Hacker News Reader

Comment by zebracanevra | Hacker News Reader

I feel like if you've selected some text, then pressing copy should always copy that text and nothing else.

But then: what's to stop websites from detecting you've selected text, unselecting it, and copying the bad text in, and then reselecting it...

There are so many loopholes I can imagine to get around these restrictions :(

View on HN

> what's to stop websites from detecting you've selected text, unselecting it, and copying the bad text in, and then reselecting it

Disabling JavaScript.

it'd be trivial to trick users to copy the wrong text with only CSS.

Wait, how?

Make a layer that isn’t visible with “opacity: 0” that sits in front of the visible text. A user copies the invisible text instead.

Or conversely, make the visible text “pointer-events: none” and it sits in front of the dangerous text.

Both of those make sense.

If you just want to add text in, it is even easier, no JS required. just CSS: insert an element into your text that is positioned off-screen. When the user selects and copies, they'll get that text too.

Why are websites allowed to know that you've selected plain text? (genuinely clueless on web stuff)

I think there are a bunch of decent uses for that, like rich text editors (eg select text, hit ctrl-b, and the text is bolded).

There are also some sites that popup a small box above your selection with a share box. Straight to hell with those. Compulsive selectors go mad on those sites. That's you, medium.com.

But why does a rich text editor need to talk to a website?

What if the rich text editor and the website are the same thing? What if the rich text editor is part of a larger tool that is the website?

Well, I'm not sure what you're waving at. If the website is nothing more than a RTE, then it's better (and safer) to do it in the browser. If the RTE is just part of the website, then that's a part that's better done in the browser.

Perhaps you want a RTE that doesn't depend on JS. I think that's a reasonable thing to want; but if you normally browse with JS switched off, then running into a working RTE is at least going to violate the Principle of Least Surprise.

Why are websites allowed to know that I hover an element?

Javascript knows about clicks, doubleclicks, hovers... like almost every interaction the user does. There are use cases but also potential to be exploited somehow.

Because websites are apps now. The browser is your operating system.

Click events, hover, etc have always existed (since js exists I'm pretty sure).

Regardless of intent, today websites are often built as 'apps', making browsers more and more like your OS. JS is how that's usually implemented.

In forums you can select parts of someone's post and quote that part in your reply

Humor me as someone without much web development experience - but what's to stop websites from displaying unclosable ads/popups? As in the "x" does nothing, or maybe doesn't appear at all?

It happens, but then people tend to not visit the site.

Both Pinterest and Quora have unclosable popups, as do many news websites.

There is a reason many articles and extensions exist to avoid those sites in search results.

> what's to stop websites from displaying unclosable ads/popups?

My uBlock Origin filters stop them with extreme prejudice.

Enjoy them while you can, less than one year left.

userscript injecting this everywhere:

    window.addEventListener('copy', function copyintercept(e) {
      console.log(copyintercept.caller, 'copy action initiated');
      e.stopImmediatePropagation();
    }, true)
    
    document.addEventListener("contextmenu", bringBackDefault, true);
    
    function bringBackDefault(event) { event.returnValue = true;
                                      (typeof event.stopPropagation === 'function') && event.stopPropagation();
                                      (typeof event.cancelBubble === 'function') && event.cancelBubble();
                                     }

A news website must not know that i selected text. A webpage shall display text. Keyboard input shall not be allowed except in text fields.

I guess you must be really pissed off at something because you're not making any sense.

Couple of things

1. How do you focus a text field without a keyboard? Mouse or touch only? No TAB, no up/down keys for scrolling, no escape, etc.

2. You can disable all non text content in a web page. This was always possible

I can go on and on but what's the point?

Reply on news.ycombinator.com