It's weird how some of the same people who use middle-click-to-paste also use password managers (which are a good thing).

If that's you, then you're quite daring when you're using collaborative apps (that have history!)

I agree with everyone who says middle-click-to-paste really should be off by default.

It's actively harmful and can easily paste sensitive information and surprising clipboard contents.

(Anyone who likes it is advanced enough to figure out how how to turn it back on.)

This was actually talked about a few years back too, but we were in a pre-Wayland-is-ready world and *everyone* was still on Xorg back then.

I'm happy that it seems that it might be toggled off (at least in some places) by default soon.

It's such a harmful *default* setting to have it on, especially when so many collaborative apps use middle click to drag around documents.

@garrett

Wait, but password managera shouldn't use _that_ clipboard (PRIMARY). What's the thing you're worried about?

@mattdm It's not just password managers though; that's just one example. And who knows how all password managers are handled?

You can reveal the password to make sure it's the correct one (such as if you have multiple accounts), then select it, and then it's using that clipboard, isn't it?

But even selecting some text elsewhere (in a conversation, on a website, etc.) might not be for any random audience.

Clipboards do contain sensitive stuff sometimes, passwords or not.

@garrett @mattdm On Wayland+GTK if I select text in App1 I wouldn't expect that anything in App2 could read that text from the clipboard unless I hit middle-click to paste it.

If that assumption is wrong, then I'd assume that's an isolation or design bug somewhere. Or perhaps I'm missing something?

@purpleidea @mattdm Middle click means much more than paste.

It's also how you pan around in many apps, including web apps like Penpot, Miro, Figma, etc. So you can unintentionally paste something (which could even be sensitive) when panning.

(Also some native apps like Inkscape too, but you don't need to worry about history and leaking things to coworkers quite as much.)

(Middle click is also used for new tabs and closing tabs, but there isn't a paste risk there.)

@garrett @mattdm I think hardcore security conscious people can disable it if they care.

I think the default should be on so that we can show newbies how magic and better we are. There's a bad trend to try and copy windows and mac. Let's innovate more instead and polish like crazy.

Am I right or wrong about when the data is shared with the app or did I get that wrong?

@purpleidea @garrett There is no "cancerous trend". No one is gonna fucking die from it.

As someone who has been using middle-button paste since 1993, I can tell you that I welcome its removal. On my desktop machine I often get confused which is what and paste the wrong thing. On the laptop I wouldn't even know how to do it.

@purpleidea @garrett @mattdm

> I think the default should be on so that we can show newbies how magic and better we are.

How often does that happen and how many people have you convinced to switch to Linux with this "magic"? If this is something that actually happens, it's not hard to enable it. Most people do not need this. I've been using it for 25 years and even I do not think I need it. I get confused often and paste things from the wrong buffer, wasting my time.

@zeenix @purpleidea @mattdm It's even worse when you accidentally paste something into a shared space that has version history, so it's always there. You might also not even notice.

And it could be sensitive (password, some previously selected text from a private conversation, some secret or WIP document that isn't ready to be shared yet, possibly something that needs more context, etc.) or just a random surprise (which could still cause embarrassment).

It's a bad default to have it on.

@purpleidea @garrett @mattdm I had middle click paste disabled by default when I started using Linux. I don't think many would care too.
@garrett @purpleidea @mattdm yep, happened to me all the time before I disabled it in firefox