12 ms·

You have to imagine the Apple engineers who implemented this new clipboard notification knew this shitstorm was coming.

draw_down 6y ago
Sure, this practice is probably the reason they did it in the first place
RandallBrown 6y ago
I'm guessing that's part of the reason they didn't implement a clipboard permission. It would probably have broken a TON of stuff in weird ways. I expect to see an actual clipboard permission at some point.
- DyslexicAtheist 6y ago
  a tinfoil hat tip: imagine the shitstorm if Apple would allow proper introspection instead of suing these companies who offer such a service. that storm would be much harder to manage now. if I'd really believe it myself I'd even say controlling the messaging was part of the reason why they sued these companies and instead are providing limited subset of such features themselves.
- dewey 6y ago
  Maybe I'm missing something but a clipboard permission seems to be pretty useless for most apps. When I want to login I have to paste my password, when I want to paste an email address into a Linkedin chat I need the clipboard. So everyone would just grant that permission anyway as it makes a lot of apps useless without and they'd just continue their harvesting after that. It would be a very small percentage to selectively enable/disable the clipboard permissions for certain tasks.
  - mixmastamyk 6y ago
    Pasting to the clipboard into a standard widget is different than reading/writing it. Hopefully in mobile OS as well.
  - Vvector 6y ago
    The clipboard is controlled by the OS. When you 'paste' the OS sends the contents to the app. There is no need for an app to have access to the clipboard.
    - filleduchaos 6y ago
      I'm curious - have you ever actually looked into how clipboards work across various OSes? Because programmatic clipboard access is the norm pretty much across the board.
      - nitrogen 6y ago
        It doesn't have to be though. Especially on a platform that only has one UI toolkit, controlled by the vendor.
        filleduchaos 6y ago
        Ah, so _now_ we're asking Apple to disallow any UI development whatsoever outside of using the components in the UIKit and AppKit SDKs (and screw you if you want to develop any sort of interface that's not supported or intended to be supported out of the box by the above)? Very interesting indeed. I understand the outrage over programs abusing the resources they have access to, but frankly this is just approaching hysteria. This is the equivalent of reading an article about an app snooping at documents you didn't open for sensitive data and jumping to the conclusion that operating systems should not support programmatic access to the filesystem.
        leppr 6y ago
        I'll give a similar reply as I did to your other comment: the most popular platform for interacting with low-trust applications, the web, sanely does not allow apps to access your whole filesystem. It would have never thrived as it did if users had to limit themselves to a small selection of vendors they can thrust with their whole system. There's a huge difference in usage between apps on desktop OSs, which are often of less commercial nature, open-source, and more carefully vetted by centralized gatekeepers, and the mobile app ecosystem, where any random fast food chain will entice you to install their app to make an online order. The smartphone app ecosystem has to be low trust, like the web.
  - RandallBrown 6y ago
    Being able to accept pastes wouldn't require any permission. Being able to read the clipboard without the user knowing would.
- jorvi 6y ago
  Wait what, they show the pop-up, but there is no permission toggle for access?
  - nemothekid 6y ago
    I feel like a copy/paste permission would be useless and the notification is 100x better. Most people would click "accept" on the permission and never think about it. "Oh of course I need the ability to copy/paste on tiktok, how else will I paste 90sMusicChallenge in the search bar?"
spideymans 6y ago
Part of me wishes they dropped this feature in a random dot release, to give these developers a well deserved public flogging. Of course, the responsible part of me knows that’s a bad idea. Sigh.
- Wowfunhappy 6y ago
  tbqh, why would that be a bad idea? It's a minor feature from a technical standpoint.
  - gpm 6y ago
    It would annoy their (Apple's) users more than necessary.
    - Wowfunhappy 6y ago
      I actually really like how Apple implemented this though. If apps aren't doing something very clearly nefarious, it's not annoying at all.
      - gpm 6y ago
        I mean, hn users aren't exactly normal, and while I'm sure many people like this feature that doesn't mean they want their day to be unnecessarily and repeatedly interrupted when that could have been solved by giving the sites a few days notice.
      - comex 6y ago
        It's not necessarily nefarious though. https://twitter.com/twolivesleft/status/1275776460918157315 https://twitter.com/twolivesleft/status/1275776460918157315
        Wowfunhappy 6y ago
        Ah, thanks, that's a case I didn't think of. And a pretty good reason to keep this out of a point release!
sneak 6y ago
Now if only they would finally Sherlock Little Snitch for iOS; the amount of spyware embedded in almost every single app in the App Store is astounding. I make a point of knowing about this stuff and even I was flabbergasted the first few times I ran my iPhone via a proxy. Apple claims that you consented you this when you agreed to the App Store TOS.
- faizshah 6y ago
  Can you share how you did this? I would like to try it.
  - walterbell 6y ago
    Charles Proxy on App Store.
  - K0nserv 6y ago
    For a free alternative I’ve got a blog post[0] detailing how to do it with the excellent mitmproxy utility. There’s also Burpsuite community edition which is pretty decent 0: https://hugotunius.se/2019/01/23/going-spelunking-with-mitmproxy.html https://hugotunius.se/2019/01/23/going-spelunking-with-mitmp...
- novok 6y ago
  There are so-so approximations of it, like the guardian vpn/firewall: https://guardianapp.com/ https://guardianapp.com/
  - randomchars 6y ago
    Unfortunately the approximations are not that great, requiring you to route all your network traffic through an unknown company.
    - holidaytrucksky 6y ago
      There's also https://lockdownhq.com/ https://lockdownhq.com/ which should work on device. There really should be something like Screen Time directly integrated in the OS.

