Chrome should be spun off into a non-profit that is barred from Google/Alphabet influence.

At a glance and without very much context, it looks to me like this engineer was working on implementing Web Custom formats for the clipboard API [0], but broke the Google doodle sharing while doing so. It appears they were trying to restore old behavior as a temporary measure, but ended up breaking the checks altogether.

Their commit's comment[1] claims that the added variable should only be true if reading/writing a web custom format, but that obviously isn't the case (anymore?).

EDIT: Here is their original commit, which broke the doodle sharing: [2]. It extends the interaction requirement to custom formats, which wasn't true before. Their followup was meant to just undo that part of this commit, but appears to have done much more.

[0] https://chromestatus.com/feature/5649558757441536

[1] https://chromium.googlesource.com/chromium/src/+/4d7b74b051a...

[2] https://chromium.googlesource.com/chromium/src/+/a3b96a459cf...

Not saying it’s worse, but it may not necessarily be due to Google also being an ad giant, but just corporations being corporations and having the wrong priorities.

But then a concurrent solution happened and almost everyone moved to chrome.

The history is sad but true: it's the general indifference to those conflict of interest that led us here...

dictate random policies like that and you will watch American capitalism die.

Dumping a ton of money down the toilet doesn't mean you own the toilet.

Why don't you look to Europe instead?

And even the modern monopolies... Gates and his mom getting him a deal with IBM is a bit different than someone else without a well connected mom.

And looking at tax rates companies like facebook pay, I think corruption is very well alive in USA too.

“As a policy regime, it is described by academics as advocating economic and social interventions to promote social justice within the framework of a liberal-democratic polity and a capitalist-oriented mixed economy.”

Some of the world’s most successful countries are run that way.

It is called social democracy.

Option 1: the definition of "capitalism" requires that zero regulation be applied. In that case, abandon "capitalism" and replace it with whatever you'd call the same model but with regulation.

Option 2: a significant amount of regulation actually is enough alone to fatally destabilize capitalism. I do not believe this to be the case, but if it were, then it should very likely be abandoned, but it's difficult to know how other options might behave in this hypothetical universe.

If that is not the assumption then we can just make arbitrary claims about anything and calculate "drift"

Definitions have an inherently arbitrary component, sure. But stable, precise definitions are far easier to reason with than a shifting definition like "whatever the US is doing right now".

Capitalism requires that the capitalists (who own for a living) are in control of the state, so it has little incentive to stop Google from messing with your system.

The only certain way to stop them is for workers (who work for a living, the majority of us) gain control of state power through a socialist revolution. Those historically are led by communists or similar.

So if you want control over your computer and ultimately life, join us in conspiring to overthrow capitalism.

I choose neither. Is there another alternative?

But it’s worth keeping in mind that the capitalists also control the media, school curriculums, academia (including economics and history), etc. It’s not hard for them to portray all socialist countries as far worse than they are, in order to discourage workers from rising up. And of course it is in the capitalists interest to do so.

I'd be even happier if governments treated small businesses the same as they treat large (mostly by making tax avoidance impossible, and making the large pay the same taxes as the small ones to), but that's practically impossible with the corruption in our governments.

You’re happier in a richer country, as are many of us Eastern Europeans that have been forced to emigrate. We could’ve been even happier in our own countries while having collective control over the means of production, but the (foreign) capitalists made sure that wasn’t possible through propaganda, coups, sanctions and invasions.

I haven't moved, I still live in the same city, the country is the one that doesn't exist anymore.

Only 100m?

It was when he wanted to own Ukraine that it rose to the level of significant intervention by the outside world.

That's one of my explicit goals, so good.

I'm from a former socialist country (both former socialist, and former country, since neither exist anymore).

For a long time, Chrome did not allow pages on the open web to use document.execCommand('copy') or document.execCommand('cut'), and there was a fairly steady stream of requests from web developers to enable this. Eventually, Chrome did expose this gated behind a user gesture: https://chromestatus.com/feature/5223997243392000

> So instead of changing their new tab page to require a gesture like all other sites... they decided to allow any website to copy text into the clipboard. Nice.

Ownership of the clipboard features has moved around a bit, and sometimes historical context around things like the user gesture requirement are lost. Here, the NTP doesn't actually need this to work without a user gesture. The correct fix here is to fix the NTP tests to correctly simulate a user gesture, not to allow writing to the clipboard without a user gesture.

