6 ms·

The Curious Case of Copy and Paste

61 points by pjf 6y ago

davidgerard 6y ago
Copy and paste in browsers is a horrible mess, as LibreOffice is finding out with its web version: https://people.gnome.org/~michael/data/2019-09-12-copy-paste.pdf https://people.gnome.org/~michael/data/2019-09-12-copy-paste...
- gcbw3 6y ago
  Heh. this reminded me some libreoffice bugs i track. One is to have plain text copy paste be the default. The other is to completely disable selected text dragging. There's a large number of people who likes both of these features. Go figure.
- mjevans 6y ago
  Google's suite requests the use of a a plugin helper for anything serious.
divbzero 6y ago
Great write-up. Reminds me of different copy-paste concerns that persist in other platforms. [1] [1]: https://news.ycombinator.com/item?id=22569662 https://news.ycombinator.com/item?id=22569662
andrewstuart 6y ago
All keyboards should have cut/copy/paste buttons under the delete/end/pgdn row.
- elpescado 6y ago
  They do have Command/Ctrl and X, C and V, though.
- spupy 6y ago
  On Linux: Control+Insert/Shift+Insert for copy/paste
autocorr 6y ago
It's tangential to the article, but I've found it's been really helpful to have dedicated copy and paste buttons on the left hand. On Linux the highlight and middle click is nice, but not every application can be selected (like split windows in tmux) and the buffers don't always match between applications (like Firefox and something else). But I've found Ctrl+Insert and Shift+Insert works practically without fail everywhere. I have a programmable keyboard so made macros for those two commands and mapped them to keys on the non-mouse hand (extra thumb keys on an ergodox, not bad to lift the hand a little to reach them). Works great! For something so universal as copying text it would make sense to have dedicated keys for them on many keyboards, like volume up or down.
mattigames 6y ago
In a barely related subject, does anybody knows a good clipboard manager (e.g. multiple copy + paste) for mac that supports both text and images? (like Ditto on Windows)
- Khannan 6y ago
  Maccy has served me very well. Open source too! https://github.com/p0deje/Maccy https://github.com/p0deje/Maccy
- oxfeed65261 6y ago
  For Windows, Thornsoft Clipmate is very powerful and one of my must-have utilities, despite its lack of recent updates. http://thornsoft.com/ http://thornsoft.com/
pjc50 6y ago
The ability of Javascript to alter the "copy" contents is, like the ability to disable zoom, something that's nearly always used against the user and the usability and accessibility of the site. Such as appending disclaimers and copyright notices to strings.
- elpescado 6y ago
  The problem is that the same medium (HTML) is used for "documents" and "applications". Programmatic access to clipboard, zoom etc is legitimate for "HTML applications" like Google Docs/Maps but unnecessary for "HTML documents", along with virtually all scripting.
  - pavel_lishin 6y ago
    In a more perfect world, browsers would require websites to ask permission before allowing access to the copy/paste buffer.
    - sam_goody 6y ago
      Except that the ability to copy is extremely useful. And creating more popup-approval fatigue doesn't help anyone. You are a super-user, so it might be the git clone URL of a really long commit. That "click to copy" button on github is really useful. The same scenario exists from Grandma, and she will click the popup or give up in frustration - neither of which is good. IMO, sites should be able to have access to the copy buffer but not to the paste. Paste should be available to the user with ctrl+P. Definitely not perfect, but more mitigable.
      - pavel_lishin 6y ago
        I don't think the putative Grandma has much need for copy-and-paste functionality from websites. And yes, there would be fatigue, and me-the-super-user would globally block those popups from coming up. It's honestly not worth it. I would miss it maybe once a month, which is about how often I get annoyed by something messing with it. Maybe a middle ground would be allowing websites to _insert_ things into the buffer, but not _modifying_ the buffer. (Though of course, they could just inspect what's highlighted on the page, and then flat out insert that plus their garbage, except I'd argue that I don't think they need to know what I've got highlighted, then you'd point out that that would break Google Docs, and I'd suggest another popup, and you'd say that Grandma can't handle the fatigue, etc., etc.)
nullc 6y ago
The related issue most irritating for me is that google search makes the URL hover claim one destination but when you click the click itself rewrites the URL to funnel through their tracking service. This is an extremely dangerous attack vector which google is abusing to compromise user privacy (but fortunately, not worse). There was a firefox bug open on this for years but it seems like Mozilla really didn't want to break their big sponsor's analytics. ( https://bugzilla.mozilla.org/show_bug.cgi?id=229050 https://bugzilla.mozilla.org/show_bug.cgi?id=229050 ) I find it extremely annoying because I often search for PDFs to answer questions for people and if I click the link it pops up in an external viewer and I get no opportunity to copy a url. Unfortunately the right-click to copy also triggers the onclick handler to add the google tracking spam, causing me to copy an extremely long and chat-unfriendly URL.
- a1369209993 6y ago
  FWIW, NoScript fixes this, since the clickjacking malware can't run by default.
- scoutt 6y ago
  I know. You have to set the browser to ask what to do for every download. Then you download the PDF. After that go to "downloads" and right-click and select "copy source URL" or something like that. That's the only way I've found to get the real URL.
  - em-bee 6y ago
    why not display the pdf in the browser? that keeps the url in the address bar
    - scoutt 6y ago
      Some sites make you download the PDF instead of showing it in the browser. The new tab opens and closes immediately after fetching the URL, so you don't get to see the URL in the bar. If the browser is set to open files with known editors, it will be downloaded and opened (and I can't recall if the PDF is still in the download list in the browser). Edit: I work with datasheets. The following link forces me to download the PDF: https://www.st.com/resource/en/datasheet/stm32f103rc.pdf https://www.st.com/resource/en/datasheet/stm32f103rc.pdf This does not: https://www.mouser.it/datasheet/2/389/stm32f103rg-1851026.pdf https://www.mouser.it/datasheet/2/389/stm32f103rg-1851026.pd... Don't ask me why....
securitymb 6y ago
Hey, I'm the author of the write-up. Nice to see my research here! If you have any questions, please let me know.

