10 ms·

This was one of those things that frustrated me so much that we ended building this natively into Orion browser (Tools menu -> Allow Copy & Paste). [1] One of

This was one of those things that frustrated me so much that we ended building this natively into Orion browser (Tools menu -> Allow Copy & Paste). [1] One of the joys of building your own browser. [1] https://kagi.com/orion https://kagi.com/orion

ghostpepper 3y ago
How would you rate the security posture of Orion compared to Chrome?
- freediver 3y ago
  Along what axis?
  - ghostpepper 3y ago
    Size of security team? Mean time to patch actively exploited CVEs? Availability of source? Etc
    - freediver 3y ago
      Same as Safari in that regard, albeit with a much smaller team (we inherit upstream patches from the WebKit team and publish them regularly, sometimes even before Safari like in the case of patching iLeakage vulnerability).
- torstenvl 3y ago
  Well, there are apparently whole classes of JavaScript malware that Orion blocks but Google doesn't...
  - ghostpepper 3y ago
    This is exactly what I was asking, not sure why my post was downvoted
igetspam 3y ago
Brave has a "force paste" that I use now instead of Chrome and the linked plugin. I assume the motivation was the same. (What a*hole thinks blocking paste is reasonable??) Good on you for solving this too. It's a nonsense bit of functionality.
- serial_dev 3y ago
  It's always incapable product owners and business people who don't understand security but think they do.
cute_boi 3y ago
The problem with orion browser is it is not opensource.
idonotknowwhy 3y ago
Cheers for making Orion. I don't know how you guys managed to support Firefox and Chrome extensions (on iOS) but it's amazing and made moving from Android so much easier!
- freediver 3y ago
  Just the sheer determination to build the best browser in the world :)
quadhome 3y ago
Why allow pages to disable copy & paste at all?
- musicale 3y ago
  It's kind of a misfeature, but the non-evil idea was probably to provide hooks for customizing copy and paste (or other standard command functionality) in beneficial ways, for example seamlessly copying and pasting custom data formats between web apps, or between web and desktop apps. It is a law of the web that any potentially beneficial browser feature will immediately be (mis)used in an abusive, user-hostile manner.
- Spivak 3y ago
  It's not about disabling it, it's about intercepting it by telling the browser that you're directly handling paste events and then doing nothing. The extensions just forces the browser default handler.
panja 3y ago
Sadly, I am not in that ecosystem :(

ghostpepper 3y ago

How would you rate the security posture of Orion compared to Chrome?

freediver 3y ago
Along what axis?
- ghostpepper 3y ago
  Size of security team? Mean time to patch actively exploited CVEs? Availability of source? Etc
  - freediver 3y ago
    Same as Safari in that regard, albeit with a much smaller team (we inherit upstream patches from the WebKit team and publish them regularly, sometimes even before Safari like in the case of patching iLeakage vulnerability).
torstenvl 3y ago
Well, there are apparently whole classes of JavaScript malware that Orion blocks but Google doesn't...
- ghostpepper 3y ago
  This is exactly what I was asking, not sure why my post was downvoted

igetspam 3y ago

Brave has a "force paste" that I use now instead of Chrome and the linked plugin. I assume the motivation was the same. (What a*hole thinks blocking paste is reasonable??) Good on you for solving this too. It's a nonsense bit of functionality.

serial_dev 3y ago
It's always incapable product owners and business people who don't understand security but think they do.

cute_boi 3y ago

The problem with orion browser is it is not opensource.

idonotknowwhy 3y ago

Cheers for making Orion. I don't know how you guys managed to support Firefox and Chrome extensions (on iOS) but it's amazing and made moving from Android so much easier!

freediver 3y ago
Just the sheer determination to build the best browser in the world :)

quadhome 3y ago

Why allow pages to disable copy & paste at all?

musicale 3y ago
It's kind of a misfeature, but the non-evil idea was probably to provide hooks for customizing copy and paste (or other standard command functionality) in beneficial ways, for example seamlessly copying and pasting custom data formats between web apps, or between web and desktop apps. It is a law of the web that any potentially beneficial browser feature will immediately be (mis)used in an abusive, user-hostile manner.
Spivak 3y ago
It's not about disabling it, it's about intercepting it by telling the browser that you're directly handling paste events and then doing nothing. The extensions just forces the browser default handler.

panja 3y ago

Sadly, I am not in that ecosystem :(