Earlier quoted context omitted.
Wonder if an author will rename themself sudo rm -rf / with the proper escape codes.
Bobby wants his tables back!
:D
Don't touch my clipboard
131–140 of 322 posts
Re: Don't touch my clipboard
#132Earlier quoted context omitted.
I really care about security and lament that most people don't, but maybe they've the right idea and I'm just wasting my time. There are simply too many holes to plug :/
How do you want the clipboard to work then? To my mind, the whole point is to provide a way to move information within and between applications.
Would it be so hard to say “when I press command-v, send a paste event to the focused window containing my clipboard contents”? Sure some programs would want to customize keybindings, so unrestricted access could be allowed on a per-app basis, but why should any app I install have access to all of my copy events ever?
Similarly for private files: MacOS already alerts you when something tries to read from “~/Desktop” for the first time, why not allow users to extend that to “~/.ssh” and “~/.gpg” too?
Re: Don't touch my clipboard
#133Earlier quoted context omitted.
I really care about security and lament that most people don't, but maybe they've the right idea and I'm just wasting my time. There are simply too many holes to plug :/
How do you want the clipboard to work then? To my mind, the whole point is to provide a way to move information within and between applications.
Yup. The fundamental problem are the evil apps that steal your keys and add ads to the text you copy. You can't take away the means for them to do it without neutering the entite system itself (an experiment in doing just that is happening on the web and in mobile space right now).
Re: Don't touch my clipboard
#134Earlier quoted context omitted.
I think the wrongest thing is that this is a clear attack vector... make a site with helpful Linux shortcuts, then replace every copy with "curl malicious script and run it, plus a newline to make it run immediately"
As I also noted in a sibling comment, you don't even need JS to do that: https://jsfiddle.net/eaL153uz/
I might start to be grateful for the screen reading software - these tricks fortunately don't work when you use NVDA or Orca, because they have its own virtual buffer and they intercept the copy command soon enough that the browser has no idea about it.
Re: Don't touch my clipboard
#135You're giving sites permission to do this when you browse the web with browser that automatically executes whatever code it is sent. They're not forcing you, you're going there and you're asking for it and doing it yourself. There's an easy solution. Stop. Don't run JS by default.
OP is simply asking for a compromise, a better solution that yours. Instead of avoiding JS altogether, don’t give it access to things it should never have access / no business mucking around
There's a tension here, though. Having access to things like this is the whole point of having JS in the first place. The web is just full of assholes, so you experience the abuse as often - or even more often - than the proper use of JS.
Not sure how to approach it. JS whitelist is a stopgap solution, but not a particularly convenient one, and it doesn't always work.
Re: Don't touch my clipboard
#136The wrongest thing about this, from my perspective, is that my browser fires off a js 'copy' event when I press control-c. There are times when I've found it helpful that a browser can copy text to my clipboard when I click a button, but I can't think of a single time when I want a site to react to my attempt to copy text off if it. Is there any way to configure my user agent (Firefox) not to do this? A hack is ok.
about:config -> dom.event.clipboardevents.enabled = false You can't do it through a user agent, though
Be aware that some websites will completely break when pasting when this is disabled (e.g. Twitter, Facebook, probably more).
Re: Don't touch my clipboard
#137Just wait until they place an ad in your clipboard
This already is an ad. They're betting on you pasting what you copied straight into a communicator.
Re: Don't touch my clipboard
#138Earlier quoted context omitted.
Because for some reason terminals are stuck in the 70ies and don't accept those characters as quotes. Anything but ASCII trips them up. Seems such an obvious interface to innovate, but it seems to run into terminal wizards sense of purity.
The problem, such as it is, is with languages. Terminals (mine at least) handle most of Unicode just fine; admittedly I've seen it choke on emoji, but punctuation, nah. The vast majority of programming languages are defined in terms of ASCII and only ASCII. I don't care for this, personally. I've given some thought to how to do quoting right in a programming language, and implemented «guillemets» as an experiment. Bu…
> I've given some thought to how to do quoting right in a programming language
Already fully designed and implemented in Raku: https://docs.raku.org/language/unicode_entry#Smart_quotes
Test online: https://tio.run/##K0gtyjH7//9Rw7ySjMxiBSBKVChOzStJzUtOfdQw9/...
Re: Don't touch my clipboard
#139Earlier quoted context omitted.
In Firefox this behaviour has been closed as WONTFIX for >10 years [1] and actually accepted for more like 20 years [2]. [1] https://bugzilla.mozilla.org/show_bug.cgi?id=504748 [2] https://bugzilla.mozilla.org/show_bug.cgi?id=39098#c23
I mean, there's a reason why it's WONTFIX, down in the 4th comment: https://bugzilla.mozilla.org/show_bug.cgi?id=504748#c4
That's not a reason, it's a flimsy excuse to avoid implementing a non-trivial feature. The fact that there are non-JS ways to pollute the clipboard does not mean it's pointless to protect the user from JS based clipboard abuse. The fact that some web apps have legitimate use cases for augmenting copied data does not mean the browser should default to providing that functionality to every page.
Re: Don't touch my clipboard
#140Earlier quoted context omitted.
Millions of people use applications with these kinds of features. A few more examples: the Scratch educational programming tool, website builders such as Webflow, diagram editors, image editors, etc. The list goes on and on. The browser is no longer just a document viewer... That ship has sailed, and overall it is a good thing. We can mitigate the risk of clipboard hijacking without burning down the house. By the way…
A decent workaround would be to have 2 clipboards. The regular untouched one and the special one. Then when you paste, apps which only take plain text will grab the regular one and apps which accept formatted copying will grab the special clipboard but also provide a "paste as plain text" so the user gets what they want every time.
You don't have two clipboards? It's been the default on *nix OSes for ages. Ctrl+C/Ctrl+V works, but there is also the select/middle-mouse clipboard. Great for crap websites that hijack one.