Tynt Insight Is Watching You Cut and Paste

jerryasher writes "In recent weeks I've noticed that when I copy and paste text from Wired and other websites, the pasted text has had the URL of the original website appended to it. Cool, and utterly annoying, and how do I make that stop? Tynt Insight is a piece of Javascript that sends what you copy to Tynt's webservers and adds the backlinks. Tynt calls that a service for the site owner, many people call that a privacy invasion. Worse, there are some reports that it sends not just what you copy, but everything you select. And Tynt provides no opt outs. Not cookie-based, not IP-based, but stop-it-you-creeps-angry-phone-call-based. It ain't a pure useful service, and it ain't a pure privacy invasion. But I sure wish they'd go away or have had the decency never to start up in the first place. I block it on Firefox with Ghostery."

Comments

use noscript!

[Anonymous Coward]

Only run the javascript you want.

Re:use noscript!

[Kral_Blbec]

It seems to me the advantage of ghostery over noscript is that (as I understand it) it has a database to identify what the javascript and urls are. I use noscript occasionally, never used ghostery though so idk

Re:use noscript!

[melikamp]

I have to second this. NoScript is now my favorite extension, with ABP being a close second.

Re:use noscript!

[Montezumaa]

I read their website, and it looks like they offer a program for users to install. Is this what the article is referring to, or are webmaster running a script to allow Tynt Insight to track what I copy and paste, irrespective of whether or not I install Tynt's program? If it is the former, then do not install the damned program. This is just like the whole social-networking sites and people bitching about privacy.

If it is the latter, then install No-Script(which everyone should have) and block the shit out of Tyrant....err, Tynt. I have No-Script running because I was tired of Google tracking my every move, along with the other tracking site.

Re:use noscript!

[Itninja]

I am also a NoScript fan. I love it's use of the 'whitelist' security model. Instead of making me tell it everything I want to block, it blocks it all by default and I tell it what I want to see. I wish all security products used this model.

Re:use noscript!

[Anonymous Coward]

Not cookie based, not IP based, but stop it you creeps angry phone call based.

You are not know English?

Re:use noscript!

[Anonymous Coward]

NoScript users are going to be a minority of internet users, but you have to be INSANE to browse without it.
I whitelist base 2nd level domains, but noscript really highlights the amount of CRAP that many sites use, like fuck-up-you-shit-apis.com

A page rarely appears, or functions differently with all 3rd party scripts blocked. It also might be blocking some advertising, but I can't tell if Adblock got there first.

Re:use noscript!

[Ethanol-fueled]

"Stop it, you creeps," angry phone call-based.

But yeah, the editors and most of the submitters not knowed the English.

Re:use noscript!

[Anonymous Coward]

Maybe I'm doin' it wrong, but NoScript broke an awful lot of the web when I was running it using default settings. AdBlockPlus, on the other hand has a 0% false positive rate for me.

If you want widespread adoption, I think the ABP route is the one to go for, even at the expense of letting some new/unknown scripts through.

Re:use noscript!

[NeoSkandranon]

I found that when i was using noscript firefox's responsiveness plummeted and it often ballooned up to 600+ mb of space when tabs having javascript going (say, MSDN, gmail or slashdot) were left open. Disabling noscript immediately solved the issue.

I'd love to go back to using it, but such behavior really isn't acceptable to me. Any ideas how to streamline it a bit? (OP or anyone else reading)

Re:use noscript!

[dannydawg5]

I've noticed that RequestPolicy...
https://addons.mozilla.org/en-US/firefox/addon/9727/

requires much less management. NoScript constantly updates and constantly requires white-listing sites to be able to use them. RequestPolicy defaults to denying just the off-site JavaScript, which is the JavaScript I care the most to deny.

Re:use noscript!

[c0d3g33k]

I actually have both installed, and haven't noticed any adverse effects or conflicts. NoScript handles the "selectively allow this", while Ghostery tells me about web bugs and such, and lets me identify the JS and urls, as you point out. Ghostery seems to stay out of the way quite nicely, while NoScript does the heavy lifting.

Re:use noscript!

[Hurricane78]

There’s a giant problem with this:
- You are not going to inspect every JavaScript you want to allow.
- Which means that you only might know what it does, when you enabled it.
Which makes the whole exercise kind of pointless.

An example is a MySpace or YouTube XSS script. Those sites are not usable without JS. So you enable it. But they are also the sites that are targeted the most. And that’s the problem.

Does NoScript have a automatically updated white-list? And if yes, who decides what gets in there?

All in all, it sounds very much like a half-assed illusion of a solution. Unfortunately. :/

Re:use noscript!

[Anonymous Coward]

Just FYI: A similar effect can be achieved without Javascript. No, I won't tell how, but if you really want to know, you'll figure it out.

Re:use noscript!

[izomiac]

As a poster above mentioned, allowing 2nd level domains is a good trade off between security and convenience. Before I used NoScript I blocked external scripts using a proxy filter for years, and it's only been in the past couple that I've bothered whitelisting anything. Basically, a few APIs (e.g. Google's) and some oddly configured sites that use multiple 1st level domains are about it. Other than those, it is quite rare for a script from an external host to be something that is beneficial for the user. Usually they're ads, stat counters, or something flashy and annoying. This will get you into trouble with some shopping sites though, like Pizza Hut's where I wasn't sure if my order was placed or not, and didn't want to refresh and possible order another pizza. So I whitelisted "https://*", and that seems to work well.

Re:use noscript!

[Anonymous Coward]

These two extensions should be added to a default install. Or maybe there is a way to install these extensions to all users. (Both in Linux and in Windows)

Re:use noscript!

[paiute]

"Stop it, you creeps," angry phone call-based.

But yeah, the editors and most of the submitters not knowed the English.

"Stop it you!" creeps angry phone. (call-based)

Re:use noscript!

[virtualXTC]

Comparing the false positive rate of ABP to noScipt is about as useful as comparing apples and oranges. ABP is a blacklist based service, Noscript is a whitelist. Therfore ABP only has false negatives (including all of the things you need noscript for). No-script therefore has only false positives. Unfortunately, un-like ABP, a user curated list isn't practical; as soon as you do and whitelist a paticular script, someone will change it to do something malicious.

....the fact that some users are too dumb to figure out how to use no-script makes me like it that much more.

Re:use noscript!

[Joce640k]

NoScript uses whitelisting so you have to click "allow scripts" whenever a website breaks. Permissions can be temporary or permanent.

Re:use noscript!

[ahabswhale]

NoScript is whitelist oriented. You have to explicitly tell it what sites are ok to run javascript. If you don't do that, you're opening yourself up to a world of hurt (especially if you ever browse porn). Once a site is whitelisted, you shouldn't have any problems with it at all.

Re:use noscript!

