Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Don't fuck with paste

github.com

Post reply on HN
Print view View original

151–160 of 397 posts

Re: Don't fuck with paste

#151

Post by lowbloodsugar »

Nifty3929 wrote: post #133
jessriedel wrote: post #12

> In order to provide the smoothest experience as possible, the extension needs to know when you change active tabs. In order for the extension to know about that event, it needs the tabs permission, which Chrome describes as "can read and change all your data on websites you visit." That description is very scary, and is certainly not what this extension is doing. Being an open-sourced project, you can always read a…

This is a bit cynical isn't it, when the author is clearly being as transparent as possible about what they need and why, which is due to factors outside their control. Of course you're right in a technical sense. They could do whatever they want later. But still let's celebrate and attitude like this rather than criticizing it.

But WHY do they need that permission? They dont need it to implement the paste behavior. Looks super sus to me.

Re: Don't fuck with paste

#152

Post by vidarh »

BLKNSLVR wrote: post #143
S201 wrote: post #99

Earlier quoted context omitted.

> right in front of ultra short timeouts everywhere > If only I could meet the people who make these decisions in person... For what it's worth, I was once forced to implement a half hour auto-logout on a website that could hardly be considered as containing sensitive data because an external pentest firm flagged the lack of a short timeout as an issue. The only way we could show clients a passing pentest was to comp…

You must have had your shit pretty tight for the pen-tester to have to scrape that from the bottom of the barrel.

Sometimes they will just be excessive because nobody applies any kind of critical thinking and/or because they favour looking like they find a lot over any kind of precision. I once had a site where they insisted on disabling ping responses for the website, citing it as a serious security concern. Because surely nobody would otherwise know that the very public website was there.

I replied with listing a number of websites of security focused organisations whose websites responded to ping, including assorted security services, military, and the pentesting company's own website.

(I didn't object to them querying what actually responded to the ICMP requests - none of them made it past the firewall, which is what replied and revealed nothing of our internal infra - I objected to them ignoring that answer and still insisting it revealed things it demonstrably didn't, and that lack of understanding was consistent through their report)

Re: Don't fuck with paste

#153

Post by foofie »

Nifty3929 wrote: post #133
jessriedel wrote: post #12

> In order to provide the smoothest experience as possible, the extension needs to know when you change active tabs. In order for the extension to know about that event, it needs the tabs permission, which Chrome describes as "can read and change all your data on websites you visit." That description is very scary, and is certainly not what this extension is doing. Being an open-sourced project, you can always read a…

This is a bit cynical isn't it, when the author is clearly being as transparent as possible about what they need and why, which is due to factors outside their control. Of course you're right in a technical sense. They could do whatever they want later. But still let's celebrate and attitude like this rather than criticizing it.

> This is a bit cynical isn't it (...)

No, it's called security.

Let's put it this way: there have been FLOSS projects whose maintainers intentionally pushed compromised code to unsuspecting end users. See for example the colors attack.

What leads you to believe that good intentions are enough?

Re: Don't fuck with paste

#154

Post by beacon294 »

Nifty3929 wrote: post #133
jessriedel wrote: post #12

> In order to provide the smoothest experience as possible, the extension needs to know when you change active tabs. In order for the extension to know about that event, it needs the tabs permission, which Chrome describes as "can read and change all your data on websites you visit." That description is very scary, and is certainly not what this extension is doing. Being an open-sourced project, you can always read a…

This is a bit cynical isn't it, when the author is clearly being as transparent as possible about what they need and why, which is due to factors outside their control. Of course you're right in a technical sense. They could do whatever they want later. But still let's celebrate and attitude like this rather than criticizing it.

No, it's well documented. Popular Chrome plugins, mainly free ones, historically have been sold.

Re: Don't fuck with paste

#155

Post by shakna »

Nifty3929 wrote: post #133
jessriedel wrote: post #12

> In order to provide the smoothest experience as possible, the extension needs to know when you change active tabs. In order for the extension to know about that event, it needs the tabs permission, which Chrome describes as "can read and change all your data on websites you visit." That description is very scary, and is certainly not what this extension is doing. Being an open-sourced project, you can always read a…

This is a bit cynical isn't it, when the author is clearly being as transparent as possible about what they need and why, which is due to factors outside their control. Of course you're right in a technical sense. They could do whatever they want later. But still let's celebrate and attitude like this rather than criticizing it.