61 points by pjf 6y ago

Copy and paste in browsers is a horrible mess, as LibreOffice is finding out with its web version: https://people.gnome.org/~michael/data/2019-09-12-copy-paste.pdf https://people.gnome.org/~michael/data/2019-09-12-copy-paste...

gcbw3 6y ago
Heh. this reminded me some libreoffice bugs i track. One is to have plain text copy paste be the default. The other is to completely disable selected text dragging. There's a large number of people who likes both of these features. Go figure.
mjevans 6y ago
Google's suite requests the use of a a plugin helper for anything serious.

divbzero 6y ago

Great write-up. Reminds me of different copy-paste concerns that persist in other platforms. [1] [1]: https://news.ycombinator.com/item?id=22569662 https://news.ycombinator.com/item?id=22569662

andrewstuart 6y ago

All keyboards should have cut/copy/paste buttons under the delete/end/pgdn row.

elpescado 6y ago
They do have Command/Ctrl and X, C and V, though.
spupy 6y ago
On Linux: Control+Insert/Shift+Insert for copy/paste

autocorr 6y ago

It's tangential to the article, but I've found it's been really helpful to have dedicated copy and paste buttons on the left hand. On Linux the highlight and middle click is nice, but not every application can be selected (like split windows in tmux) and the buffers don't always match between applications (like Firefox and something else). But I've found Ctrl+Insert and Shift+Insert works practically without fail everywhere. I have a programmable keyboard so made macros for those two commands and mapped them to keys on the non-mouse hand (extra thumb keys on an ergodox, not bad to lift the hand a little to reach them). Works great! For something so universal as copying text it would make sense to have dedicated keys for them on many keyboards, like volume up or down.

mattigames 6y ago

In a barely related subject, does anybody knows a good clipboard manager (e.g. multiple copy + paste) for mac that supports both text and images? (like Ditto on Windows)

