Hacker News Reader

Comment by oefrha | Hacker News Reader

Relevant commit:

https://chromium.googlesource.com/chromium/src/+/4d7b74b051a...

  commit 4d7b74b051abfe5945f418601fdc2ffc8ce3072c
  Author: Anupam Snigdha <snianu@microsoft.com>
  Date: Tue Jun 07 16:36:28 2022

  [Clipboard API] Remove user gesture requirement for read/writeText.

  Adding user gesture requirement for readText and writeText APIs
  breaks NTP doodle sharing. We are relaxing this check for now, but
  we should fix this for sites to not rely on these APIs to be called
  without a user gesture.
  See NewTabPageDoodleShareDialogFocusTest.All test for more details.

View on HN

Why is the headline about writing to the clipboard when reading FROM the clipboard without permission is much worse?

Clipboard should exist at the OS level and web browsers should be unable to distinguish it from keyboard input.

Because despite what the commit message seems to imply to someone unfamiliar with the Clipboard API, navigator.clipboard.readText triggers the clipboard permission prompt. writeText is different in that there's no permission to grant to begin with, it was only gated behind user interaction, which was lifted.

What is a NTP doodle? Is this related to chrome-search://local-ntp/doodles.js? (I can't see because I don't use chrome)

But chrome-search://local-ntp/doodles.js is served from a chrome-search:// url, chrome could give it permissions without giving for every web page

New tab page google doodle

Imagine introducing a security risk in order to make it easier for people to share some silly cartoon picture. Who's reviewing these decisions?

It looks like a Microsoft engineer accidentally broke some Google code while implementing an unrelated feature. They tried to restore the old behavior but ended up actually breaking the interaction checks altogether.

If you look at the commit comment, it indicates that they understood they were only disabling the checks for the new clipboard feature they were working on, not for all clipboard actions.

but it makes no sense to do this for all webpages and not just for webpages on the chrome-search:// scheme

This is an excellent example of why attributing individual small contributions to your real-life identity online is not a good idea.

Reply on news.ycombinator.com