[BusDriver]

When did you last use it? I haven't seen any problems such as this while I've been using it.

Do you have a lot of other addons installed, maybe there's a conflict going on.

Re:use noscript!

[c0d3g33k]

No-script therefore has only false positives. Unfortunately, un-like ABP, a user curated list isn't practical; as soon as you do and whitelist a paticular script, someone will change it to do something malicious.

What he said. It took awhile to teach my family to change their default behavior to "temporarily allow" for NoScript, since it is a bit annoying, but they understand why and it gives me a bit more peace of mind. Only the sites we use regularly or have decided to trust get whitelisted permanently.

Re:use noscript!

[PopeRatzo]

So I whitelisted "https://*"

Thank you for that tip, friend.

Re:use noscript!

[c0d3g33k]

No, NoScript doesn't have an automatically updated whitelist - it's entirely the responsibility of the user. And that's a good thing in my view. Nothing is whitelisted by default, and the whitelist isn't automatically updated without the users explicit involvement.

The key advantage of NoScript if you can stand it is that the permissions can be granted temporarily. Do what you need to do and revoke permissions and exposure to the risks you mention are minimized at least.

Also, NoScripts user interface is easy enough to use that it isn't a big pain to selectively allow (temporarily) scripts until the site works. Once finished, rolling back permissions is pretty easy (Right click plus a mouse click).

Re:use noscript!

[Anonymous Coward]

When you do that, you look like a fool with your pants on the ground.

Re:use noscript!

[Maxo-Texas]

I've used noscript for a long time-- recently found Web of Trust (WOT) is equally awesome.

Re:use noscript!

[Anonymous Coward]

comparing apples and oranges.

You said the magic words!

Gentlemen, I repost Apples and Oranges: A Comparison

Re:use noscript!

[tuxgeek]

NoScript users are going to be a minority of internet users

I don't see how Firefox users implementing NoScript can be considered a minority
FF users with any brains have NoScript & AB installed
Additionally, FF is a very popular browser and gaining market share daily

Re:use noscript!

[NeoSkandranon]

Over the summer I believe was when I disabled it. My standard load of addons are: Noscript, Addblock Plus, Tree Style Tabs, and FireGestures.

If there's one thing I've learned about firefox, it' that any memory issues it exhibits are highly website specific; it could just be the sites I'm going to interacting strange.y

Re:use noscript!

[Maxo-Texas]

I use noscript with default settings, portable 3.0, portable 3.5, regular 3.0, regular 3.5.

I do not have these issues under Windows XP, Vista, or Windows 7.

Right now I'm at 74k.
Opened Gmail and I went to 107k.
Opened Yahool and went to 114k.

One thing I did find was that my flash drive performance issues with portable was because of the history setting. Apparently with history set on, it builds a huge sqlite database and it updates it constantly.

On my current machine I have adblock, flashblock, noscript.
On my home machine, I also have WOT and a couple other addons.

There was one addon that added little 4 section postage stamps around the page overlinks and interesting words and it killed my performance.

Re:use noscript!

[JWSmythe]

    It's gone downhill since they outsourced the editor responsibilities to the cheapest bidder in India. This is what we get for 2 Indian Rupee's a week. I'm fairly pleased most of the words even show up. :)

    The way the US economy is going, I may as well start heading that way. Anyone know a cheap way to get to India from the US? 2 Rupee's is more than the $0 a lot of us are making. Yea! Outsourcing!

   

Re:use noscript!

[Anonymous Coward]

NoScript only works based on the source domain of the Javascript. There is nothing preventing someone from either hosting the tynt.com code on their own site or even embedding it within their HTML page. In other words, sending the tynt.com code from a whitelisted domain.

Re:use noscript!

[melikamp]

but noscript really highlights the amount of CRAP that many sites use

OMG, yes. I have temp allow button on my toolbar and I click it for fun sometimes. On wired.com, 29 scripts are blocked, and the site seems to work fine. Inside an article, 47 scripts are blocked, but I can still read the article, probably because the bulk of Wired content is plain text with pictures, which is being handled (very well) by a super-tech known as plain HTML.

Seriously? They want my poor rig to plow through 47 scripts, while all I get, as a Web reader, are 6 paragraphs of text and a stupid photo?

Re:use noscript!

[dzfoo]

Last time I used it (it's been a few months), it still whitelisted some crappy sites by default, including Google and such. This could have changed over the months, as it seems to be updated every other week.

        -dZ.

Re:use noscript!

[epine]

I'll take my solutions in half measure, thank you very much. A half-measure here, a half-measure there, pretty soon I'm better off than the chump beside me.

The absolute win with NoScript is that no scripts run on a site you didn't mean to visit. Maybe the mouse slipped, or you clicked something dubious in a late night haze, or a google search result looked good in précis but you land with a giant OMG! thump. With NoScript you can bail, and you still know where you've been.

Most sites work with just scripts from the base URL. I'm on a lot of sites with half a dozen or more scripts blocked, and it works fine.

For places that look a bit dubious, I use temporary mode.

I'm sure there's some monkey business going on with the base scripts I'm permitting on many sites, but a lot less than shacking a rugby team in a convent. I say it's a pretty good first measure if they have to sneak across the quad.

All in all, it sounds very much like a half-assed illusion of a solution.

Quoting the forefathers of gender-segregation are we?

Re:use noscript!

[Derek Pomery]

NoScript can be configured as a blacklist. Just enable "Allow Scripts Globally" and it will permit any site that hasn't been explicitly blocked in the blacklist.

Re:use noscript!

[HTH NE1]

I use NoScript, but one of the things I still don't like about it is when I temporarily allow it to run scripts for one tab, it enables it for all my tabs that have scripts hosted at that location, not just allow scripts in the current tab. So if I were to enable Google Analytics, Google would get a big ping identifying me as being on all those sites at once.

Re:use noscript!

[pixelpusher220]

You're not doing it wrong. You could argue that the websites that 'broke' are doing it wrong though with quite a few caveats.

The point of NoScript is to stop scripts from executing automatically the first time. After that you can enable them individually or for the full page as you need them, as well as permanently enable them so your next visit isn't 'broken'.

If a site is hosting the scripts it is running I generally allow them, but if it's hosting 'displaylotsofads.js' from some ad site it doesn't get to run.

Re:use noscript!

[CodeBuster]

The NoScript addon also features regular expression filtering of urls to catch common xss attempts and block them. These filters can also be applied to sites that are otherwise allowed via the whitelist. I agree that one has to be knowledgeable to use NoScript, but it really does have a lot of features for knowledgeable users and it is almost certainly better than nothing for any user who is not a complete novice. From the wiki article:

"However NoScript supports also an optional blacklist mode: users can choose to enable scripts globally and disable them on selected sites which they do not trust. Even in this configuration, NoScript keeps providing a significant security enhancement because anti-XSS, anti-CSRF and anti-Clickjacking features remain active."