Khannan 6y ago
Maccy has served me very well. Open source too! https://github.com/p0deje/Maccy https://github.com/p0deje/Maccy
oxfeed65261 6y ago
For Windows, Thornsoft Clipmate is very powerful and one of my must-have utilities, despite its lack of recent updates. http://thornsoft.com/ http://thornsoft.com/

pjc50 6y ago

The ability of Javascript to alter the "copy" contents is, like the ability to disable zoom, something that's nearly always used against the user and the usability and accessibility of the site. Such as appending disclaimers and copyright notices to strings.

elpescado 6y ago
The problem is that the same medium (HTML) is used for "documents" and "applications". Programmatic access to clipboard, zoom etc is legitimate for "HTML applications" like Google Docs/Maps but unnecessary for "HTML documents", along with virtually all scripting.
- pavel_lishin 6y ago
  In a more perfect world, browsers would require websites to ask permission before allowing access to the copy/paste buffer.
  - sam_goody 6y ago
    Except that the ability to copy is extremely useful. And creating more popup-approval fatigue doesn't help anyone. You are a super-user, so it might be the git clone URL of a really long commit. That "click to copy" button on github is really useful. The same scenario exists from Grandma, and she will click the popup or give up in frustration - neither of which is good. IMO, sites should be able to have access to the copy buffer but not to the paste. Paste should be available to the user with ctrl+P. Definitely not perfect, but more mitigable.
    - pavel_lishin 6y ago
      I don't think the putative Grandma has much need for copy-and-paste functionality from websites. And yes, there would be fatigue, and me-the-super-user would globally block those popups from coming up. It's honestly not worth it. I would miss it maybe once a month, which is about how often I get annoyed by something messing with it. Maybe a middle ground would be allowing websites to _insert_ things into the buffer, but not _modifying_ the buffer. (Though of course, they could just inspect what's highlighted on the page, and then flat out insert that plus their garbage, except I'd argue that I don't think they need to know what I've got highlighted, then you'd point out that that would break Google Docs, and I'd suggest another popup, and you'd say that Grandma can't handle the fatigue, etc., etc.)

nullc 6y ago

The related issue most irritating for me is that google search makes the URL hover claim one destination but when you click the click itself rewrites the URL to funnel through their tracking service. This is an extremely dangerous attack vector which google is abusing to compromise user privacy (but fortunately, not worse). There was a firefox bug open on this for years but it seems like Mozilla really didn't want to break their big sponsor's analytics. ( https://bugzilla.mozilla.org/show_bug.cgi?id=229050 https://bugzilla.mozilla.org/show_bug.cgi?id=229050 ) I find it extremely annoying because I often search for PDFs to answer questions for people and if I click the link it pops up in an external viewer and I get no opportunity to copy a url. Unfortunately the right-click to copy also triggers the onclick handler to add the google tracking spam, causing me to copy an extremely long and chat-unfriendly URL.

a1369209993 6y ago
FWIW, NoScript fixes this, since the clickjacking malware can't run by default.
scoutt 6y ago
I know. You have to set the browser to ask what to do for every download. Then you download the PDF. After that go to "downloads" and right-click and select "copy source URL" or something like that. That's the only way I've found to get the real URL.
- em-bee 6y ago
  why not display the pdf in the browser? that keeps the url in the address bar
  - scoutt 6y ago
    Some sites make you download the PDF instead of showing it in the browser. The new tab opens and closes immediately after fetching the URL, so you don't get to see the URL in the bar. If the browser is set to open files with known editors, it will be downloaded and opened (and I can't recall if the PDF is still in the download list in the browser). Edit: I work with datasheets. The following link forces me to download the PDF: https://www.st.com/resource/en/datasheet/stm32f103rc.pdf https://www.st.com/resource/en/datasheet/stm32f103rc.pdf This does not: https://www.mouser.it/datasheet/2/389/stm32f103rg-1851026.pdf https://www.mouser.it/datasheet/2/389/stm32f103rg-1851026.pd... Don't ask me why....

securitymb 6y ago

Hey, I'm the author of the write-up. Nice to see my research here! If you have any questions, please let me know.