7 ms·

Yes, I hate these douchebags. I also hate the people who use them. I have a modified Chromium that specifically prevents this tampering with selection (null out

by tumult 16y ago

Yes, I hate these douchebags. I also hate the people who use them. I have a modified Chromium that specifically prevents this tampering with selection (null out the webkit javascript hooks for selection stuff) and an extension that will give a little blip whenever I land on a page that uses them or something like it. It pisses me off. I can't believe people think this is a good idea. When the spammers/ad people start using HTML5 audio to blast annoying crap at you, HTML5 locations to figure out how to send junk mail to your house, and other crap that browser makers were too short-sighted to realize were a bad idea to give sites the power to control, then we're going to see a regression in browser features as "does less" becomes the default. Right now, the sites you visit have way too much control over what they can do to your browser. It's naïve to think that these people will just 'play nice' and not abuse features. The SEO and ad people will take whatever length of thread you give them and completely unravel the shirt off of your back.

daleharvey 16y ago
crippling the functionality of the browser isnt going to harm people developing these exploits, they will just use toolbars and plugins whatever. all it does is hurt people who want to build real web applications, the complete lack of support for copy and paste is a major major pita in that regard.
- tumult 16y ago
  Uh, you can tamper with the clipboard from JavaScript. That's why this works, and why it's a problem. You shouldn't be able to by default.
  - daleharvey 16y ago
    you cant, these things employ tricks like a hidden textarea that gets focused and selected when ctrl+c gets keyed down (safari does have a copy / paste events), the same can happen on paste, flash also has access to write to the clipboard, sometimes. its buggy and annoying though. but it means 1. applications cant have copy paste buttons 2. if you have a special clipboard (googles cloud clipboard), you have 2 clipboards that can very easily become out of sync. preventing abuse of the clipboard by completely killing its functionality is like banning apples because someone chocked on one once, there are much simpler solutions (like firefoxs geolocation permission dialog)
    - Kadin 16y ago
      I don't see why JS code running on a page in the browser should have access to my computer's local clipboard. That's a misfeature at best, and it's ripe for abuse. Web apps that really need access to the local clipboard should have to jump through some hoops in order to access it, just like they have to jump through hoops to access the local filesystem. Perhaps we could make those permissions persist, so that users wouldn't have to constantly authorize a particular site (like Google Docs) that they want to let access their clipboard, but it should definitely not be accessible to the world by default.
      - JadeNB 16y ago
        > That's a misfeature at best, and it's ripe for abuse. I'm with the group that despises this behaviour (although I think I can't quite manage to work up to outrage), but I'm puzzled by this. Since the (mis)feature has already been abused, I assume you're referring to possible worse future abuses; but I can't think of any. Could you clarify?
        Kadin 16y ago
        I mean that the implementation is not a true feature, but a quasi-bug in disguise. This definition sums up my use of the term fairly well (http://encyclopedia2.thefreedictionary.com/misfeature http://encyclopedia2.thefreedictionary.com/misfeature): >A feature that eventually causes lossage, possibly because it is not adequate for a new situation that has evolved. Since it results from a deliberate and properly implemented feature, a misfeature is not a bug. Nor is it a simple unforeseen side effect; the term implies that the feature in question was carefully planned, but its long-term consequences were not accurately or adequately predicted... At some point, someone must have thought that allowing JavaScript access to the clipboard would be a neat idea. And on a whiteboard, it does seem like a neat idea. But in the extremely hostile environment of the Internet, where every feature will be abused in the most user-hostile ways possible, it is a liability rather than an asset. The Internet has a long history of such features: the ability of a page to spawn new windows, which led to popups, is the one of the most glaring to casual users, but Usenet's CANCEL messages and the ensuing Hipcrime debacle is IMO more to the point. The prevailing attitude when developing desktop operating systems, which provide tools to developers under the assumption that they will be reasonably careful with them ('with great power comes great responsibility'), fails completely on the Internet. On the desktop, you can assume that obviously flawed, hostile software will get eliminated by the market -- a few people might get burned, but then nobody will install it, problem solved. On the Internet, this doesn't work; if you release a browser with a "feature" that can be exploited to take advantage of users or even to merely annoy them, it will be used, and it won't just be used a few times, it will be used over, and over, and over ... until the feature is hardened or removed (e.g. the BLINK tag, early ActiveX). I am very concerned that the rush to provide desktop-application-like capabilities to web apps will open a huge can of worms in terms of the new avenues for abuse that it allows, and the overall effect of this -- when the abuse happens in spades, which it will -- will be to cause users to disable those features globally, and distrust web apps in general.

