7 ms·
The wrongest thing about this, from my perspective, is that my browser fires off a js 'copy' event when I press control-c. There are times when I've found it he
by smichel17 7y ago
The wrongest thing about this, from my perspective, is that my browser fires off a js 'copy' event when I press control-c. There are times when I've found it helpful that a browser can copy text to my clipboard when I click a button, but I can't think of a single time when I want a site to react to my attempt to copy text off if it.
Is there any way to configure my user agent (Firefox) not to do this? A hack is ok.
- wink 7y agoWhat about the X clipboard, e.g. just selecting text and then being able to paste with middleclick - did you check that as well? I suppose it should circumvent that?
- bzbarsky 7y agoThere's the "dom.event.clipboardevents.enabled" preference, which you can set to false in about:config. I don't know whether that's planned to stick around or whether it was added when the clipboard event support was still experimental and will be removed at some point. But I suspect the former, for precisely the reasons in this thread. Note that disabling these events will likely break "smart" copy/paste in things like Google Sheets, which is one reason it's not disabled by default....
- zzo38computer 7y agoOK, it looks like I have already disabled that (although I forgot about it until I looked now).
- deleted 7y ago[deleted]
- franga2000 7y agoI suspect a complex WYSIWYG editor like Google Docs benefits from this feature since the selection behaviour is heavily customised (and it has to be in order to support most of its features). The browser can't comprehend most of the things you might be selecting and copying from such a document, so it makes sense to replace the clipboard with a more accurate representation.
- joquarky 7y agoIf you use Greasemonkey or Tampermonkey, you can add the following to run before any other scripts: document.addEventListener('copy', function(e){ e.stopImmediatePropagation() } );
- 0zymandiass 7y agoabout:config -> dom.event.clipboardevents.enabled = false You can't do it through a user agent, though
- ErotemeObelus 7y agoYeah you're a friend.
- ebg13 7y agoI'm pretty sure this breaks copying from google docs.
- 0zymandiass 7y agoI can highlight and ctrl+c without issue in their Writer clone. Never tried any others. I've only ever seen that setting fix sites that try to prevent you from copying.
- josephg 7y agoI’ve used clipboard events for legitimate uses - for example I use them in this pseudo Turing sandpit / visual programming system to move, copy and export content: https://steam.dance/ https://steam.dance/ (you can hold shift for a selection box and once selected you can copy, etc). But I wouldn’t be surprised if stuff like this is the exception rather than the rule. I feel like most news sites and blogs are improved with JavaScript disabled.
- 0zymandiass 7y agoYou're getting far enough into JS knowledge that I don't have. Do you actually need clipboard events, or just dom.event.contextmenu.enabled for that?
- zamalek 7y agoPut another way, on a website like draw.io, you need to be able to hook into copy to allow lassoing and copying a set of shapes (and have them remain editable when pasted). The entire ask (stopping the copyright, and allow clipboard integration) be achieved by allowing pages to augment the clipboard data, which can already be done, but not replace it. Pages would still need to be able to hook paste.
- Dylan16807 7y ago> I can't think of a single time when I want a site to react to my attempt to copy text off if it. Any time you're not interacting with HTML text is a time it could be useful.
- codetrotter 7y agoSpecifically, things like copying a cell of data in Google Sheets for example.
- dredmorbius 7y agoCopying from HTML tables is already sane.
- codetrotter 7y agoGoogle sheets is not just a HTML table though. And when you click on a cell, you select the cell itself, rather than having to highlight the cell contents. In order for copy paste to work as intended, this makes it necessary for Google Sheets to intercept Ctrl-C and Ctrl-V.
- pierrec 7y agoIn that case there should be no actual text selected. The problem only occurs when there is text visibly selected and you press your copy shortcut. In those cases the only correct behavior is to copy the selected text.
- deleted 7y ago[deleted]
- cortesoft 7y agoI think the wrongest thing is that this is a clear attack vector... make a site with helpful Linux shortcuts, then replace every copy with "curl malicious script and run it, plus a newline to make it run immediately"
- bloopernova 7y agoI always paste into a text document to examine what's there. Then copy from that and paste.