It's not cynical - see what happened to ublock. That kind of mess has happened, and will continue to happen, and should be a factor in what you choose to trust.

Re: Don't fuck with paste

#156

Post by nextlevelwizard »

jessriedel wrote: post #12

> In order to provide the smoothest experience as possible, the extension needs to know when you change active tabs. In order for the extension to know about that event, it needs the tabs permission, which Chrome describes as "can read and change all your data on websites you visit." That description is very scary, and is certainly not what this extension is doing. Being an open-sourced project, you can always read a…

The thing is there is no alternative way to do this. I have written some extensions my self and often you cant do anything without having full read and write access to every page.

For example I have an extension that lets you right click an image and rotate it by -90/+90/180 degrees. All I want is for the browser to hit me up when there is a `` tag, but that is not an option. Either I have to white list every page separately in the code or ask the user to white list every single page or just ask for full read and write permissions for every single web page the user visits.

Re: Don't fuck with paste

#157

Post by eviks »

lolinder wrote: post #132
eviks wrote: post #113

Earlier quoted context omitted.

But then you need to click Also you can get the extension loaded locally, and it will never update

I run into one of these broken-clipboard situations once every few months, I can afford to spend an extra click in order to not have an extension active on every website I ever visit.

It "ensure the extension is only running on sites that are bad actors with copy & paste events a", so what exactly can you not afford?

Re: Don't fuck with paste

#158

Post by Beldin »

Nifty3929 wrote: post #133
jessriedel wrote: post #12

> In order to provide the smoothest experience as possible, the extension needs to know when you change active tabs. In order for the extension to know about that event, it needs the tabs permission, which Chrome describes as "can read and change all your data on websites you visit." That description is very scary, and is certainly not what this extension is doing. Being an open-sourced project, you can always read a…

This is a bit cynical isn't it, when the author is clearly being as transparent as possible about what they need and why, which is due to factors outside their control. Of course you're right in a technical sense. They could do whatever they want later. But still let's celebrate and attitude like this rather than criticizing it.

This has been used as an attack vector in the past: spot reasonably popular plugin; make author an offer; inject whatever tracking/other malwate stuff new owners want (typically after a delay).

So now we'd have to trust the author to do thorough vetting of a potential buyer and also not sell if vetting is inconclusive. And this against an adversary aiming to cheat their way past vetting.

Might be a cynical take, but it is not one without reason.

As a sibling comment points out, this is due to the permission model. This doesn't let the author entirely of the hook though: the permissions model created the situation, the author chose a particular path. The consequences may not have been foreseen by either, but they do exist and affect users.

Re: Don't fuck with paste

#159

Post by pinkmuffinere »

dotancohen wrote: post #144
pinkmuffinere wrote: post #72

Earlier quoted context omitted.

You’re absolutely correct though, the parent comment seems to think there are absolute right and wrong answers for UI. I think that’s just not true, a good UI is one that works for your customers.

Of course there are absolute right and wrong answers for UI. Accessibility, minimum text contrast and font size, minimum size for clickable items. Keyboard shortcuts may not be (or may be) one of them, but in fact consistency across applications _is_ considered a hallmark of good UI and every Human Interface Guideline I've ever read, including open source ones such as that from KDE, specify such.

I agree with almost all of the specific examples you give, but I think I agree _because_ those UI decisions work better for customers, and not because they are absolute right and wrong. I think I can illustrate this with some examples:

1. Consider a keyboard without an f-key, eg Arabic. If the user is using an Arabic keyboard, what should bring up the browsers 'find' functionality. Of course ctrl-f won't cut it. Perhaps it should be ctrl-[first letter of 'find' in Arabic]? Or perhaps ctrl-[the letter in the same position as f on qwerty keyboard]? It makes sense to follow convention if one is already established for Arabic, but then what about languages that are new to the web?

2. Consider a phone-tree, which is a sort of UI. For this UI, the 'absolute right answers' of minimum text contrast, font size, keyboard shortcuts, etc, make no sense, but there are surely other ways to make the UI work well for customers.

In both these scenarios, I feel the 'right' choice is to pick the UI that is best for users. I think there isn't a-priori a right answer, and users habits change over time and across cultures, so it's not necessarily an easy choice.

Post reply on HN