4 ms·
This highlights the tension between the web as publishing vs an application platform. Publishers do not need programmatic clipboard access, but applications do.
by millstone 7y ago
This highlights the tension between the web as publishing vs an application platform. Publishers do not need programmatic clipboard access, but applications do.
Metro is a publisher, and so ideally should just serve content. But the web is ad-supported, and ordinary ads are non-economical (maybe?), so Metro is forced into the application space. The browser gives them an inch and they take a mile.
I wish browsers sliced along this line. You get to be an app or a document, not both. Documents give up control but can play in more sandboxes. Apple News does this, AMP is trying it but has other problems.
- danShumway 7y agoThe problem isn't Javascript in this case. You can trivially execute this attack with CSS by adding invisible spans that will be copied, but not rendered, and pseudo-elements that will be rendered but won't be copied. You can also trivially execute this attack by bundling a custom web font that contains invisible characters and swapped glyphs. I don't know what Apple's writing format is for Apple News, but AMP at least does not block this attack. It's not necessarily even a web thing -- PDFs are vulnerable to this attack, because they allow embedding custom fonts.
- skunkpocalypse 7y ago> This highlights the tension between the web as publishing vs an application platform. It also highlights the importance of acknowledging that tension. Notice how the app-app-rah-rah-rah crowd gets very hostile when the fact that it exists is even mentioned.