- oefrha 7y ago> plus a newline to make it run immediately I already mentioned this in another comment, but everyone should enable bracket paste mode in their shell to defend against this. https://cirw.in/blog/bracketed-paste https://cirw.in/blog/bracketed-paste
- dylan604 7y agoThanks for this. I had never heard of it before, but will definitely be playing around with it.
- umvi 7y agoI always just type "#" first before pasting... That way it is just a comment I can inspect before running
- hackmiester 7y agoHere, paste this into your terminal: echo "hello" echo "lol" ; sudo sl -rf / (In case it's not obvious, the # trick will not help you.)
- umvi 7y agoTrue, the comment trick does not work for multi-line pastes
- 7y ago
- ori_b 7y agoYou can turn off JavaScript. This has the added benefit of disabling most tracking and advertising.
- Polylactic_acid 7y agoAs well as disabling most of the internet. It makes more sense to turn off the bad apis individually and block known tracking domains.
- wtmt 7y agoI’ve recently been experimenting with having JS off by default on Brave. Many sites that I don’t regularly use or have an account/relationship with are much more pleasant without JS. There may be some visual breakage in some cases, but I’m there for the main content, which is mostly fine. I had experimented with NoScript long ago, but found it a bit more cumbersome at that point because (then, before the uBlock days) I couldn’t really judge which scripts were necessary and which weren’t. I’m going to try it again. One big plus with disabling JS is that all those ad blocker blockers and other annoying popups just don’t even appear, and that adds to a better experience.
- tjpnz 7y ago>disabling most of the internet I have JS blocked on some domains because of popups/other annoyances which make getting to the content a hassle. In those cases it's the exact opposite.
- dredmorbius 7y agoWe've been through the blacklisting argument numerous times: spam, viruses, adware, malware, spyware, browser adblocking, etc. It ... ultimately doesn't scale. The black-hat namespaces are too large, and treating as TOFU eventually proves untenable. Advanced features -- anything beyond rendering basic HTML, and I'd be quite prepared to argue for a very limited subset of that -- should be expressly prohibited unless enabled. The trick is to make enabling reasonably painless and consequence-free (e.g., enable into a sandbox). There are still the problems of users gratuitously enabling anything and everything (especially when prompted through website notifications, pop-ups, phishing and vishing social engineering attacks, etc.), as well as the problem of largely invisible second and higher-order effects. But the key is to cut down on the effectiveness of such methods, to impose costs on websites for employing them, and to make black-hat attacks through these too expensive by reducing the herd susceptibility to the attacks (the unbocking would have to occur on a one-at-a-time case-by-case basis, e.g., it's expensive and has limited scalability). I don't think we'll actually see this for another 5-10 years (my usual sane-suggestion take-up lead time, it seems), but It Would Certainly Be Nice To See.
- hashkb 7y ago> I can't think of a single time when I want a site to react to my attempt to copy text off if it Perhaps in a rich text editor I want to copy as plain text; or perhaps I want to make a Markdown editor that you can select+copy the Markdown but then paste HTML. Just brainstorming.
- maple3142 7y ago> I can't think of a single time when I want a site to react to my attempt to copy text off if it. I think it is needed for some complex web app to handle copying non-text content. Such as images in wysiwyg editor, Google Sheets/Slides...
- na85 7y agoSo trade those apps not working for immunity from JavaScript clipboard hijacking? I'd be 110% fine with that trade and nothing of value to me would be lost. Is it possible in Firefox? Anyone know?
- bzbarsky 7y agoIt's possible. See https://news.ycombinator.com/item?id=22356697 https://news.ycombinator.com/item?id=22356697
- maple3142 7y agoIf you really don't mind it will break some websites, then you really can disable it in Firefox. https://news.ycombinator.com/item?id=22352929 https://news.ycombinator.com/item?id=22352929
- epse 7y agoMind you that this breaks a LOT of things. Even stupid stuff like any textbox on Facebook will be broken.