Re:use noscript!

[MortyKnox]

Open your noscript options, under the general tab uncheck the box next to "Automatically reload affected pages when permissions change"
Hope that helps.
MortyKnox

Re:use noscript!

[Anonymous Coward]

Interesting. My long standing problem with FF (with NS and ABP) seems to be that it'll crash after some several hours or days of use under typically heavy load. Heavy typically being for instance something like 100 windows and 500 tabs open for days on end. Yes, FF ends up using a lot of memory, but I've got 8GB RAM and swap on top of that, and it USUALLY doesn't seem to be using memory without bounds or memory leaking badly, so I think it is just trying to make use of what is 'available' and usually stops around the point where it has most of the free memory but isn't pathologically swapping or whatever. But the bad thing under Windows Vista, Windows 7, and Linux is that it'll just CRASH for no apparent reason, and reloading 500-600 pages isn't much fun even on DSL. I can't believe it is this unstable. I hope it isn't noscript's fault since it is an essential add on for security and sanity for me.

Re:use noscript!

[Anonymous Coward]

This is what we get for 2 Indian Rupee's a week.
...
2 Rupee's is more than the $0 a lot of us are making.

Perhaps you should learn how to use apostrophes before complaining about the editing.

Re:use noscript!

[JWSmythe]

    I never claimed I was editing for the front page, and they aren't paying me for it.

    But' If' It' Would' Make' You' Happy' Gramma' Nazzi', Here's Some' Apostrophes' For' You'.

    I know. I know. Don't feel the trolls.

Re:use noscript!

[Anonymous Coward]

this site is so effing gay sometimes. i really dont give a shit if someone sees the text i select. you people are too paranoid.

Re:use noscript!

[Rophuine]

Firefox... Web Developer... Edit HTML. Insert nasty message into page. Select, Copy. I assume they're reading the copy operations on their own site: after all, they're keen for web masters to realize how useful it is, so they must believe it, right?

DIAF delivered.

Slashdot, start your browsers!

Re:use noscript!

[fm6]

I have a big problem with noscript. It assumes that all scripts are evil, and makes you go through a big routine every time you want to give one permission to run. That makes a lot of sites painful to use. Unless you're a lot more paranoid than I am, it's just not worth it.

Re:use noscript!

[JohnFen]

What big routine? I just click on the placeholder that appears on the page. It's not a big deal.

Re:use noscript!

[Anonymous Coward]

Wow, I just re-read RMS's "The Right to Read." It's really not that far fetched that 1st: debuggers become a common tool for ordinary users to "skip over" parts of programs like this, there purportedly to "protect" copyrights, and 2nd: some asshat judge decides that's their primary use and outlaws them except for licensed and bonded programmers. http://www.gnu.org/philosophy/right-to-read.html

(captcha is ensnare!)

Re:use noscript!

[fm6]

Never mind. My knowledge of noscript was dated. It used to be a lot more obnoxious than it is now. The version I just installed is actually usable, once you've turned off the more paranoid features.

Re:use noscript!

[nospam007]

I use noscript occasionally, never used ghostery ...

It's really cool, you'd be amazed how much crap some sites use, you're thrilled every time it blocked more than a dozen attempts or so.

Re:use noscript!

[mahesh69a]

NoScript rocks - some of my friends are too lazy to use it (you know one click for temporarily allow or allow permanently) and then complain of all the scripts - I feel like hitting them with a key board or something :-) NoScript + AdBlockPlus + WebOfTrust (WOT) gives one of the safest browsing experiences.

Re:use noscript!

[Anonymous Coward]

NoScript has an option to forbid web bugs (its under "Advanced > Untrusted"), which isn't enabled by default. I think I'll try Ghostery to see if it picks up on anything that NoScript doesn't block.

Re:use noscript!

[fm6]

I take back my previous post. Just disabled noscript. It was breaking several sites I use that rely on dynamic HTML. (Including Slashdot, though the lost functionality was minor.) Simply could not find a set of options that would work.

Noscript is less obnoxious than it used to be, but it is still is more trouble than it's worth.

Re:use noscript!

[JohnFen]

Hmm, I use noscript and have no problem at all with Slashdot. Configuring it was easy as pie for me. I guess YMMV.

Re:use noscript!

[fm6]

The only thing it breaks is that little app on the main page that lets you access and manipulate your message queue. Hard to understand why. All my current issues with noscript have to do with this type of dynamic content, and they happen even if I grant full permission for the site.

Re:use noscript!

[Uzuri]

RequestPolicy is incredible. I still run NoScript and ABP on top of it (one mostly so I can test my own code w/ and w/o scripting and the other so that I can block peoples' annoying self-hosted avatars on some forums that I visit), but I'm finding myself doing very, very little allow/deny type things anymore now that I found RP.

Re:use noscript!

[Uzuri]

Slashdot pulls code from another site (fsdn.com, I think). Amazon, Facebook, a number of other biggies do the same sort of thing, owning multiple domains and storing different things in each. They should all be listed in the little medallion and be a choice to allow.

I'll admit, it can be a royal pain to figure out just what you need and what you don't at some places. I kinda figure that if I'm thrown a list of 20 sites and can't tell right off which ones I want, I probably shouldn't be trusting the main site I'm at anyway -- but to each his own, certainly!

Thought JavaScript clipboard was opt in?

[tjstork]

I thought that to allow JavaScript to access the clipboard, you had to opt in, and even then, you can't really do it the right way under FireFox or Chrome. Like, JavaScript clipboard access is an IE only thing.

  Are we sure this isn't a Java application or something?

Re:Thought JavaScript clipboard was opt in?

[Anonymous Coward]

This can be done by overloading the Ctrl+c keypress event, etc.

Re:Thought JavaScript clipboard was opt in?

[FlyingBishop]

It's plain JS. It doesn't actually access the clipboard. It just tells what you're highlighting through mouse interaction.

In any case, I blacklist *.tynt.com in hosts.

Re:Thought JavaScript clipboard was opt in?

[tjstork]

This can be done by overloading the Ctrl+c keypress event, etc.

Then from there, you can get the selection...

I got you.

Re:Thought JavaScript clipboard was opt in?

[rhsanborn]

Is anyone else half-tempted to write a script to post back random text from Pride and Prejudice, or something to that effect?

Re:Thought JavaScript clipboard was opt in?

[Anonymous Coward]

Or an ASCII art version of goatse.

Re:Thought JavaScript clipboard was opt in?

[mystik]

My quick 'how it works assessment w/o tracing the code' is that it detects when you create a range of highlighted text, the inserts an invisible image with alt text @ the very end of the selection. It's not touching the clipboard, it's simply "altering" what you selected to copy @ the last second before the user copies it to the clipboard.