> I think copying into the clipboard needs an overhaul—even with a gesture. Don't you hate when news sites add a "- from XYZ" to your clipboard? That shouldn't be possible. I'm not sure how you'd fix this, but it should be fixed.

This is a difficult problem to fix. There are absolutely websites that abuse this. But there are also pages that do use the legacy clipboard API events in non-abusive ways (e.g. rich text editors), and blocking this outright would break legitimate uses as well.

Maybe something like a "copy as plain text" option would make sense...

  > Maybe something like a "copy as plain text" option would make sense

Hide it in some hidden flag or something, but please, make plain text copying an option!

But all the other styling? The fonts, the colors, stuff like that that isn't in markdown? Nobody wants that.

  #!/bin/bash
  while true ; do xclip -sel primary -o | perl -pe 'chomp if eof' | xclip -sel primary ; sleep 1 ; done

Google is deeply philosophically opposed to doing that. Power users are a distraction from the billions of normal users.

So bloody annoying, thanks Microsoft for continuing to make my life harder than it needs to be.

Currently (until this bug) it’s supposed to trace back the call stack to the event that triggered it, and only allow it if the triggering event is something like a click. That’s what’s meant by “user gesture”, the opposite of code triggering it independently of the user.

“Consent” would be a positive acceptance in a browser controlled message box asking for permission to use the clipboard.

Most people agree that for copying to the clipboard the first is all that’s needed (there isn’t really a security concern here), for pasting from the clipboard the later is always required.

See the other discussion here: https://news.ycombinator.com/item?id=32614839

I would argue the actual vector is in the terminal, it should really validate the clipboard content.

Wow, rude.

One possible answer to your question: there is no way for a browser to detect "consent", which is a subtle and nuanced concept, but user gestures have a hard and fast definition, so that's the proxy they use.

The number of sites that reasonably need to know when I copy/paste or need to override what happens when I do that is approximately zero. There's no reason to allow it by default for all sites.

And then there's the "clever" sites that replace the text I copied with a message like "haha you thought you could copy this? think again sucker".

But then: what's to stop websites from detecting you've selected text, unselecting it, and copying the bad text in, and then reselecting it...

There are so many loopholes I can imagine to get around these restrictions :(

Disabling JavaScript.

Or conversely, make the visible text “pointer-events: none” and it sits in front of the dangerous text.

There are also some sites that popup a small box above your selection with a share box. Straight to hell with those. Compulsive selectors go mad on those sites. That's you, medium.com.

Perhaps you want a RTE that doesn't depend on JS. I think that's a reasonable thing to want; but if you normally browse with JS switched off, then running into a working RTE is at least going to violate the Principle of Least Surprise.

Javascript knows about clicks, doubleclicks, hovers... like almost every interaction the user does. There are use cases but also potential to be exploited somehow.

My uBlock Origin filters stop them with extreme prejudice.

    window.addEventListener('copy', function copyintercept(e) {
      console.log(copyintercept.caller, 'copy action initiated');
      e.stopImmediatePropagation();
    }, true)
    
    document.addEventListener("contextmenu", bringBackDefault, true);
    
    function bringBackDefault(event) { event.returnValue = true;
                                      (typeof event.stopPropagation === 'function') && event.stopPropagation();
                                      (typeof event.cancelBubble === 'function') && event.cancelBubble();
                                     }

Couple of things

1. How do you focus a text field without a keyboard? Mouse or touch only? No TAB, no up/down keys for scrolling, no escape, etc.

2. You can disable all non text content in a web page. This was always possible

I can go on and on but what's the point?

I opened a bug with chromium when I first encountered that behavior ~10 years ago since it was an obvious security and privacy concern to me. Needless to say, the chromium devs didn't think it's an issue.

You would think browsers would ask permission for sites to do things like modify your clipboard, see when you copy/paste, track your mouse movements and text selections, etc. but google obviously isn't going to care about protecting the user from such things.

(On my computer I usually disable the scripts so that it will not do such a things, but even if scripts are enabled, you might want to configure that feature too.)

    dom.event.clipboardevents.enabled

There are browser extensions. For example, my own StopTheMadness on macOS and iOS:

https://underpassapp.com/StopTheMadness/

I'm going to work on this navigator.clipboard issue, because I find it unsettling, and I use Chrome quite a bit.

Will they? Hah.