3 ms·

I don't think that javascript should be permitted to know what text you've selected as displayed in your browser or that you've copied it to clipboard. Fundamen

I don't think that javascript should be permitted to know what text you've selected as displayed in your browser or that you've copied it to clipboard. Fundamental mismatch in the rights of the end user client device and person operating the browser vs. the httpd. At least not without going through the same level of explicit permission popup that you would need for microphone or camera access in a modern browser. What people copy to clipboard on their own client workstation device should be exclusively up to their local control. Mostly I see this in websites that deploy some mostly-futile "special sauce" code to prevent things like right-click/save-as of images. And similar.

Waterluvian 5y ago
I’m not sure this changes a thing unless you also want a permission popup for tracking when text is even selected. And at that point you’re getting permission to be aware of basic DOM events.
tshaddox 5y ago
The practical problem with this idea is that you would essentially need to remove the ability of JavaScript to track all human input (mouse movement, clicks, etc.) since that could already be used to figure out what they’re selecting. Sure, browsers could try to hide this info with clever rules like not reporting mouse movements while the mouse button is being held and text is being selected, but it would be pretty hard to get right (and would probably break a lot of sites that aren’t doing anything nefarious, like any rich text editor).
VWWHFSfQ 5y ago
Your web browser is your operating system. It needs to have access to your peripherals and lower-level things like your clipboard and filesystem.
- walrus01 5y ago
  Sure it does, doesn't mean it needs to report back to a website what it's doing with it.
  - Thorrez 5y ago
    Is your position that Javascript shouldn't be able to see click and drag events? That would make a lot of browser games, tools (e.g. broswer image editors) and certain browser drag and drop functionality (e.g. a custom video or audio scrub bar) not work. They would require permission popups.
ftl64 5y ago
If anyone uses Firefox, it is possible to disable websites from knowing about any clipboard-related events. Go to about:config, search for dom.event.clipboardevents.enabled and set it to false. Done.
- jlarocco 5y ago
  Sorry to go off topic, but is there documentation for the settings in about:config? And why don't they have a better UI? It's pretty sad that something as security sensitive as browser settings requires trusting random strangers on the internet or digging through source code to understand what's going on.
  - heavyset_go 5y ago
    There's Mozilla wiki pages for many of the options in about:config. Check this out: http://kb.mozillazine.org/About:config_Entries http://kb.mozillazine.org/About:config_Entries If Mozilla made a chrome UI for those settings, they'd be accused of adding bloat to Firefox, creating complex options that confuse users, and making Firefox harder to use than Chrome-based browsers. I've noticed that open source really can't win in that department, so power user settings are put out of sight and out of mind, or are eliminated completely.
    - throwawaylinux 5y ago
      > If Mozilla made a chrome UI for those settings, they'd be accused of adding bloat to Firefox, creating complex options that confuse users, and making Firefox harder to use than Chrome-based browsers. Possibly, but does Mozilla actually care about accusations of bloat or poor usability?
    - jlarocco 5y ago
      Thank you! That's more documentation than I knew about before. TBH, the I personally think the UI is fine, but it's annoying to have so many places to look for settings. Chromium/Chrome have chrome://flags, which is basically the same UI, but all of the options have a few sentences explaining what they do. I still miss Opera; they were the only browser developer who didn't take the "Users are stupid and easily confused" approach to browser development.

Waterluvian 5y ago

I’m not sure this changes a thing unless you also want a permission popup for tracking when text is even selected. And at that point you’re getting permission to be aware of basic DOM events.

tshaddox 5y ago

The practical problem with this idea is that you would essentially need to remove the ability of JavaScript to track all human input (mouse movement, clicks, etc.) since that could already be used to figure out what they’re selecting. Sure, browsers could try to hide this info with clever rules like not reporting mouse movements while the mouse button is being held and text is being selected, but it would be pretty hard to get right (and would probably break a lot of sites that aren’t doing anything nefarious, like any rich text editor).

VWWHFSfQ 5y ago

Your web browser is your operating system. It needs to have access to your peripherals and lower-level things like your clipboard and filesystem.

walrus01 5y ago
Sure it does, doesn't mean it needs to report back to a website what it's doing with it.
- Thorrez 5y ago
  Is your position that Javascript shouldn't be able to see click and drag events? That would make a lot of browser games, tools (e.g. broswer image editors) and certain browser drag and drop functionality (e.g. a custom video or audio scrub bar) not work. They would require permission popups.

ftl64 5y ago

If anyone uses Firefox, it is possible to disable websites from knowing about any clipboard-related events. Go to about:config, search for dom.event.clipboardevents.enabled and set it to false. Done.

jlarocco 5y ago
Sorry to go off topic, but is there documentation for the settings in about:config? And why don't they have a better UI? It's pretty sad that something as security sensitive as browser settings requires trusting random strangers on the internet or digging through source code to understand what's going on.
- heavyset_go 5y ago
  There's Mozilla wiki pages for many of the options in about:config. Check this out: http://kb.mozillazine.org/About:config_Entries http://kb.mozillazine.org/About:config_Entries If Mozilla made a chrome UI for those settings, they'd be accused of adding bloat to Firefox, creating complex options that confuse users, and making Firefox harder to use than Chrome-based browsers. I've noticed that open source really can't win in that department, so power user settings are put out of sight and out of mind, or are eliminated completely.
  - throwawaylinux 5y ago
    > If Mozilla made a chrome UI for those settings, they'd be accused of adding bloat to Firefox, creating complex options that confuse users, and making Firefox harder to use than Chrome-based browsers. Possibly, but does Mozilla actually care about accusations of bloat or poor usability?
  - jlarocco 5y ago
    Thank you! That's more documentation than I knew about before. TBH, the I personally think the UI is fine, but it's annoying to have so many places to look for settings. Chromium/Chrome have chrome://flags, which is basically the same UI, but all of the options have a few sentences explaining what they do. I still miss Opera; they were the only browser developer who didn't take the "Users are stupid and easily confused" approach to browser development.