Re:Thought JavaScript clipboard was opt in?

[gknoy]

Do it with something that is in the public domain. Perhaps random snippets from a random Project Gutenberg article.

Re:Thought JavaScript clipboard was opt in?

[lattyware]

'ASCII art version of goatse.' +4 Interesting
Only on slashdot.

Re:Thought JavaScript clipboard was opt in?

[metrometro]

>> Is anyone else half-tempted to write a script to post back random text from Pride and Prejudice, or something to that effect?

> Do it with something that is in the public domain. Perhaps random snippets from a random Project Gutenberg article.

Like, perhaps, Pride and Prejudice?

Copyright awareness win. Literature awareness fail.

Re:Thought JavaScript clipboard was opt in?

[Anonymous Coward]

=O=

Re:Thought JavaScript clipboard was opt in?

[Anonymous Coward]

Perhaps some of the code from the Linux kernel would be good? If we could get 50% of the people copying text to have this silly site think they are all copying snippets of Linux code it would be pretty funny.

Re:Thought JavaScript clipboard was opt in?

[geminidomino]

Maybe random passages snarfed from the alt.sex.stories archives... fuck up their demographics, but at least give them something to read!

Re:Thought JavaScript clipboard was opt in?

[Anonymous Coward]

what do you mean random text? if you are going to do it, make it the full text

Re:Thought JavaScript clipboard was opt in?

[vnaughtdeltat]

I have this terrible habit of double-clicking on text when I'm reading it, which selects it every couple of seconds. If more people did this maybe we could overload their servers.

Re:Thought JavaScript clipboard was opt in?

[Ollabelle]

Why stop with snippets? How about whole books at a time? It'll amount to a DDoS attack on their servers....

Re:Thought JavaScript clipboard was opt in?

[jank1887]

Pride and Prejudice? You're nice. I was thinking something along the lines of the 'first post' and CmdrTaco spam.

Re:Thought JavaScript clipboard was opt in?

[Anonymous Coward]

/etc/hosts doesn't support wildcards (at least on my platform, to my knowledge).

I just tested it on mac os x. Does it work on other platforms, or is there something I have to do to enable it?

Re:Thought JavaScript clipboard was opt in?

[Anonymous Coward]

What's CmdrTaco?

Re:Thought JavaScript clipboard was opt in?

[Gordonjcp]

It seems to send some sort of start and length reference to the servers. It wouldn't be hard to keep sending them lots of randomish clicks though.

Re:Thought JavaScript clipboard was opt in?

[maxwell demon]

I never use Ctrl+C when copying from web sites. I just mark the text on the web page, and then paste it whereever I want.

Re:Thought JavaScript clipboard was opt in?

[Ken_g6]

I triple-click (to select paragraphs), which would be even worse!

Re:Thought JavaScript clipboard was opt in?

[dlgeek]

He was modded down as overrated. +1 funny -1 overrated is not a wash because funny gives no karma. My guess is some mod who thought it was funny was trying to make sure he didn't get hurt by it. You can lose karma on a +5 post if you keep getting downmodded and upmodded back as funny.

Re:Thought JavaScript clipboard was opt in?

[FlyingBishop]

http://man.netbsd.se/?find=hosts.deny+5+30

I think the proper way is ALL: .tynt.com

*.tynt.com shouldn't work on any platform, to my knowledge.

Re:Thought JavaScript clipboard was opt in?

[Anonymous Coward]

How does one edit the hosts file in Win 7? It won't let me save over it.

Re:Thought JavaScript clipboard was opt in?

[Anonymous Coward]

> In any case, I blacklist *.tynt.com in hosts.

AFAIK, wildcards don't work in hosts files, although it's a common misperception that they do. I think you can just add tynt.com and block the whole domain.

Re:Thought JavaScript clipboard was opt in?

[clone53421]

Blocking .tynt.com doesn’t block tynt.com itself. You have to use two entries.

Re:Thought JavaScript clipboard was opt in?

[clone53421]

Moderating funny posts interesting (or informative, or insightful) can often be quite funny. When moderating, I’ve been known to do it just for comic effect.

Re:Thought JavaScript clipboard was opt in?

[Anonymous Coward]

I actually do that too. Now I want to go see what sort of effect it has on a site that's using this taynt stuff.

Re:Thought JavaScript clipboard was opt in?

[madpansy]

I have a, perhaps worse, habit of repeatedly drag-selecting the paragraph I'm reading.

Re:Thought JavaScript clipboard was opt in?

[broken_chaos]

The specific URL to block, in case you don't want to block absolutely everything from a domain, is:
http://tcr.tynt.com/javascripts/Tracer.js

Re:Thought JavaScript clipboard was opt in?

[clone53421]

I’d prefer to block absolutely everything from their domain unless I’m actually visiting their domain.

Re:Thought JavaScript clipboard was opt in?

[Anonymous Coward]

Or an ASCII art version of goatse.

I have this:

-O-

You're welcome.

Re:Thought JavaScript clipboard was opt in?

[broken_chaos]

Which is more than reasonable, of course!

Judging by some other comments further down the page, that may actually be very warranted here. A better block than the on I initially found is as follows:
http://*.tynt.com/javascripts/

They appear to be using multiple subdomains and at least two different script names...

Re:Thought JavaScript clipboard was opt in?

[clone53421]

||tynt.com^$third-party

Re:Thought JavaScript clipboard was opt in?

[Idbar]

And that rule worked quite well on ABP.

Re:Thought JavaScript clipboard was opt in?

[Anonymous Coward]

I have this terrible habit of double-clicking on text when I'm reading it, which selects it every couple of seconds. If more people did this maybe we could overload their servers.

Weird, me too. Wonder why?

Re:Thought JavaScript clipboard was opt in?

[The MAZZTer]

A bug tracker called "Gemini" hooks and stops Ctrl+V and hooks the context menu too and blocks it. This is very annoying since their paste IS BROKEN. I go to paste and nothing happens. Gemini appears to be made for IE6 since it doesn't support tabs (it "remembers" your previous page and uses that to figure out what project you're viewing... if you open a new tab and browse into another project, the other tab will navigate to it as soon as you click any link) and the text area editor is simply better for IE. Quite infuriating. If I still used Firefox I could just NoScript it and be done with at least the dumb clipboard stuff. I can't paste via the Page menu either since Chrome's paste menu option is a hack; it just sends Ctrl+V to the browser window (I've seen the source code). Hope they fix that soon...

Re:Thought JavaScript clipboard was opt in?

[Anonymous Coward]

haha me too, thought I was the only one!

Re:Thought JavaScript clipboard was opt in?

[Kalriath]

UAC prevents it. You must run Notepad or whatever you're editing with elevated.