Sure, this practice is probably the reason they did it in the first place

I'm guessing that's part of the reason they didn't implement a clipboard permission. It would probably have broken a TON of stuff in weird ways. I expect to see an actual clipboard permission at some point.

DyslexicAtheist 6y ago
a tinfoil hat tip: imagine the shitstorm if Apple would allow proper introspection instead of suing these companies who offer such a service. that storm would be much harder to manage now. if I'd really believe it myself I'd even say controlling the messaging was part of the reason why they sued these companies and instead are providing limited subset of such features themselves.
dewey 6y ago
Maybe I'm missing something but a clipboard permission seems to be pretty useless for most apps. When I want to login I have to paste my password, when I want to paste an email address into a Linkedin chat I need the clipboard. So everyone would just grant that permission anyway as it makes a lot of apps useless without and they'd just continue their harvesting after that. It would be a very small percentage to selectively enable/disable the clipboard permissions for certain tasks.
- mixmastamyk 6y ago
  Pasting to the clipboard into a standard widget is different than reading/writing it. Hopefully in mobile OS as well.
- Vvector 6y ago
  The clipboard is controlled by the OS. When you 'paste' the OS sends the contents to the app. There is no need for an app to have access to the clipboard.
  - filleduchaos 6y ago
    I'm curious - have you ever actually looked into how clipboards work across various OSes? Because programmatic clipboard access is the norm pretty much across the board.
    - nitrogen 6y ago
      It doesn't have to be though. Especially on a platform that only has one UI toolkit, controlled by the vendor.
      - filleduchaos 6y ago
        Ah, so _now_ we're asking Apple to disallow any UI development whatsoever outside of using the components in the UIKit and AppKit SDKs (and screw you if you want to develop any sort of interface that's not supported or intended to be supported out of the box by the above)? Very interesting indeed. I understand the outrage over programs abusing the resources they have access to, but frankly this is just approaching hysteria. This is the equivalent of reading an article about an app snooping at documents you didn't open for sensitive data and jumping to the conclusion that operating systems should not support programmatic access to the filesystem.
        leppr 6y ago
        I'll give a similar reply as I did to your other comment: the most popular platform for interacting with low-trust applications, the web, sanely does not allow apps to access your whole filesystem. It would have never thrived as it did if users had to limit themselves to a small selection of vendors they can thrust with their whole system. There's a huge difference in usage between apps on desktop OSs, which are often of less commercial nature, open-source, and more carefully vetted by centralized gatekeepers, and the mobile app ecosystem, where any random fast food chain will entice you to install their app to make an online order. The smartphone app ecosystem has to be low trust, like the web.
- RandallBrown 6y ago
  Being able to accept pastes wouldn't require any permission. Being able to read the clipboard without the user knowing would.
jorvi 6y ago
Wait what, they show the pop-up, but there is no permission toggle for access?
- nemothekid 6y ago
  I feel like a copy/paste permission would be useless and the notification is 100x better. Most people would click "accept" on the permission and never think about it. "Oh of course I need the ability to copy/paste on tiktok, how else will I paste 90sMusicChallenge in the search bar?"

spideymans 6y ago

Part of me wishes they dropped this feature in a random dot release, to give these developers a well deserved public flogging. Of course, the responsible part of me knows that’s a bad idea. Sigh.

Wowfunhappy 6y ago
tbqh, why would that be a bad idea? It's a minor feature from a technical standpoint.
- gpm 6y ago
  It would annoy their (Apple's) users more than necessary.
  - Wowfunhappy 6y ago
    I actually really like how Apple implemented this though. If apps aren't doing something very clearly nefarious, it's not annoying at all.
    - gpm 6y ago
      I mean, hn users aren't exactly normal, and while I'm sure many people like this feature that doesn't mean they want their day to be unnecessarily and repeatedly interrupted when that could have been solved by giving the sites a few days notice.
    - comex 6y ago
      It's not necessarily nefarious though. https://twitter.com/twolivesleft/status/1275776460918157315 https://twitter.com/twolivesleft/status/1275776460918157315
      - Wowfunhappy 6y ago
        Ah, thanks, that's a case I didn't think of. And a pretty good reason to keep this out of a point release!

sneak 6y ago

Now if only they would finally Sherlock Little Snitch for iOS; the amount of spyware embedded in almost every single app in the App Store is astounding. I make a point of knowing about this stuff and even I was flabbergasted the first few times I ran my iPhone via a proxy. Apple claims that you consented you this when you agreed to the App Store TOS.

faizshah 6y ago
Can you share how you did this? I would like to try it.
- walterbell 6y ago
  Charles Proxy on App Store.
- K0nserv 6y ago
  For a free alternative I’ve got a blog post[0] detailing how to do it with the excellent mitmproxy utility. There’s also Burpsuite community edition which is pretty decent 0: https://hugotunius.se/2019/01/23/going-spelunking-with-mitmproxy.html https://hugotunius.se/2019/01/23/going-spelunking-with-mitmp...
novok 6y ago
There are so-so approximations of it, like the guardian vpn/firewall: https://guardianapp.com/ https://guardianapp.com/
- randomchars 6y ago
  Unfortunately the approximations are not that great, requiring you to route all your network traffic through an unknown company.
  - holidaytrucksky 6y ago
    There's also https://lockdownhq.com/ https://lockdownhq.com/ which should work on device. There really should be something like Screen Time directly integrated in the OS.