RE: [clipboard] Semi-Trusted Events Alternative

> -----Original Message-----
> From: Perry Smith [mailto:pedzsan@gmail.com]
> 
> As a side note: I would change "isTrusted" to "fromUserAgent" to make it
> more honest.  Folks are somewhat foolish to trust their browsers and all the
> plugins.  e.g. people unwittingly trust flash.  I would remove "trust" from the
> names of things.
> 
> "semi-trusted" seems worse to me.  Reminds me of slightly-pregnant.  Its
> either one or the other.
> 
> It appears to me that isTrusted and semi-trusted are really trying to say "the
> user has not been fooled".  Which brings me back to my original question.
> What, precisely, are we afraid the user has been fooled into doing?
> 
> Thank you for your time,
> Perry

I agree with this. 'Semi-trusted' seems like a misnomer.

We need a way to understand that a user intended to copy/cut/paste for the given site. The argument that there is precedent here doesn't really seem to hold. Plugins have historically been a source of security issues, so saying that plugins allow this behavior doesn't really help. I still think we should try to figure out a model where the user knows what they're doing (like input type=file). Authors use that object because it's the way to get to files. If an 'input type=clipboard' were the way to get to the clipboard, wouldn't authors use it? Surely we can come up with ways to style it to match website design without losing the clear intention of giving clipboard access.

Received on Wednesday, 30 July 2014 18:17:13 UTC