Re:Thought JavaScript clipboard was opt in?

[Anonymous Coward]

This isn't a minor detail. Tynt sends *everything you highlight on a page* to its servers, along with your IP -- not only things you copy. As one of the links in the post mentions, that's potentially a violation of some countries' privacy laws. It borders on passively monitoring your computer...

Re:Thought JavaScript clipboard was opt in?

[RobertM1968]

I'd test to see just how large their database fields are... or test to see how long their server will keep a connection open that has a full speed data flow to their server. And open a buncha tabs to do so (ie: scripts running connected to their server). Hmmm... I can hit 10Mbs upstream... figure a 90 second script timeout on their server maybe? Over 100MB of data to them aint that bad. Especially if everyone was doing it until they got the hint. I dunno, maybe a simple "random" generated string saying "stop stealing my keystrokes/clipboard data without my permission" (ok, maybe that's not so random).

I actually have some secure files I keep certain often used account info in that I then copy and paste into the browser as needed... guess I need to stop doing that.

Re:Thought JavaScript clipboard was opt in?

[Anonymous Coward]

I do this too (although more often triple-clicking). It leads me to not use sites like the New York Times that open a dictionary or some such useless behaviour every time you select text.

Re:Thought JavaScript clipboard was opt in?

[thejynxed]

Or....you can just seize control over that particular file via Permissions. I know I did that for more than a few things in Vista. The stupid OS didn't even allow me permission to open my own Documents folder.

Re:Thought JavaScript clipboard was opt in?

[Anonymous Coward]

How do you edit the hosts file in Windows 7?

Re:Thought JavaScript clipboard was opt in?

[ais523]

Some moderators also do it to reward the poster (or cancel out a mod-down, as the grandparent says). Modding someone funny doesn't increase their karma; modding them interesting, informative, insightful or underrated does.

Re:Thought JavaScript clipboard was opt in?

[Anonymous Coward]

Rather than double-clicking, I repeatedly select random bits of text I'm reading. I'd be great if this sort of behaviour overloaded their servers or at least made the data useless, unfortunately I use NoScript, so they are blocked by default and my behaviour won't affect them.

Re:Thought JavaScript clipboard was opt in?

[Anonymous Coward]

They gather the selected text by using Javascript. Reverse engineer it and add lots of noise with a bot!

Re:Thought JavaScript clipboard was opt in?

[FlyingBishop]

http://en.wikipedia.org/wiki/Hosts_file#Location_and_content

You will need an elevated text editor, obviously.

Other script blockers will work, as well

[srmalloy]

NoScript will also block it, and if you configure it to block by default, Tynt's code will never execute unless you specifically permit it.

Re:Other script blockers will work, as well

[pdboddy]

How the hell is the parent of this a troll?

Re:Other script blockers will work, as well

[causality]

Somebody's been insulted by the story. Half the replies to this story have been down-modded as Troll.

Make note, meta-mods!

Unfortunately meta-moderation is quite useless these days. It mattered when it produced a "fairness" score for moderators and whether they received points was affected accordingly. Now it just meta-moderates posts and not moderators, which completely defeats the useful original purpose. Anyone who's been on this site for a decent length of time has noticed the increase in low-quality moderation that has happened ever since this decision was made.

Re:Other script blockers will work, as well

[xlation]

If you control your DNS, you can also blackhole Tynt's servers

Re:Other script blockers will work, as well

[JonStewartMill]

I just checked my NoScript settings. Imagine my surprise to see tynt.com whitelisted by default.

Re:Other script blockers will work, as well

[clone53421]

I just checked my EasyPrivacy Adblock Plus subscription. Imagine my surprise to see ||tynt.com^$third-party blacklisted by default.

Re:Other script blockers will work, as well

[maxwell demon]

It's not in my NoScript whitelist (just checked). But anyway, even if it were, RequestPolicy would reliably block it anyways.

Re:Other script blockers will work, as well

[Anonymous Coward]

Anyone who's been on this site for a decent length of time has noticed the increase in low-quality moderation that has happened ever since this decision was made.

So that change went into effect about 4-5 years ago? That sounds about right.

Re:Other script blockers will work, as well

[SharpFang]

Will adding http://.tynt.com/* to adblock suffice?

Re:Other script blockers will work, as well

[himitsu]

If you work your way outward it won't be on your whitelist unless you allow it. It's not on my whitelist because I forbid everything by default and enable JS when I see a need.

Re:Other script blockers will work, as well

[Golddess]

Someone over at Tynt got mod points?

It is to laugh.

[geminidomino]

Epic Win for Irony.

Currently on the front page of Wired.Com

"WebMonkey:

Warning: This site may be sharing your data"

Re:It is to laugh.

[pdboddy]

Not sure how the parent of this is a troll either. Are people who are moderating even reading what they're rating?

Re:It is to laugh.

[SpaceLifeForm]

Oh, they are reading it all right.

They just don't want other readers to get educated.

Re:It is to laugh.

[baegucb]

Moderation "errors" get corrected, just takes time. There are fewer people screwing up moderation then there are people doing it properly. If it gets real bad, the admins will change slashdot, possibly going back to old style meta-moderating.

If its just JS break it.

[DarkOx]

If its just J/S it must be useing the browser to get or post the information back to their web server. Figure out what there net block is and black configure your firewall to send you a nice reset packet anytime your box tries to hit it.

Re:If its just JS break it.

[TheRaven64]

I often randomly click on a page while I'm reading and select bits of text. If I visit any site that uses this, then they'll get a lot of data but no useful information from me.

Re:If its just JS break it.

[Sir_Lewk]

Who the hell is modding everything -1 Troll? There are way more than 5 posts unjustly modded so it's not just some single jackass.

Re:If its just JS break it.

[winthrop]

They'll get how long you stayed on the page and were actively reading it.

Re:If its just JS break it.

[Anonymous Coward]

Append this to /etc/hosts:
#tynt makes browser bitch when you highlight things
#I have never seen a worse idea
#ever
#ever!
#seriously, screw that so much
#first one is the JS script host
#second is recipient of highlightings
0.0.0.0 tcr.tynt.com
0.0.0.0 w1.tcr70.tynt.co

I've known about this for ages because it makes Firefox act like it's loading a page whenever you highlight text. I do that habitually while reading.

Re:If its just JS break it.

[Jaysyn]

Probably the owners of Tynt Insight & their employees. I wouldn't worry about it, they just wasted their mod points anyhow.

Re:If its just JS break it.

[QuoteMstr]

Don't like it? Metamoderate.

Re:If its just JS break it.

[TheRaven64]

Not really. I click on random things on my active browser window while I'm thinking about other stuff. They'll get how long I had the window open, but not how long I was actively paying attention to it.

