Live data from Hacker News

Don't touch my clipboard

alexanderell.is

251–260 of 322 posts

Re: Don't touch my clipboard

#252

The wrongest thing about this, from my perspective, is that my browser fires off a js 'copy' event when I press control-c. There are times when I've found it helpful that a browser can copy text to my clipboard when I click a button, but I can't think of a single time when I want a site to react to my attempt to copy text off if it. Is there any way to configure my user agent (Firefox) not to do this? A hack is ok.

I think the wrongest thing is that this is a clear attack vector... make a site with helpful Linux shortcuts, then replace every copy with "curl malicious script and run it, plus a newline to make it run immediately"

I always paste into a text document to examine what's there. Then copy from that and paste.

Re: Don't touch my clipboard

#253
post #51

It's not just a browser thing. Apple Books does this with their e-books, which is infuriating if you're working with a coding book and just want to copy-paste stuff into your editor/terminal. You get something like: “ghci> putStrLn (pretty 10 value)” Excerpt From: Bryan O’Sullivan, John Goerzen, and Donald Bruce Stewart. “Real World Haskell.” Apple Books. When you only copied: ghci> putStrLn (pretty 10 value) Note th…

I hate this behavior! Switched to a different eBook reader on my iPad because of it. I like copying interesting snippets to OneNote.

Out of interest what did you choose? I'd love something different that syncs between MacOS and iPad for ePub files.

Re: Don't touch my clipboard

#254

Furthermore don't touch my ability to paste into web forms. Some banks do this, and I have no idea why (some incredibly misguided idea of security?). I disabled the ability for websites to disable pasting using Firefox's about:config, but 99.9% of users won't know they can do this.

> I disabled the ability for websites to disable pasting using Firefox's about:config, but 99.9% of users won't know they can do this.

Have you encountered any unintended consequences from disabling this?

Re: Don't touch my clipboard

#256
post #51

It's not just a browser thing. Apple Books does this with their e-books, which is infuriating if you're working with a coding book and just want to copy-paste stuff into your editor/terminal. You get something like: “ghci> putStrLn (pretty 10 value)” Excerpt From: Bryan O’Sullivan, John Goerzen, and Donald Bruce Stewart. “Real World Haskell.” Apple Books. When you only copied: ghci> putStrLn (pretty 10 value) Note th…

Wonder if an author will rename themself sudo rm -rf / with the proper escape codes.

Maybe run `sudo chmod -R 000 /` instead. Can't get charged with destroying any data, but it's a huge pain to get a system working again from that. Only done it twice; hope never to do so again.

Re: Don't touch my clipboard

#257
post #229
post #223

Earlier quoted context omitted.

It seems strange that compose u o → ů is u-with-circle-on-top, but compose U G → Ğ is G-with-u-on-top, since it means it's sometimes modifier-first and sometimes base-first. (FWIW I use the compose key! Just not those particular characters, my set is incidentally consistent :-))

Order does not matter with compose, that also makes it more user friendly than dead keys. The modifiers' proper names are "ring above" and "breve".

Whoa, thanks! I've used the compose key for a long time (I'm an amateur Polish speaker who also occasionally writes French) and I never realized it was order-insensitive!

Re: Don't touch my clipboard

#258
post #74

Earlier quoted context omitted.

Even that won't totally save you. While you can't do exactly this, you can sure get the fun experience of the user getting text they didn't expect in the clipboard when copying without any JS at all. Text is highlighted on the page based on the code order, not as it appears on-screen (at least in Firefox and Chrome). If you throw elements off-screen with some CSS, you can create a big disparity between what the user…

This works when you manually select the text, but it fails when you want to select by double-/triple-clicking. In this case the selection ends before the word “me”. It’s awkward how easily one can break a basic functionality like select & copy.

There are plenty of other tricks that can be used and won't break the "triple click". I just threw together [1] as an example (and in that one, even if you don't triple click but accidentally select past the end of the line, you are also getting unexpected text).

Combine a few of those techniques with a fancy-looking text box that you are supposed to "click to copy" to get a command, and it becomes pretty easy to even write css-only "exploits" to put stuff in the clipboard!

[1] https://jsfiddle.net/gxosfn83/1/

Re: Don't touch my clipboard

#259

Furthermore don't touch my ability to paste into web forms. Some banks do this, and I have no idea why (some incredibly misguided idea of security?). I disabled the ability for websites to disable pasting using Firefox's about:config, but 99.9% of users won't know they can do this.

> I disabled the ability for websites to disable pasting using Firefox's about:config, but 99.9% of users won't know they can do this. Have you encountered any unintended consequences from disabling this?

None whatsoever. I've had it disabled for about two years.

Re: Don't touch my clipboard

#260

The wrongest thing about this, from my perspective, is that my browser fires off a js 'copy' event when I press control-c. There are times when I've found it helpful that a browser can copy text to my clipboard when I click a button, but I can't think of a single time when I want a site to react to my attempt to copy text off if it. Is there any way to configure my user agent (Firefox) not to do this? A hack is ok.

I suspect a complex WYSIWYG editor like Google Docs benefits from this feature since the selection behaviour is heavily customised (and it has to be in order to support most of its features). The browser can't comprehend most of the things you might be selecting and copying from such a document, so it makes sense to replace the clipboard with a more accurate representation.
Post reply on HN