Hacker News Reader

Comment by yewenjie | Hacker News Reader

I just realized I need this for myself and quickly cooked up a solution using tridactyl, ddgr, and jq that fits perfectly in my workflow. Everything is reduced to just typing `:cp <SEARCH QUERY>` without moving to a new tab or losing flow.

The entire function is basically this (requires Tridactyl native messenger).

  command cp js -p tri.native.run('cd ~ && ddgr --json -n 1 ' +JS_ARG + '| jq -r ".[0].url" | xclip -sel clip')

[1] https://github.com/tridactyl/tridactyl

[2] https://github.com/jarun/ddgr

[3] https://stedolan.github.io/jq/

PS: I used this tool itself to find the links for the three projects mentioned above.

View on HN

This kind of thing makes me uneasy, and is an example of why I don't enjoy the web platform for applications.

In this case, we have Firefox, which has built-in integration for DDG, as well as lots and lots of capability for querying and processing JSON. And on top of that, we are adding a command that drops to the command line to make a series of command calls to different programs for sending and extracting a search query. All to return 1 URL. It's nuts.

This topic could be a 20-page thesis.

I'm sure it can be made simpler, I just wanted to create a quick hack with the tools I'm already familiar with.

Is this dangerous if the link is able to inject Bash commands as the value of JS_ARG? If so, that's RCE and that's bad.

Is it possible to do this using the HTML5 clipboard functions instead?

Maybe, but I'm pretty sure browsers block the clipboard functions unless they were triggered via user input. I don't know if a page load counts as a valid trigger.

`document.execCommand("copy")` works without user input - https://developer.mozilla.org/en-US/docs/Web/API/Document/ex....

Nope.

> Conditions of having this behavior enabled vary from one browser to another, and have evolved over time.

If you're not running based on a click event, you'll certainly fail.

Perhaps extension code gets different rules. This code works in Firefox without needing interaction from the user: https://github.com/tridactyl/tridactyl/blob/5e8f94ff06bd5f14...

Extensions get different rules.

JS_ARG here is coming from the user - `:cp [search term]` would be typed interactively into our iframe which pages don't have access to.

Tridactyl provides a `:shellescape` function for sanitising untrusted input but I don't think it is needed in this case.

Didn't know about Tridactyl, thanks! This is a really cool extension!

It's the best Vim emulation addon I've seen so far, and God knows I used almost all of them.

Hey. I have long been wanted to know from someone who has used both Tridactyl and Surfingkeys. On the surface level it seems like they have a larger set of features, but maybe almost all of those can be done in Tridactyl as well. Can you please tell me how these two compare?

https://github.com/brookhong/Surfingkeys

Surfingkeys is great, but the real killer feature of Tridactyl for me is the hint mode, more details here https://news.ycombinator.com/item?id=24637041

Reply on news.ycombinator.com