I actually wouldn't mind page owners having some information about how long I spend on each page. I close pages with irritating ads as soon as they open, and I'd love to have that information reported to both the people placing the ads (piss me off with your ad and I won't even stay long enough to read your product name) and the content providers (show irritating ads and I won't read your content).

Re:If its just JS break it.

[Jah-Wren Ryel]

Don't like it? Metamoderate.

It is impossible to metamoderate without javascript.
The irony of that requirement is particularly stark given the context of this slashdot article.

Re:If its just JS break it.

[Clover_Kicker]

Unjust?

Relax, it's just slashdot.

Re:If its just JS break it.

[mikael_j]

Or with Bind you could create an empty master zone conf that returns NXDOMAIN for everything and then tell Bind it's the master server for tynt.com and tell it to use the empty zone file, that's what I do with annoying junk domains and I only have to change it in one place to change it for my entire network.

/Mikael

Re:If its just JS break it.

[BJ_Covert_Action]

I still can't figure out how to metamoderate. I've been on the site for over a year now and have never once seen a link asking if I have metamoderated recently. I have browsed the FAQ and every other scrap of info I can find about it on slashdot but, so far as I can tell, there isn't a single place that tells you what button or whatever to click on a comment to metamoderate it. I don't know, I suppose I am just doing it wrong.

\overit

Re:If its just JS break it.

[clone53421]

http://slashdot.org/firehose.pl?op=metamod

Re:If its just JS break it.

[MrMr]

That's nothing; I often deliberately leave the mouse pointer up a nostril or in an eye of a picture on the page while I read.
I know. It's pathetic, but it amuses me.

Re:If its just JS break it.

[Anonymous Coward]

And if I could read your poor spelling, I might comment on your statement...

Re:If its just JS break it.

[mister_playboy]

If you meta-moderated yourself, you'd know that it no longer has anything to do with moderation of the moderators.

Re:If its just JS break it.

[Rossman]

That's the thing though...you're saying that the data is considered useless/harmless, and therefore of no value. Maybe it's not. There are a great deal of people who analyse data out there and they may or may not be able to glean something useful out of your collated user actions. There could be a whole field of folks out there analysing the psychology of why people click and where and how to best market to those people (it's always about advertising in the end).

Scripting?

[Nexzus]

Probably uses the script onmousedown or onselect events for the page. So don't allow scripting for that site, and you should be fine.

Isn't disabling javascript an opt-out?

[Anonymous Coward]

I agree that the talk-back makes me a bit uncomfortable, but ultimately anything that makes it to my browser window is under my control.

Re:Isn't disabling javascript an opt-out?

[Joce640k]

That depends ... with Firefox+NoScript it's an opt-in.

NoScript

[leoc]

Personally I have stopped browsing without NoScript enabled. I sincerely hope that the functionality it provides is adapted as a base feature in future browsers. Javascript is simply too dangerous to be trusted by default. Sites need to earn that trust, IMHO.

Re:NoScript

[LordKazan]

until i find a subscribable whitelist (ala AdblockPlus's blacklist) I won't use it.

I don't want to go through the trouble of adding every known benign site to my white list.

Re:NoScript

[apoc.famine]

It's interesting how transparent NoScript is on the pages I visit often, and how much it complains about sites I don't visit often. It's an extra irritation, definitely. But when you watch someone browsing without it, you get a damn good refresher on why you use it.
 
I'm blown away by the amount of abuse that most people put up with from scripts. It's mind-boggling to me. I put up with exactly one bit of abuse - sometimes I have to reload a page a time or two as I selectively enable scripts to get to the content I want. I'd rather not do that, but it sure beats the alternative.

Re:NoScript

[John Hasler]

> I don't want to go through the trouble of adding every known benign site to
> my white list.

I find that very few benign sites need JavaScript (though many claim to).

Re:NoScript

[causality]

until i find a subscribable whitelist (ala AdblockPlus's blacklist) I won't use it.

I don't want to go through the trouble of adding every known benign site to my white list.

The number of benign sites I use is much greater than the number of benign sites that won't work without Javascript. Even if there were an exact 1:1 correspondence, I'd consider the couple of mouse clicks of effort to be more than worth my while to obtain a browsing experience that is under my control and happens the way I want it to happen. Once added to the (non-temporary) whitelist, a site stays on that list until and unless I remove it, so It's not like I have to do this more than once for any particular site. I consider it a very small price to pay, especially when you think about the potential abuses that we don't yet know about because they have not yet made headlines.

Re:NoScript

[Jah-Wren Ryel]

until i find a subscribable whitelist (ala AdblockPlus's blacklist) I won't use it.

I don't want to go through the trouble of adding every known benign site to my white list.

I find that the web is remarkably useful without javascript. There are a handful of sites that absolutely require it, but 99% of the time, I don't need javascript to get by. For example, my white list is limited to:

my high school's alumni site
my banks' websites
bing.com - for the maps only
google.com - for maps and voice only, not search
youtube
addons.mozilla.org

Occasionally I'll make use of the "enable javascript on this site temporarily" but for the most part that's rare (like if I'm shopping at newegg)

I will admit, that on occasion I will give up on a website because it doesn't work without javascript. But there are almost always alternatives that fit the bill and do work just fine.

Re:NoScript

[inviolet]

Personally I have stopped browsing without NoScript enabled. I sincerely hope that the functionality it provides is adapted as a base feature in future browsers. Javascript is simply too dangerous to be trusted by default. Sites need to earn that trust, IMHO.

It is in Opera. Opera has built-in site prefs that include java, javascript, plugins, 1st and 3rd party cookies, send referer, right-clicks, etc. These can be configured per site, per domain, and both. Then you turn all that crap off browser-wide, so that your site prefs become a whitelist.

Opera is so far ahead of its time.

Re:NoScript

[clone53421]

In the meantime, I find that the EasyList and EasyPrivacy subscriptions for Adblock Plus are pretty adequate.

Re:NoScript

[fast turtle]

Having used Noscript for over 2 years, I've built a whitelist of all the sites I use that absolutely need jscript working. That's 11 sites in all over the last 2 years. If that few need Javescript to be useful, why in hell even allow javascript to begin with?

Re:NoScript

[PhantomHarlock]

After browing with noscript + adblockplus for a year, I can't fathom not browsing that way. It started after I got malware from an ad from a major newspaper website. Learned that day the hard way that there are no real trustworthy sites out there. Just have to take everything one step at a time.

I too enable one script at a time on pages that seemingly aren't working correctly. Usually you can figure out which script you want to enable by the company or URL name. (mostly for embedded videos served by a third party web page)

Re:NoScript

[pavon]

I put up with exactly one bit of abuse - sometimes I have to reload a page a time or two as I selectively enable scripts to get to the content I want.

