Hacker News Reader

Comment by leephillips | Hacker News Reader

Every day I read about another outrage being committed by another garbage app that I do not have and would never install on my phone. Why do people need a LinkedIn app? Even if you think that you need LinkedIn, can’t you access your please-spam-me account through your browser? Isn’t it obvious that every closed-source mystery program that you install increases your attack surface? You wouldn't click on an email attachment from a stranger in Russia, so why install an executable from a company that you already know is unethical?

View on HN

Perhaps not relevant to LinkedIn specifically, but in general people install these apps because they eventually get fed up with the purposefully crippled mobile website badgering them about it. Ever tried to use Yelp or Reddit's mobile websites? Impossible.

If only there was a app for always on desktop mode.

You can just turn the toggle on in Firefox on Android and it stays on in that tab until you turn it off (or close the tab)

I'm a little surprised that iOS content blockers haven't seemed to address nagware.

Content blockers aren't allowed to inject arbitrary JS which is often necessary to fix broken websites, unlike uBlock Origin.

Actually, no, I never have. But if I wanted to wallow in these sewers for some reason, and the mobile sites were unusable, I would use my laptop, or just manage to find some way to survive without them. Installing their apps is out of the question.

>Ever tried to use Yelp or Reddit's mobile websites? Impossible

The other day I tried to view a subreddit in Safari. It was literally impossible, it was claimed to be only available in the app.

If you don't mind seeing the desktop interface, prepend "old" to the domain on any reddit page (i.e. change the domain to old.reddit.com) to bring up the legacy interface. Loads quick and works fine on mobile if you don't mind zooming.

That said, it's ridiculous that this is necessary.

For a super legacy experience, try i.reddit.com

https://i.reddit.com/

I use my mobile browser to read Reddit threads posted on HN. Not terrible but I don't know in which ways the app is better.

Think it's just the app? Hope you don't have your clipboard events enabled in your browser

Edit for those interested:

tl;dr: "asynchronous clipboard API" [0]

Overtly, it's used by shit news sites like WSJ, nytimes, and bloomberg to inject their shit into your clipboard when you copy-paste. A common thing I've noticed is selecting text, copying the text, and then pasting somewhere and seeing a link to the original article instead.

I'm not sure if they're still doing it; there has been several people complaining about this over time [1] [2] [3] [4] [5] [6]. I found this awesome article on the Security StackExchange from 2013 [8].

Also it's not just javascript. You might be forgiven to think that using a command-line interface would spare you. Unfortunately you'd be wrong; mosh, tmux, vi, emacs all support your terminal emulator's clipboard events. [7] [8]

[0]: https://www.w3.org/TR/clipboard-apis/

[1]: 4 months ago: https://news.ycombinator.com/item?id=22352674

[2]: 4 months ago: https://news.ycombinator.com/item?id=22446940

[3]: 8 months ago: https://news.ycombinator.com/item?id=21377598

[4]: March 2019: https://news.ycombinator.com/item?id=19384895

[5]: December 2017: https://news.ycombinator.com/item?id=16034854

[6]: September 2015: https://news.ycombinator.com/item?id=10301881

[7]: Three months ago: https://news.ycombinator.com/item?id=22815757

[8]: https://security.stackexchange.com/q/39118/47800

Can you explain this a bit for me here?

To read the clipboard, website needs explicit permission to do so, no way to go unnoticed.

Right. Firefox and Safari (iOS and desktop) haven't implemented the Clipboard.read functionality yet either, only Chrome has and it's only available on use action such as a click or keydown (and not available on touch or scroll events).

But they can copy to your clipboard for you, a lot of services use "Click to copy" features. But reading is much harder.

iOS before 14.0 appears to have allowed apps to read clipboard contents without making that clear to users. Now that you get a notification whenever an app reads the clipboard, it has become fairly clear a lot of apps are reading clipboards constantly. For what… we all wonder.

I read something recently that gave the impression browsers didn't allow this and they could only modify the clipboard?

I'm not saying this is true, rather asking if I got the wrong impression.

Thanks for the details. I agree that it’s obnoxious for sites to interfere with copy. But they still can’t read from the clipboard, which is the topic here. And your [8] seems to be about the user deciding to paste unsafe content — totally different issue, isn’t it?

> they still can’t read from the clipboard

Incorrect; the API is here [0].

[0]: https://www.w3.org/TR/clipboard-apis/#dom-clipboard-read

It is at least supposed to be hidden behind a permission. What's the default for that permission though? I sure hope Google^H^H^H^H^H^HMicrosoft^H^H^H^H^H^H^H^H^Hsome evildoer doesn't find a way to override your permission setting. A reset of configuration data after an automatic update might do the trick...

> And your [8] seems to be about the user deciding to paste unsafe content — totally different issue, isn’t it?

Perhaps you are right. I won't claim to fully understand how tty programs work. However:

* `emacs` documentation describes an ability to interact with the user's system clipboard [1].

* `tmux` integrates with the user's system clipboard [2].

* `mosh` apparently caches the user's system clipboard [3].

* `vim` has special registers to represent the user's system clipboard [4] [5].

If the system is using dbus (nearly every Linux based OS), it's pretty easy to do. Here's a python script using GTK to do so [6]. A high level overview of the clipboard is described in the freedesktop specification [7].

I think it's really unfortunate that desktop and CLI software is so insecure.

[1]: https://www.gnu.org/software/emacs/manual/html_node/emacs/Cl...

[2]: https://superuser.com/a/1336764

[3]: https://superuser.com/a/1336764

[4]: https://vi.stackexchange.com/a/96

[5]: https://vim.fandom.com/wiki/Accessing_the_system_clipboard

[6]: https://stackoverflow.com/a/21337063/1111557

[7]: https://specifications.freedesktop.org/clipboards-spec/clipb...

Of course there are APIs for accessing the clipboard. I probably use Vim’s clipboard registers 300 times a day. None of this has anything to do with closed source programs reading the clipboard without permission. Speculating that somehow an app might “override your permission setting” is not really informative. There might be any number of exploits.

> None of this has anything to do with closed source programs reading the clipboard without permission.

This has everything to do with closed source programs reading the clipboard without permission since there are no permissions involved in desktop operating systems.

Oh, OK. But all of your examples are open source programs. And there is a reason I only run open source programs on the desktop (except maybe for a driver or two, I guess, possibly). I'm not afraid that Vim is scraping my clipboard and selling the contents to an advertising firm. Because it’s not.

What I don't understand is why the browsers and OSs aren't preventing this. This is a massive security hole.

An app doesn't need access to the clipboard unless I'm actively pasting to it while it's in focus.

Yeah, but companies are more competent than government and that's what matters

https://news.ycombinator.com/item?id=23716931

right?

Reply on news.ycombinator.com