Hacker News Reader

What is a NTP doodle? Is this related to chrome-search://local-ntp/doodles.js? (I can't see because I don't use chrome)

But chrome-search://local-ntp/doodles.js is served from a chrome-search:// url, chrome could give it permissions without giving for every web page

View on HN

New tab page google doodle

Imagine introducing a security risk in order to make it easier for people to share some silly cartoon picture. Who's reviewing these decisions?

It looks like a Microsoft engineer accidentally broke some Google code while implementing an unrelated feature. They tried to restore the old behavior but ended up actually breaking the interaction checks altogether.

If you look at the commit comment, it indicates that they understood they were only disabling the checks for the new clipboard feature they were working on, not for all clipboard actions.

but it makes no sense to do this for all webpages and not just for webpages on the chrome-search:// scheme

Reply on news.ycombinator.com