I tried using NoScript for a while. What really frustrated me was that I would completely fill out a form, then discover that I needed javascript enabled for the submit button to work. So I would enable javascript at which point the page would reload and clear all the form entries I just spent the last 5 minutes filling in. This happened on nearly half of the forms I would use. I got sick of that real quick and haven't used NoScript since.

Re:NoScript

[apoc.famine]

That and it's pretty easy to figure out which ones you see all over that are problematic. My "untrusted" list is growing slowly, but steadily. It's nice to have that log of the scripts you know aren't needed for content, and are only there to serve ads or do other obnoxious stuff.
 
It's been a slow process, but my browsing is getting less and less hindered by NoScript as I've built my web of trusted and untrusted scripts.

Re:NoScript

[AsmordeanX]

I tried using NoScript for about a month but stopped using it. Often times I would run into a website that was just broken for some reason. Couldn't click on the links, missing elements, no navigation menus, etc. Yes I could just back out of these sites and go elsewhere but a few of them I simply don't have a choice. I have to use the site.

A result of this, I permit the site to run JS. I thought, gee why couldn't a malicious site just look innocent and make it appear that you NEED JS to do anything on the page causing NoScript users to give them permission.

There are also some nice things you can do with JS. While these are low priority compared to some of the risks with javascript it can make some sites a bit nicer to deal with. Yes, there are safer ways to do this stuff but you don't have a choice.

Re:NoScript

[pmontra]

Yes, that was bad until I got the habit of enabling site's scripts before starting to fill out the form. I usually enable only the scripts from the primary domain of the site, not the 3rd party ones so I'd never enable something like tynt to fill out a form.

Everything selected, not only copied?

[Anonymous Coward]

In that case I hope they have enough server space.

Snopes

[Itninja]

Snopes was (is?) using java to prevent site viewers from right-clicking and selecting text at all (not to mention using java to present copious pop-up and pop-under ads). I had no idea until I was watching a friend go to Snopes in a browser without NoScript running. Showed him how to user get NoScript and now he is free to copy/paste text with impunity!

Re:Snopes

[Unbeliever]

I don't use noscript, but have been noticing lots of disabled copying on more and more websites.

The simple fix I use is to Ctrl-U/View source and copy from that window.

Re:Snopes

[Itninja]

That would work sort of. For Snopes they put a manual line break after every line, and they have a lot of in-line advertisements that will clutter up the code.

Re:Snopes

[Jaysyn]

I'll just stick with NoScript, thanks.

Re:Snopes

[Jose]

a lot of places do this by watching your mouse actions (the right click). if this is the case, and if you are using Windows, another way around it is to use shift-F10 instead of the right-click.

Re:Snopes

[Anonymous Coward]

If you don't have no-script, you can do a poor-man's script block by hitting the windows menu key to bring up the context menu. It doesn't fire a mouse-click event, and so it some scripts that depend on that don't fire.

Re:Snopes

[Lord Ender]

Hey boys! This feller here is calling himself "IT Ninja" but he doesn't know the difference between java and javascript! I say we run him outa slashdot!

Re:Snopes

[corbettw]

That sounds like an urban legend to me. What does Snopes say about it?

Re:Snopes

[shamborfosi]

Here's the script snopes uses:

var omitformtags=["input", "textarea", "select"]
omitformtags=omitformtags.join("|")

function disableselect(e){
if (omitformtags.indexOf(e.target.tagName.toLowerCase())==-1)
return false
}

function reEnable(){
return true
}
if (typeof document.onselectstart!="undefined")
document.onselectstart=new Function ("return false")
else{
document.onmousedown=disableselect
document.onmouseup=reEnable
}

So you can see that with the exception of select input and textareas, they disable selection when the mouse is pressed and re-enable it when the mouse is released.

Re:Snopes

[Anonymous Coward]

How poor are you? NoScript is free...

Re:Snopes

[VGPowerlord]

I simply set Firefox's options so that JavaScript can't disable or modify context menus.

Re:Snopes

[shutdown -p now]

Snopes was (is?) using java to prevent site viewers from right-clicking and selecting text at all (not to mention using java to present copious pop-up and pop-under ads).

How would one use Java to achieve that? Or do you mean JavaScript?

In any case, I'm honestly surprised that Firefox lets JS intercept right clicks by default. I thought it's only an IE [mis]feature. Do Chrome and Safari do that, too?

If so, I sure am glad that I'm using Opera, which has this crap disabled out of the box (you can enable it per-site if you want). As far as I'm concerned, this amounts to hijacking the browser UI, and definitely should be opt-in rather than opt-out. What next, give pages access to browser toolbar?

Re:Snopes

[SharpFang]

Well, there was this page which used Java for roll-over buttons in navigation. One applet per button, some 30 buttons on a page. With no other purpose than change background under the button.
You can imagine the computer wasn't too happy about loading 30 instances of JavaVM...
I guess some manager complained "I don't want any half-assed SCRIPT! Everyone knows scripts are slower!"

Re:Snopes

[Anonymous Coward]

No, he is calling himself It Ninja, as in the game children play where one child is "it" and they have to chase after and touch another child who then becomes "it" after the child who was "it" touches them. I do understand your confusion here though, because I'm sure this game is known by other names as well.

Re:Snopes

[Fred_A]

Hey boys! This feller here is calling himself "IT Ninja" but he doesn't know the difference between java and javascript! I say we run him outa slashdot!

Get the feathers, I'm heating the tar !

Re:Snopes

[Nyder]

Hey boys! This feller here is calling himself "IT Ninja" but he doesn't know the difference between java and javascript! I say we run him outa slashdot!

Hey boys! This feller here don't know how to use Quote Parent properly. So now we don't know which post he is referring to. I saw we run him outa slashdot!

Re:Snopes

[naam00]

Just print to PDF and select from there. Or is that OSX only?

Habits

[Hatta]

I have a habit of repeatedly selecting and deselecting text as I read it. I probably selected the story blurb here 10 times while reading it. It would be hard for them to mine that data for anything useful. Not that I run strange javascript anyway.

Re:Habits

[Wonko the Sane]

I do the same thing. I think it is because light text on a dark background is easier to read.

Re:Habits

[LMacG]

I'm a "highlight while reading" guy too. That's what first made me notice Tynt, and that's what made me swich back to Firefox (w/ NoScript) from Chrome.

Re:Habits

[ColdWetDog]

Wow, who (or what) came through and troll modded everything? One of the editors have a really bad day?

Re:Habits

[Mikkeles]

Probably Derek Ball

Re:Habits

[Ethanol-fueled]

Somebody with a god-like sense of humor.

O' Megamod Troll, I beseech thee and offer thee a faded black semen-crusted Rush t-shirt!

