The full reach of this issue might not be limited to just text. It might be possible to mess with scripts in programs like Word by abusing rich text, macros and styles:
Pastejacking
211–220 of 246 posts
Re: Pastejacking
#212zsh actually detects pastes into the terminal and doesn't submit the commands on newlines. This way you see the full command and have to hit enter yourself to run it. It isn't perfect because people could try to obscure the command but in general it makes me a lot happier to paste commands into my terminal.
This. I'd argue that the issue here is more with terminals and shells than web browsers: paste shouldn't immediately start executing something. The technology to not do so has been around for years - it's called bracketed paste: https://cirw.in/blog/bracketed-paste
Re: Pastejacking
#213Earlier quoted context omitted.
I'm sure that those involved have very interesting rationalizations, but I don't think that it should be viewed from an ethics perspective. Expecting people to behave against their own self interest in the short term, for the good of strangers in the long term, will always end in disappointment. This is actually a pretty simple case of poorly stated objectives being cleverly met by people who are completely self inte…
> I know this sounds kind of "well what did you expect wearing something like that" Which is a perfectly rational question/argument. > Expecting people to behave against their own self interest in the short term, for the good of strangers in the long term, will always end in disappointment. I agree. This is a systemic problem, and appeals to ethics won't work (and the advertisers won't change their metrics because of…
>Which is a perfectly rational question/argument.
How is that rational at all? That question is referencing the common practice of blaming rape victims rather than the rapists, by questioning what the victim was wearing.
Re: Pastejacking
#214Earlier quoted context omitted.
I just turned this preference off in Firefox, and it didn't stop the demo from working, which makes sense since the preference says it only disables oncopy/cut/paste events, and this demo uses a different method.
This is because the Firefox preference is useless - it only disables the clipboard events, but not the clipboard access from any other event. So the demo simply hooks the keydown event instead. Have a look at the source, it's really quite straightforward. What browsers really should have are a standard "Ask & Whitelist" dialog for all of these security critical features[1]. It seems Firefox even used to have this fea…
> Unfortunately browsers are no longer controlled by hackers who think about all the implications of a feature, but by corporations who think about money, and us hackers have to spend inordinate amounts of time trying to play security whack-a-mole, or be forced to give up and use our browsers like sheep, the way the corporations want us to.
FWIW, the features that this uses have their origins in proprietary IE5 features (maybe 5.5?). Whether this attack works in IE5 I leave as an exercise to someone else.
Note that the tradeoffs are more complex than what one might naïvely assume: people weren't using the feature as it existed in Firefox before because it required explicit user interaction, but doing the same thing through Flash didn't… so everyone just used Flash. In effect, this is a security bug the platform has long had (because, like it or not, de-facto the web platform for the longest time included Flash). Now, should we blindly copy everything Flash can do? Of course not. But if something is making people hold on to Flash, we really should consider the tradeoffs. Are we just gaining theoretical superiority but practical irrelevance (on desktop at least; mobile where Flash is gone is a different story)?
Re: Pastejacking
#215Earlier quoted context omitted.
Kind of odd to even bring ethics up when discussing how websites make money. It doesn't matter at all. Ethics is normally used to discuss other people getting harmed by actions, but when all that harm can be removed simply by closing the browser and doing something else it's barely worth talking about. Is it ethical for a shop to advertise its products in the shop windows when the people running the shop know that th…
> Who gives a shit? I do. That's probably why I won't be running an effective business any time soon. Being nice and not fucking people over doesn't get you far in highly competitive markets. I strongly second what 'nitrogen wrote[0]. This is very much about ethics. > Is it ethical for a shop to advertise its products in the shop windows when the people running the shop know that there are higher quality products ava…
> I do. That's probably why I won't be running an effective business any time soon. Being nice and not fucking people over doesn't get you far in highly competitive markets.
> lying to people to make them buy your stuff instead of something objectively better is fucking them over for your own gain
Thanks, this needed to be said. I'm in the same position. I will probably never be able to run a business either because I hold these same views.
Re: Pastejacking
#216Earlier quoted context omitted.
Kind of odd to even bring ethics up when discussing how websites make money. It doesn't matter at all. Ethics is normally used to discuss other people getting harmed by actions, but when all that harm can be removed simply by closing the browser and doing something else it's barely worth talking about. Is it ethical for a shop to advertise its products in the shop windows when the people running the shop know that th…
> Who gives a shit? I do. That's probably why I won't be running an effective business any time soon. Being nice and not fucking people over doesn't get you far in highly competitive markets. I strongly second what 'nitrogen wrote[0]. This is very much about ethics. > Is it ethical for a shop to advertise its products in the shop windows when the people running the shop know that there are higher quality products ava…
That argument would lead you to the conclusion that if your peers are objectively better than you, then it's immoral for you to seek employment; you must improve yourself or choose a different industry. So do you think you are among the world's best in your area of expertise, or are you voluntarily unemployed? ;)
Re: Pastejacking
#217Earlier quoted context omitted.
> I know this sounds kind of "well what did you expect wearing something like that" Which is a perfectly rational question/argument. > Expecting people to behave against their own self interest in the short term, for the good of strangers in the long term, will always end in disappointment. I agree. This is a systemic problem, and appeals to ethics won't work (and the advertisers won't change their metrics because of…
>Which is a perfectly rational question/argument. How is that rational at all? That question is referencing the common practice of blaming rape victims rather than the rapists, by questioning what the victim was wearing.
It is a perfectly rational question. You're layering a bunch of unnecessary stuff about blame on top of it. Rape is always the fault of the rapist. Full stop. Now, given that there probably always will be rapists in the world, can we be allowed to ask questions that help prevent rape?
Re: Pastejacking
#218Earlier quoted context omitted.
> Who gives a shit? I do. That's probably why I won't be running an effective business any time soon. Being nice and not fucking people over doesn't get you far in highly competitive markets. I strongly second what 'nitrogen wrote[0]. This is very much about ethics. > Is it ethical for a shop to advertise its products in the shop windows when the people running the shop know that there are higher quality products ava…
That argument would lead you to the conclusion that if your peers are objectively better than you, then it's immoral for you to seek employment; you must improve yourself or choose a different industry. So do you think you are among the world's best in your area of expertise, or are you voluntarily unemployed? ;)
I do suffer from impostor syndrome sometimes :).
That said, most of my peers who are objectively better than me are already employed, and it's up to employers to select from the available pool of employees. My responsibility is to truthfully present my skills during interview.
Re: Pastejacking
#219Quite nicely iTerm2 will catch when you attempt to paste new line characters and warn you about it. Mostly it's useful when I've accidentally copied an extra line, but protecting against malicious abuse is a useful plus.
Re: Pastejacking
#220Earlier quoted context omitted.
Kind of odd to even bring ethics up when discussing how websites make money. It doesn't matter at all. Ethics is normally used to discuss other people getting harmed by actions, but when all that harm can be removed simply by closing the browser and doing something else it's barely worth talking about. Is it ethical for a shop to advertise its products in the shop windows when the people running the shop know that th…
Kind of odd to even bring ethics up when discussing how websites make money. It doesn't matter at all. This is why we can't have nice things. Because people adopt a FYGM attitude. Because they piss in the pool we all have to swim in. ...all that harm can be removed simply by... ...quitting smoking? Throwing away the prescription pain meds? Giving up junk food? How about not robbing people of their valuable time and m…
> How about moving past ... where the distributed costs far outweigh the concentrated gains?
That pretty much describes living in the US and even Europe to a degree compared to most of the world.
How deep should morality go? Almost all of us in the US consume an order of magnitude more than most of the world for instance.