Hacker News Reader

Comment by smichel17 | Hacker News Reader

There's no problem if I manually copy some text from a box in one app and paste it into another app, and I don't want a permission prompt for that. It's programmatic access that I care about (apps snooping clipboard content).

Technically they could probably be implemented the same way and the "manual" action is actually just granting the programmatic permission to the keyboard app.

View on HN

The copy and paste button in all apps is programmatic. Windows can't tell the difference, for example, if a user copied from edit > copy or if the website did it itself.

It could work if windows had a copy paste api with levels of access and trusted the apps to honor the access level. Then the browser could tell windows if a user clicked paste or if a website did.

I argue that the clipboard shouldn’t be given any extra levels of trust because it’s current level of trust, very low, is the correct amount.

Precisely! It's the rough equivalent of a tempfile in your home directory, I don't know why even developers have come to view it like it's some super secure and private kernel component.

That's all well and good, unless you're an attorney, author, document writer, research scientist, or literally anybody who types a lot...

At jobs I've literally copy PHI all over the place for data processing.

Copy and paste is vital and often top secret.

It’s a bad shaped tool for that problem. It’s a shared resource. There is a gaping hazard where any other piece of software can change the data you want to read before you can read it. Use a database.

If it were that simple there wouldn't be employees.

I don’t mean look up a database. I mean make a database. Write a program that skims the document, parses what’s needed, and places it into a locally running database. Then, in another program, read the values you need. The clipboard is simply the wrong tool here. A database is bog standard.

How do you write documents?

What other tool provides same order of magnitude convenience for moving data verbatim between contexts? "Share" on mobile covers some use cases, but even then, you can't open a discrete password manager app and share your password directly to the password field in your browser.

Windows on the desktop is a completely different can of worms. For example, I installed a small application last week to take screenshots of my entire screen every so many seconds and it was then that I realized the whole installation process (there is no installation process, just a simple executable with a config file in the same directory) and execution required zero root privilege.

Technically, any application (at least any application that lives in the system tray) can take screenshots of the whole screen as often as it likes. You can probably imagine it doesn't even need to store it on disk. It could just do some quick computation and send it to whoever.

Reply on news.ycombinator.com