4 ms·

There's no problem if I manually copy some text from a box in one app and paste it into another app, and I don't want a permission prompt for that. It's program

There's no problem if I manually copy some text from a box in one app and paste it into another app, and I don't want a permission prompt for that. It's programmatic access that I care about (apps snooping clipboard content). Technically they could probably be implemented the same way and the "manual" action is actually just granting the programmatic permission to the keyboard app.

deleted 6y ago
[deleted]
behringer 6y ago
The copy and paste button in all apps is programmatic. Windows can't tell the difference, for example, if a user copied from edit > copy or if the website did it itself. It could work if windows had a copy paste api with levels of access and trusted the apps to honor the access level. Then the browser could tell windows if a user clicked paste or if a website did.
- willis936 6y ago
  I argue that the clipboard shouldn’t be given any extra levels of trust because it’s current level of trust, very low, is the correct amount.
  - filleduchaos 6y ago
    Precisely! It's the rough equivalent of a tempfile in your home directory, I don't know why even developers have come to view it like it's some super secure and private kernel component.
  - behringer 6y ago
    That's all well and good, unless you're an attorney, author, document writer, research scientist, or literally anybody who types a lot... At jobs I've literally copy PHI all over the place for data processing. Copy and paste is vital and often top secret.
    - willis936 6y ago
      It’s a bad shaped tool for that problem. It’s a shared resource. There is a gaping hazard where any other piece of software can change the data you want to read before you can read it. Use a database.
      - behringer 6y ago
        If it were that simple there wouldn't be employees.
        willis936 6y ago
        I don’t mean look up a database. I mean make a database. Write a program that skims the document, parses what’s needed, and places it into a locally running database. Then, in another program, read the values you need. The clipboard is simply the wrong tool here. A database is bog standard.
        behringer 6y ago
        How do you write documents?
      - smichel17 6y ago
        What other tool provides same order of magnitude convenience for moving data verbatim between contexts? "Share" on mobile covers some use cases, but even then, you can't open a discrete password manager app and share your password directly to the password field in your browser.
- newjersey 6y ago
  Windows on the desktop is a completely different can of worms. For example, I installed a small application last week to take screenshots of my entire screen every so many seconds and it was then that I realized the whole installation process (there is no installation process, just a simple executable with a config file in the same directory) and execution required zero root privilege. Technically, any application (at least any application that lives in the system tray) can take screenshots of the whole screen as often as it likes. You can probably imagine it doesn't even need to store it on disk. It could just do some quick computation and send it to whoever.

deleted 6y ago

[deleted]

behringer 6y ago

The copy and paste button in all apps is programmatic. Windows can't tell the difference, for example, if a user copied from edit > copy or if the website did it itself. It could work if windows had a copy paste api with levels of access and trusted the apps to honor the access level. Then the browser could tell windows if a user clicked paste or if a website did.

willis936 6y ago
I argue that the clipboard shouldn’t be given any extra levels of trust because it’s current level of trust, very low, is the correct amount.
- filleduchaos 6y ago
  Precisely! It's the rough equivalent of a tempfile in your home directory, I don't know why even developers have come to view it like it's some super secure and private kernel component.
- behringer 6y ago
  That's all well and good, unless you're an attorney, author, document writer, research scientist, or literally anybody who types a lot... At jobs I've literally copy PHI all over the place for data processing. Copy and paste is vital and often top secret.
  - willis936 6y ago
    It’s a bad shaped tool for that problem. It’s a shared resource. There is a gaping hazard where any other piece of software can change the data you want to read before you can read it. Use a database.
    - behringer 6y ago
      If it were that simple there wouldn't be employees.
      - willis936 6y ago
        I don’t mean look up a database. I mean make a database. Write a program that skims the document, parses what’s needed, and places it into a locally running database. Then, in another program, read the values you need. The clipboard is simply the wrong tool here. A database is bog standard.
        behringer 6y ago
        How do you write documents?
    - smichel17 6y ago
      What other tool provides same order of magnitude convenience for moving data verbatim between contexts? "Share" on mobile covers some use cases, but even then, you can't open a discrete password manager app and share your password directly to the password field in your browser.
newjersey 6y ago
Windows on the desktop is a completely different can of worms. For example, I installed a small application last week to take screenshots of my entire screen every so many seconds and it was then that I realized the whole installation process (there is no installation process, just a simple executable with a config file in the same directory) and execution required zero root privilege. Technically, any application (at least any application that lives in the system tray) can take screenshots of the whole screen as often as it likes. You can probably imagine it doesn't even need to store it on disk. It could just do some quick computation and send it to whoever.