3 ms·

Developers who think they're doing the world a security favor by inhibiting paste into password boxes have a special place in hell.

rob74 2y ago
Maybe the developers even know better, but were forced to do it by project managers (or other management)? Because this sounds like just the kind of "security issue" a manager could get hung up on...
- pc86 2y ago
  This will be an unpopular opinion but part of your job as a good developer is being able to explain to your boss why this is an asinine thing to do, and convince them otherwise. If you're both powerless to make a decision as small as this and unable to convince even a single person above you to back you up on it you're not a very effective engineer.
  - danaris 2y ago
    That basically says "your skill as a good developer depends on your boss being somewhat reasonable." Not everyone's boss is even a little bit reasonable. You might be both a very skilled engineer and capable of explaining things very clearly and persuasively, but communication always takes two (or more) parties, and both those parties have to be approaching that communication in good faith in order for the actual skills of communication to really matter.
    - pc86 2y ago
      There's this trope that most bosses are this curious mix of idiot, sadist, and fat cat blueblood completely incapable of reason, who produces nothing of value, and just sits around thinking of ways to make things harder on the engineers. Most people are reasonable, including people who happen to be managers. Most people will listen to you if you make informed, persuasive arguments. And even when they don't, most people will be able to articulate to you a perfectly valid reason why the thing you want to do can't happen, or can't happen yet.
      - hunter2_ 2y ago
        As a thought experiment, playing devil's advocate in a way, suppose the boss tries to be reasonable and ends up telling the developer "you make a good point, and I would support it, but my hands are tied because x." Presumably there is some value of x here that, while terrible for UX/a11y, actually exists in some fashion when it comes to using the clipboard for passwords. Maybe the fact that all apps can arbitrarily read from the clipboard, and people tend to be too lazy to copy a non-secret to the clipboard between pasting a secret and opening a sketchy app? Recent versions of Android toss up a toast notification saying something like "<app> has pasted from the clipboard" when an app does so, and I've seen it for no apparent reason in some apps -- usually apps associated with IoT junk, but sometimes even apps that ought to be reputable. I'm not normally a fan of ecosystem lock-in, but using Google products as my password manager, browser, and mobile OS means I very rarely have to use my clipboard for passwords, which is a good feeling. Unlike a third-party password manager with a great browser extension could offer, this ensures seamless autofill with most mobile apps nowadays, too.
      - danaris 2y ago
        I didn't say "all" or even "most". You were the one making absolute categorical statements. Some managers are unreasonable, and will not change their minds about what they've decided because of the arguments, no matter how rational and well-expressed, of people beneath them. Declaring categorically that any engineer who cannot persuade their manager not to do something bloody stupid is a bad engineer is insulting to engineers who are, in fact, in exactly that situation, and is, from where I sit, part of a very large category of mistake where someone tries to avoid having to apply human judgement and critical thinking by making a hard and fast rule about things that are much more nuanced and fuzzy.
    - account42 2y ago
      Well a good developer would have choice who to work for, no?
- xxs 2y ago
  You're a terrible developer if some project manager tells you to disable paste... and you listen to. I know it's easier to pick jira task, implement them feeling you're making the world a better place.
- NovemberWhiskey 2y ago
  If you have project managers that tell developers to implement features like this, and you don't have a product management function which actually represents what users want, then ... I mean, I don't even know where to go with that.
- robjan 2y ago
  These anti-features are almost always a requirement coming from either a cyber security or compliance department, not from product or engineering.

rob74 2y ago

Maybe the developers even know better, but were forced to do it by project managers (or other management)? Because this sounds like just the kind of "security issue" a manager could get hung up on...

pc86 2y ago
This will be an unpopular opinion but part of your job as a good developer is being able to explain to your boss why this is an asinine thing to do, and convince them otherwise. If you're both powerless to make a decision as small as this and unable to convince even a single person above you to back you up on it you're not a very effective engineer.
- danaris 2y ago
  That basically says "your skill as a good developer depends on your boss being somewhat reasonable." Not everyone's boss is even a little bit reasonable. You might be both a very skilled engineer and capable of explaining things very clearly and persuasively, but communication always takes two (or more) parties, and both those parties have to be approaching that communication in good faith in order for the actual skills of communication to really matter.
  - pc86 2y ago
    There's this trope that most bosses are this curious mix of idiot, sadist, and fat cat blueblood completely incapable of reason, who produces nothing of value, and just sits around thinking of ways to make things harder on the engineers. Most people are reasonable, including people who happen to be managers. Most people will listen to you if you make informed, persuasive arguments. And even when they don't, most people will be able to articulate to you a perfectly valid reason why the thing you want to do can't happen, or can't happen yet.
    - hunter2_ 2y ago
      As a thought experiment, playing devil's advocate in a way, suppose the boss tries to be reasonable and ends up telling the developer "you make a good point, and I would support it, but my hands are tied because x." Presumably there is some value of x here that, while terrible for UX/a11y, actually exists in some fashion when it comes to using the clipboard for passwords. Maybe the fact that all apps can arbitrarily read from the clipboard, and people tend to be too lazy to copy a non-secret to the clipboard between pasting a secret and opening a sketchy app? Recent versions of Android toss up a toast notification saying something like "<app> has pasted from the clipboard" when an app does so, and I've seen it for no apparent reason in some apps -- usually apps associated with IoT junk, but sometimes even apps that ought to be reputable. I'm not normally a fan of ecosystem lock-in, but using Google products as my password manager, browser, and mobile OS means I very rarely have to use my clipboard for passwords, which is a good feeling. Unlike a third-party password manager with a great browser extension could offer, this ensures seamless autofill with most mobile apps nowadays, too.
    - danaris 2y ago
      I didn't say "all" or even "most". You were the one making absolute categorical statements. Some managers are unreasonable, and will not change their minds about what they've decided because of the arguments, no matter how rational and well-expressed, of people beneath them. Declaring categorically that any engineer who cannot persuade their manager not to do something bloody stupid is a bad engineer is insulting to engineers who are, in fact, in exactly that situation, and is, from where I sit, part of a very large category of mistake where someone tries to avoid having to apply human judgement and critical thinking by making a hard and fast rule about things that are much more nuanced and fuzzy.
  - account42 2y ago
    Well a good developer would have choice who to work for, no?
xxs 2y ago
You're a terrible developer if some project manager tells you to disable paste... and you listen to. I know it's easier to pick jira task, implement them feeling you're making the world a better place.
NovemberWhiskey 2y ago
If you have project managers that tell developers to implement features like this, and you don't have a product management function which actually represents what users want, then ... I mean, I don't even know where to go with that.
robjan 2y ago
These anti-features are almost always a requirement coming from either a cyber security or compliance department, not from product or engineering.