10 ms·
The web's clipboard, and how it stores data of different types
- cebert 2y agoNice writeup. This explains why I have issues trying paste with/without formatting on Firefox on my Mac in Google Docs. It’s interesting that Google is using a deprecated API to add their own content type format to the clipboard.
- throwaway48476 2y agoAt some point the Google web should be declared an official fork of the web.
- dumbo-octopus 2y agoIf some bigwig has marked an API “depreciated”, but hasn’t provided a viable alternative and the user experience suffers when user agents stop allowing their users to invoke the helpful functionality, the agents who do let their users do what they want are not the issue.
- kevingadd 2y agoI miss the flash player and unity player plugins too. Remember how powerful activex was?
- robocat 2y agoThe main issue with powerful tools is that they get used against you by threat actors. Our society sets limits based on the most selfish. Our computers get limitations based on the most effective threat.
- dumbo-octopus 2y agoThe only “problem” with the clipboard API is shitty applications blindly trusting client data.
- layer8 2y agoPerl did something right with its taint mode: https://perldoc.perl.org/perlsec#Taint-mode https://perldoc.perl.org/perlsec#Taint-mode
- deleted 2y ago[deleted]
- talldayo 2y agoThe only thing wrong with all three things you mentioned is that they're proprietary. Google is not holding the web hostage with W3C standards.
- RajT88 2y agoNitpick: Depreciated means gone down in value. Deprecated means made obsolete. I hear this all the time at work. Drives me nuts.
- ggm 2y agoJoin me, and we can form an army. We need to solve this, and "learnings". I think it's possible this becomes the Butlerian Jihad but without spice.
- defrost 2y agoYou want spice? Irregardless, I could care less.
- anileated 2y agoAs long as you have the codes!
- colecut 2y agoThat's literally bonkers
- ggm 2y agoLiterally, Figuratively, Virtually and Actually. Great words, frequently misused. I also adore "very unique"
- colecut 2y ago"Literally" has been abused so much that they have officially made an informal definition of it to mean "figuratively." Which means "literally" is now its own antonym. Pretty wild
- JadeNB 2y ago> We need to solve this, and "learnings". What is "learnings"?
- calvinmorrison 2y agowhats wrong with a language that has only one VM? Do we really need 5 VMs?
- ivanjermakov 2y agoConsidering Chrome influence, this might drive non-fork web obsolete
- Terretta 2y agoParticularly good combination of scope (including differences across systems and browsers) and depth (including both gotchas and workarounds).
- alexharri 2y agoThanks! I've been trying to limit excessive detail and tangents in my writing (my posts tend to be on the longer side). Great to hear I managed to strike a good balance here.
- qingcharles 2y agoThis was easily the greatest article ever written on the web clipboard interfaces. I didn't even know about isTrusted until a couple of weeks ago when I was writing some widgets to speed up some tasks by automating a bunch of web controls. I couldn't get my auto-paste to work, discovered that flag and went down a rabbit hole of trying to over-ride a safety mechanism on my own local browser (not easy!).
- 38 2y agorich text content should never be the default paste. just give me the damn text I copied
- Sayrus 2y agoFor what it's worth, Ctrl/Cmd + Shift + V will paste the raw clipboard even if a rich format is available.
- zie 2y agoI just paste through a plain text editor(i.e. paste into a plain text editor, verify and copy the bits I want, then paste it in it's intended destination). I know not ideal, but at least that way I can see and verify everything before pasting it somewhere important. I'm sure there are some hacks one can do with rich formats, that some people might try to take advantage of.
- gwervc 2y agoI do that within a new browser tab url bar, since the shortcut is quite annoying to type.
- pests 2y agoSending your clipboard data to Google if you have predictive type on
- rzzzt 2y agoBut do you press Ctrl/Cmd + C three times or more to make sure it takes effect?
- threecheese 2y agoWhy are you watching me???
- eyelidlessness 2y ago
- cr125rider 2y agoThis was awesome. Thanks! A really nice deep enough dive into some of that nuance.
- fitsumbelay 2y agovery illuminating and idea-provoking deep dive. thanks.
- kfarr 2y agoMy takeaway is the most reliable way to send custom app data over clipboard is using data embedded in HTML a la figma. Bonus is that method lets you define failure behavior via html message if receiving app doesn’t support
- fitsumbelay 2y agobtw, what was the Chrome extension you were prompted about on your macbook?
- weejewel 2y agoYears ago when I was a student, and JavaScript could get a user’s clipboard without their consent, I made a website ‘getpasted’ that automatically pasted and posted your clipboard to a public database. Needless to say, some people weren’t happy about it. But it was a nice project to create awareness that it was possible to read the clipboard at any time.
- RajT88 2y agoWait until people find out that by default on Windows 11 all of your clipboard data gets sent to a Microsoft server via Clipboard History / Cloud Clipboard.