- TuringTest 7y agoThat sounds like a net positive, allowing you to tell apart proper websites from privacy nightmares :-P
- dwaltrip 7y agoMillions of people use applications with these kinds of features. A few more examples: the Scratch educational programming tool, website builders such as Webflow, diagram editors, image editors, etc. The list goes on and on. The browser is no longer just a document viewer... That ship has sailed, and overall it is a good thing. We can mitigate the risk of clipboard hijacking without burning down the house. By the way, I would guess that this is a minor risk in the grand scheme of things, as it seems that the worst risks are for technical individuals people copying programmatic commands (e.g. software engineers). For others, it is a real yet minor annoyance. Perhaps there could be an opt-in setting for allowing a site to modify the default content that is copied from a selection?
- Latty 7y agoEven that won't totally save you. While you can't do exactly this, you can sure get the fun experience of the user getting text they didn't expect in the clipboard when copying without any JS at all. Text is highlighted on the page based on the code order, not as it appears on-screen (at least in Firefox and Chrome). If you throw elements off-screen with some CSS, you can create a big disparity between what the user thinks they are selecting and what they get when they copy/paste. e.g: https://jsfiddle.net/Lbc5gsjm/ https://jsfiddle.net/Lbc5gsjm/ Not quite as neat as you can't put it dynamically around exactly what you select, but my favourite example of where you could get pretty malicious with it is a “plain text” link that injects a suffix to the hostname when you copy it.
- zzo38computer 7y agoYes, that is another problem, although it involves CSS. I suggested before to have a ARIA view, which would cause it to use ARIA properties rather than CSS to decide the rendering. I have not thought of your example though, but it is a feature I would like to have. (ARIA view would do other things too.)
- chiefsucker 7y agoThis works when you manually select the text, but it fails when you want to select by double-/triple-clicking. In this case the selection ends before the word “me”. It’s awkward how easily one can break a basic functionality like select & copy.
- Klathmon 7y agoThere are plenty of other tricks that can be used and won't break the "triple click". I just threw together [1] as an example (and in that one, even if you don't triple click but accidentally select past the end of the line, you are also getting unexpected text). Combine a few of those techniques with a fancy-looking text box that you are supposed to "click to copy" to get a command, and it becomes pretty easy to even write css-only "exploits" to put stuff in the clipboard! [1] https://jsfiddle.net/gxosfn83/1/ https://jsfiddle.net/gxosfn83/1/
- kevin_thibedeau 7y agoUnder X11, Firefox sets the primary selection correctly and middle-click paste is unaffected. This site also renders fine with JS blocked. That is a useful default to prevent this kind of crap from interfering with you. What is infuriating is CSS that prevents text selection in the first place. That insult to usability should have never been adopted by browsers.
- franga2000 7y ago> That insult to usability should have never been adopted by browsers As a web developer, it's kind of funny seeing people exclaim "this feature should not exist" after seeing a few abuses of it, even though they probably benefit from it every day without realizing it. Overriding copying is needed for wysiwyg editors and selection blocking is needed for many kinds of drag&drop interfaces and also editors. Instead of complaining that useful features exist because they can be misused, maybe complain about the misuse itself - maybe even to the people actually misusing them. Shoot them an email and they might actually do something about it. Most of these misuses hurt accessibility (screen readers, etc.), so if nothing else, they'll see it as a way to reach more customers.
- jhasse 7y agoIt can be useful. For example I don't want to select the line nunbers next to the code.
- simpss 7y agoabout:config dom.event.clipboardevents.enabled = false and you're good.
- nicoburns 7y ago> but I can't think of a single time when I want a site to react to my attempt to copy text off if it. It's useful for things like rich-text editors (e.g. google docs), where the text is never on screen as text that you are able to copy in the first place.
- unnouinceput 7y agoUse reader mode, no JS is active there, and you can copy the code quite nicely. I always do this when I see this behaviour