by tumult 16y ago

daleharvey 16y ago

crippling the functionality of the browser isnt going to harm people developing these exploits, they will just use toolbars and plugins whatever. all it does is hurt people who want to build real web applications, the complete lack of support for copy and paste is a major major pita in that regard.

tumult 16y ago
Uh, you can tamper with the clipboard from JavaScript. That's why this works, and why it's a problem. You shouldn't be able to by default.
- daleharvey 16y ago
  you cant, these things employ tricks like a hidden textarea that gets focused and selected when ctrl+c gets keyed down (safari does have a copy / paste events), the same can happen on paste, flash also has access to write to the clipboard, sometimes. its buggy and annoying though. but it means 1. applications cant have copy paste buttons 2. if you have a special clipboard (googles cloud clipboard), you have 2 clipboards that can very easily become out of sync. preventing abuse of the clipboard by completely killing its functionality is like banning apples because someone chocked on one once, there are much simpler solutions (like firefoxs geolocation permission dialog)
  - Kadin 16y ago
    I don't see why JS code running on a page in the browser should have access to my computer's local clipboard. That's a misfeature at best, and it's ripe for abuse. Web apps that really need access to the local clipboard should have to jump through some hoops in order to access it, just like they have to jump through hoops to access the local filesystem. Perhaps we could make those permissions persist, so that users wouldn't have to constantly authorize a particular site (like Google Docs) that they want to let access their clipboard, but it should definitely not be accessible to the world by default.
    - JadeNB 16y ago
      > That's a misfeature at best, and it's ripe for abuse. I'm with the group that despises this behaviour (although I think I can't quite manage to work up to outrage), but I'm puzzled by this. Since the (mis)feature has already been abused, I assume you're referring to possible worse future abuses; but I can't think of any. Could you clarify?
      - Kadin 16y ago
        I mean that the implementation is not a true feature, but a quasi-bug in disguise. This definition sums up my use of the term fairly well (http://encyclopedia2.thefreedictionary.com/misfeature http://encyclopedia2.thefreedictionary.com/misfeature): >A feature that eventually causes lossage, possibly because it is not adequate for a new situation that has evolved. Since it results from a deliberate and properly implemented feature, a misfeature is not a bug. Nor is it a simple unforeseen side effect; the term implies that the feature in question was carefully planned, but its long-term consequences were not accurately or adequately predicted... At some point, someone must have thought that allowing JavaScript access to the clipboard would be a neat idea. And on a whiteboard, it does seem like a neat idea. But in the extremely hostile environment of the Internet, where every feature will be abused in the most user-hostile ways possible, it is a liability rather than an asset. The Internet has a long history of such features: the ability of a page to spawn new windows, which led to popups, is the one of the most glaring to casual users, but Usenet's CANCEL messages and the ensuing Hipcrime debacle is IMO more to the point. The prevailing attitude when developing desktop operating systems, which provide tools to developers under the assumption that they will be reasonably careful with them ('with great power comes great responsibility'), fails completely on the Internet. On the desktop, you can assume that obviously flawed, hostile software will get eliminated by the market -- a few people might get burned, but then nobody will install it, problem solved. On the Internet, this doesn't work; if you release a browser with a "feature" that can be exploited to take advantage of users or even to merely annoy them, it will be used, and it won't just be used a few times, it will be used over, and over, and over ... until the feature is hardened or removed (e.g. the BLINK tag, early ActiveX). I am very concerned that the rush to provide desktop-application-like capabilities to web apps will open a huge can of worms in terms of the new avenues for abuse that it allows, and the overall effect of this -- when the abuse happens in spades, which it will -- will be to cause users to disable those features globally, and distrust web apps in general.