- cj 2y agoIs Apple’s version of this any better? Clipboard is synced between phone/computers logged into iCloud although it doesn’t log history (at least visibly)
- unilynx 2y agoIt requires iCloud but the data itself is transferred directly over Bluetooth or local WiFi (like airdrop) so it shouldn’t hit any Apple servers. https://support.apple.com/en-gb/guide/security/secf78dbe639/web https://support.apple.com/en-gb/guide/security/secf78dbe639/...
- knallfrosch 2y agoSince it is also end-to-end encrypted, an architecture involving Apple server wouldn't reveal the contents either.
- ygra 2y agoClipboard history and sync across devices are both disabled by default, as far as I'm aware.
- 2y ago
- threecheese 2y agoExcellent read, thank you. Just wanted to note that the author of Pasteboard Manager[0], Sindre Sorhus, is also the maker of Actions[1] shortcut library as well as other cool iPhone and Mac apps. Not sure if he is on HN. - 0. https://apps.apple.com/us/app/pasteboard-viewer/id1499215709 - 1. https://apps.apple.com/us/app/actions/id1586435171
- xelamonster 2y agoOh I recognize that name, they've got quite a few nice NPM packages published as well. https://www.npmjs.com/~sindresorhus https://www.npmjs.com/~sindresorhus
- djbusby 2y agoOn the subject of getting "private" data from the browser. Somehow my Bank webapp was able to 2FA prompt me on sign-in with my hostname (aluminium). How did it get that? And when using their site from mobile it's able to see the text with the 2FA code and auto paste it in! Wow/How? Pixel+Chrome or Linux+Chrome.
- echoangle 2y agoAt least the 2FA Code probably is a Chrome feature, safari displays 2FA SMS text codes as a autocomplete suggestion and I could imagine that Chrome on Android just autofills it. For the hostname, it’s more difficult. Are you sure you never gave that info to the bank as a username or similar? What Bank is this?
- djbusby 2y agoInstitution for Savings. They use an app/webapp built by a third party that covers loads of small banks.
- echoangle 2y agoAnd where exactly does it show your hostname there? And are you sure you never used it as an account name or something like that? I can’t imagine they can access the hostname from JS.
- ggm 2y agoWordpress stuffs around with this. Cut-pasting across multiple paragraphs in editor mode can go horribly wrong (copying wordpress words into another web system for cross-pollinating the textual dependencies over "there") -Presumably because the paragraphs are actually different regions under different DIV logic and under different control-effect outcomes? Another game I find the machine plays on me, is uplifting what I think is ASCII into UTF-8 or iso-latin1 which latterly invokes the clippy-like "I changed those quotes to be more aesthetic thank me later" behaviour which of course, I did NOT want. If I wanted `this' I would not have typed 'this'
- aumerle 2y agoThis article is a perfect illustration of why Webapps will never be as good as native ones. Webapps are always "untrusted" code so they are arbitrarily and artificially restricted from accessing resources on your local machine.
- goblin89 2y agoUntrusted by default is a feature. No user would be able to protect themselves, unless perhaps they are a highly trained security expert always on alert, which is not a thing. This is not the exciting early days of the interwebz where script kiddies run amok and it’s mostly for the geeks anymore, it’s where government-affiliated gangs are launching ransomware attacks on critical infrastructure in order to finance nuclear programs. Accessing arbitrary resources on your local machine is how that happens. Web apps, given a modern browser, naturally have stricter sandboxing, but native apps are treated as untrusted on any modern OS, too. If I launch anything new, the dialog will have me confirm before it accesses anything other than its isolated app data directory.
- aumerle 2y agoI dont run a single native application across five operating systems that requires a popup nag to access the clipboard or that is unable to put any data other than text, html and PNG on the clipboard.
- goblin89 2y agoEvery mobile OS from Apple would show a popup if an app tried to access clipboard without your explicit pasting. Obviously, if you tapped “paste” then popup would be unnecessary since you would be approving your own action, not app’s action. It is somewhat crazy that macOS doesn’t do that yet. But the comment I replied to was talking in general terms. Yes, for some APIs native apps are for now more trusted than Web apps, depending on the OS, but the trend is that they are becoming less and less trusted.
- aumerle 2y ago
- deleted 2y ago[deleted]
- visarga 2y agoOff topic: I often find that copy&paste doesn't work. I clearly hit copy, when I paste nothing happens, or I get the previous copy instead. Not sure why this happens, I see it both on Macs and Ubunutu. As if, after decades of work, we still can't reliably implement a simple operation. It happens both in browsers and other apps.
- shatsky 2y agoIt's sad that there's no support for lossy compressed images. People copypaste images a lot without intention to change them, and each time it's JPEG source the compression is lost but artifacts are preserved, and more artifacts are added upon repeated JPEG compression, which happens immediately with most target web apps. https://xkcd.com/1683/ https://xkcd.com/1683/
- bobbylarrybobby 2y agoWait, is this why when I `right click > copy` an image in safari and paste into messages, it gets turned into a png?