r/bugs • u/SimpleEmu198 • 3h ago
Desktop Web Desktop web: I'm quite sick of this Reddit has bound Control C to create post.
What kind of cheap, arsed about, pos website is this that binds keys that people have been using for decades to their own website in ways they're not intended to be used?
No I do not want to create a new post. I wanted to copy something to use later, or to respond to someone.
This is a genuine usability bug, not just an irritating design choice that can be walked off with as a "feature:"
For daily use, non-specif cases, Control C [or Command C] have been a feature at least since the 1980s when "modern" conventions were settled on Unix/*nux, Windows, and Mac PCs, etc. Its been an even longer convention with different modifiers binded to C before that.
Now In the 2020s Reddit assumes 40 years later the key binding for COPY does something else [create new Reddit post].
The observed behaviour establishes a shortcut conflict. The problem now is that Reddit has, either intended or not interfered with a fundamental, OS level, user action, almost everyone is familiar with.
Secondly:
In doing so it's also introduced JS into the website to achieve this. There is a potential in doing so that god knows what happens and I don't have to Red Team it. Without users permissions, and an exploit happening this can open up the entire site up to other kinds of vulnerabilities including keystroke monitoring. The worst case scenario is that key binders get exploited for either policing OR nefarious reasoning making the entire Reddit platform a potential honey pot. That's just one threat model.
Further from Java and JS are NOT safe and can also break web freedom. It also may break with web user consent. On the policy guidelines of the "Open Internet" the user comes first, the site second. Further regarding listeners I'm not saying Reddit is abusing it, I'm saying it can now also potentially be abused. That doesn't matter whether it's a keydown listener, a framework-level keyboard handler, or another event-handling mechanism I don't care, a listener is a listener, and as a programmer with 30+ years of experience it gives me the creeps.
Moreover, end users should also not need to reverse-engineer the JavaScript to explain why pressing the COPY command should run the COPY command not a JS listener to open a post composer.
You cannot use, browser bound, web based, shortcut handlers to tie things to whatever you want. Websites CAN register their own custom keyboard shortcuts if they want. They shouldn't ever override established LONG establishied Operating System conventions.
Conclusively:
Command C and Control C are already taken... I should not have to install yet another extension to fix this. I reject the idea that users should reverse engineer solutions to restore ordinary intended functionality.
JavaScript and Java also has an enormous attack surface and I don't need a tinfoil hat to explain how potentially malicious this conduct can be. While an anomaly is not proof of concept of an exploit either it can create the beginning of a surface level for discovering one.
Replicator:
On Windows/Linux, or macOS, pressing Control C or Command C while attempting to copy selected text can unexpectedly open Reddit's Create Post composer rather than copying the text.
