Hacker News Reader

Comment by walrus01 | Hacker News Reader

I don't think that javascript should be permitted to know what text you've selected as displayed in your browser or that you've copied it to clipboard. Fundamental mismatch in the rights of the end user client device and person operating the browser vs. the httpd.

At least not without going through the same level of explicit permission popup that you would need for microphone or camera access in a modern browser.

What people copy to clipboard on their own client workstation device should be exclusively up to their local control.

Mostly I see this in websites that deploy some mostly-futile "special sauce" code to prevent things like right-click/save-as of images. And similar.

View on HN

The practical problem with this idea is that you would essentially need to remove the ability of JavaScript to track all human input (mouse movement, clicks, etc.) since that could already be used to figure out what they’re selecting. Sure, browsers could try to hide this info with clever rules like not reporting mouse movements while the mouse button is being held and text is being selected, but it would be pretty hard to get right (and would probably break a lot of sites that aren’t doing anything nefarious, like any rich text editor).

If anyone uses Firefox, it is possible to disable websites from knowing about any clipboard-related events. Go to about:config, search for dom.event.clipboardevents.enabled and set it to false. Done.

Sorry to go off topic, but is there documentation for the settings in about:config? And why don't they have a better UI?

It's pretty sad that something as security sensitive as browser settings requires trusting random strangers on the internet or digging through source code to understand what's going on.

There's Mozilla wiki pages for many of the options in about:config. Check this out: http://kb.mozillazine.org/About:config_Entries

If Mozilla made a chrome UI for those settings, they'd be accused of adding bloat to Firefox, creating complex options that confuse users, and making Firefox harder to use than Chrome-based browsers. I've noticed that open source really can't win in that department, so power user settings are put out of sight and out of mind, or are eliminated completely.

> If Mozilla made a chrome UI for those settings, they'd be accused of adding bloat to Firefox, creating complex options that confuse users, and making Firefox harder to use than Chrome-based browsers.

Possibly, but does Mozilla actually care about accusations of bloat or poor usability?

Thank you! That's more documentation than I knew about before.

TBH, the I personally think the UI is fine, but it's annoying to have so many places to look for settings.

Chromium/Chrome have chrome://flags, which is basically the same UI, but all of the options have a few sentences explaining what they do.

I still miss Opera; they were the only browser developer who didn't take the "Users are stupid and easily confused" approach to browser development.

> I still miss Opera; they were the only browser developer who didn't take the "Users are stupid and easily confused" approach to browser development.

Old Opera was amazing, and incredibly fast. For a while there on pre-Android and early Android phones, Opera rendered the fastest out of all the mobile browsers.

Setting it to false causes issues in websites (like WhatsApp Web). You can't paste and send images in chats.

I’m not sure this changes a thing unless you also want a permission popup for tracking when text is even selected. And at that point you’re getting permission to be aware of basic DOM events.

Your web browser is your operating system. It needs to have access to your peripherals and lower-level things like your clipboard and filesystem.

Sure it does, doesn't mean it needs to report back to a website what it's doing with it.

Is your position that Javascript shouldn't be able to see click and drag events?

That would make a lot of browser games, tools (e.g. broswer image editors) and certain browser drag and drop functionality (e.g. a custom video or audio scrub bar) not work. They would require permission popups.

Reply on news.ycombinator.com