the first place).

But in a terminal all code runs in that terminal, and terminal programs don't "link against" a terminal in the same way that you do with a GUI toolkit. You need to implement a shared protocol on both ends.

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#176

Post by superkuh »

jwilk wrote: post #22
superkuh wrote: post #16

This does not require javascript to be running either, that surprised me. But it's not that big of an issue.

> This does not require javascript to be running either What do you mean?

I just went back to try again and I was wrong. I must have unthinkingly highlighted some text from the prior explanation page and that was in my middle click paste buffer without me knowing it. I thought that text was the demo and it worked with JS off. It doesn't. Sorry.

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#177

Post by tiberious726 »

lolinder wrote: post #121
philistine wrote: post #83

Earlier quoted context omitted.

Not OP, but I can say that it is a mode, which is its problem. You enter into the scroll mode and while not difficult per se to exit it can cause confusion. It is also pretty superfluous in the age of the touchpad and the ubiquity of the scroll wheel. Just another example of Microsoft working really hard to make Windows 11 look simpler, but not working on making it meaningfully simpler.

I don't know when middle-click scroll was introduced, but it definitely was before Windows 11, and at least as far back as 7. Also, "no modes" is both a question of personal preference and a sliding scale. Input-has-focus is a mode, too, but getting rid of that would be an obvious mistake.

Yeah, it's not a new thing, but an ancient thing, from the days of the button mice (a third button in the center---no scroll wheel).

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#178

Post by wkat4242 »

redwall_hp wrote: post #138
macNchz wrote: post #31

The X “primary selection”/middle click paste behavior this takes advantage of is one of my least favorite Linux features and I have had it disabled for years, so I didn’t even know it had been changed/removed in Wayland. Having a single mouse button (that often has other functionality like autoscroll in Firefox) cause text highlighted in another app to paste in the focused app is super unintuitive to me, and caused a…

Yeah, I absolutely hate it. MacOS is the only system with sane handling of copying and pasting, because it doesn't have that obnoxious thing and it doesn't overload the ctrl key. Command+C doesn't interfere with ctrl+C in terminals. Copying should always be deliberate, not something that blasts out your clipboard when you click in the wrong place and select something unintentionally. And middle click is for opening t…

This is a nice thing about macOS yes, not having to use a different key in terminal.

However it's a nightmare when you use a mix of OSes every day as I do :(

Re: With Firefox on X11, any page can pastejack you anytime (middle button paste)

#180

Post by arp242 »

charcircuit wrote: post #165
lolinder wrote: post #160

Earlier quoted context omitted.

Oh, I missed that! I've been mostly on Linux since before Windows 10.

FYI Window's clipbord history has better security than what desktop Linux has. For example desktop Linux currently has no way to copy an image and specify that the contents are sensitive and should not be added to the history. Poor API design and the inability for APIs like the clipboard to evolve are part of the reason why desktop Linux's security keeps falling behind other operating systems.

How do you copy something without adding it to the clipboard history? I can't find how to do that?

Either way, I'm pretty sure it could be added if someone cared enough, e.g. by adding a new target.

It just seems to me that if someone is able to access your clipboard history you've lost already, and the entire feature seems more of a convenience thing than a security thing.

Post reply on HN