Re:Habits

[metrometro]

I have a habit of repeatedly selecting and deselecting text as I read it

Poor man's eyetracking. Which blurb are you reading? Oh, that one.

Re:Habits

[Jeng]

I would think that the information you give them is even better than what they would get from someone else who does not select what they read.

After all, they know exactly what parts interests you. It's not like your off selecting stuff your not reading.

Re:Habits

[geminidomino]

/AOL.

I never thought much about why though, but it does make a lot of sense. I don't have to read-select when I'm coding in vim, because I use green-on-black...

Cool. Learned something about myself today. :) Thanks

Re:Habits

[Anonymous Coward]

au contraire: they will know in due time which parts of the site are interesting for visitors. Highlighted = interesting for readers and read. Very valuable information indeed.

Re:Habits

[Evro]

I also select text as I read it. Usually I'll select a line in a story and use the selected text as a visual marker so I can press Page Down and quickly see where I left off.

Re:Habits

[stillnotelf]

I am thrilled to hear that other people do this! I do it as a nervous habit - I can't keep my hands still so when reading at a computer it's a good way to keep them occupied. I forget to stop doing it when other people are reading over my shoulder for whatever reason - it drives them CRAZY! It's also a problem when cutting and pasting in emacs (since highlighting copies) - I get all sorts of bizarre things pasted by mistake when I switch between websites and code while code compiles.

Re:Habits

[maxume]

It happens from time to time. I think whoever is doing it sees it as some sort of protest of the moderation system (just now I notice this article is under YRO, I haven't noticed if the mod-bombs are concentrated in this section or not).

Re:Habits

[MyFirstNameIsPaul]

Second on that one. I first became aware that I don't like staring at a dim light-bulb for hours when James Maddox mentioned on TBPITU, I think in his FAQ. I do wish more sites would give a reverse option. I especially find the reversed out dslreports.com to be easy on the eyes. It seems like sometime back I saw it on YouTube for like a week and then it disappeared.

Re:Habits

[Hatta]

Yep, busy hands. When I'm reading a paper offline, I use a pencil. Either point at what I'm reading, or tap it repeatedly against something convenient. Figure it keeps that part of my brain from bothering the part that needs to concentrate.

Re:Habits

[stillnotelf]

What do you do when reading books for pleasure? I make sure to use scrap paper as bookmarks because I'll fold the paper up and tear it into little pieces. If it's a nice bookmark (or the library's date-stamp card) I have to remember not to destroy it. When I was younger I had a serious problem with snacking while reading to keep my hands busy - sedentary reading plus Fritos is not good for one's weight...

Re:Habits

[nahdude812]

I tend to double-click the word or sentence I'm on to select it just before I scroll. Helps me keep my reading pace up since I don't lose track of my position.

Re:Habits

[Anonymous Coward]

Same here, although fiddling with AdBlock I could never work out what exactly was causing the network access. They must have a lot of repeated paragraph selections from me! While browsing I subconciously select whole paragraphs from top to bottom, then clear selection, bottom to top, repeat ad nauseum.

Short of noscript, does anyone have an easy way to block this script?

Re:Habits

[clone53421]

The EasyPrivacy subscription blocks it automatically.

Or you can add the filter manually:
||tynt.com^$third-party

Re:Habits

[mister_playboy]

Why not invert the colors in your browser window while reading, then?

Re:Habits

[Wonko the Sane]

Not all browsers make this easy and not all websites play well with reversed text and background colors.

As Seen @ DemoCamp

[Akoman]

DemoCamp in Edmonton got a demo of this backbreakingly suit-oriented piece of software. It's a sign of how all DemoCamps slowly become lame as shit that all of the Q & A was spent with the suits asking about how they make money or providing advice on that point rather than commenting or asking about the technology.

More of the same?

[Qubit]

So let me get this straight. Because there are websites that are doing shady stuff with the text I select and such, you want me to install a Firefox Extension that theoretically won't do anything shady with my stuff, even though its license consists of

Source code license for Ghostery 2.0.2
Copyright Ghostery, Inc. All Rights Reserved.

And there's no source available.

Why should we trust the people behind Ghostery any more than a random website out there? If you're writing software to protect privacy and prevent data snooping, why make people trust more closed-source software?

Re:More of the same?

[Anonymous Coward]

Thanks to your posting we were able to determine your exact location to within 3 meters. A thought patrol has been sent to collect you for reconditioning. Have a pleasant day. Or else.

Re:More of the same?

[Nyder]

So let me get this straight. Because there are websites that are doing shady stuff with the text I select and such, you want me to install a Firefox Extension that theoretically won't do anything shady with my stuff, even though its license consists of

Source code license for Ghostery 2.0.2
Copyright Ghostery, Inc. All Rights Reserved.

And there's no source available.

Why should we trust the people behind Ghostery any more than a random website out there? If you're writing software to protect privacy and prevent data snooping, why make people trust more closed-source software?

How much did your /. account cost you?

Adblock the javascript

[Anonymous Coward]

Same thing works to get rid of that stupid answers.com script that makes an ajax call whenever you select any text on a page.

Easy Adblock Plus Filter

[CritterNYC]

Just add a filter to to Adblock Plus in Firefox. Go to Adblock Plus's preferences page, click Add Filter and enter:

http://tcr.tynt.com/*

Then just click OK or Apply.

Re:Easy Adblock Plus Filter

[bheer]

They also use http://wau.tynt.com/javascripts/TyntLite.js for some pages, so I'd recommend adding http://*.tynt.com/* if your blocking system supports multiple wildcards.

Re:Easy Adblock Plus Filter

[InvisiBill]

Similarly, I blocked http://*.tynt.com/javascripts/* myself. I prefer to be as specific as possible for what I want to block (their scripts in this case) so as not to completely block the whole site, while still trying to block the widest swath of the unwanted stuff. Not that I ever plan to go there, but this way it won't block it if I decide to check out their ToS or something.

Re:Easy Adblock Plus Filter

[Jah-Wren Ryel]

I'm totally the opposite. If I think their entire reason for existence is privacy invasion, I block the entire site e.g. "tynt.com" - because you never know when they are going to add more stuff to their arsenal, so I prefer to take them out completely by just specifying their top level domain. It has never been a problem in the ~7 years or so that I've been doing it.

Re:Easy Adblock Plus Filter

[clone53421]

Just subscribe to the EasyPrivacy filter list.

It includes the filter ||tynt.com^$third-party already.

Re:Easy Adblock Plus Filter

[jmcnamera]

Their address resolves to 208.100.17.100 so I block that as well. Of course, the scum will just get another domain address.

Re:Easy Adblock Plus Filter

[Anonymous Coward]

Similarly, I blocked http://*.tynt.com/javascripts/* myself. I prefer to be as specific as possible for what I want to block (their scripts in this case) so as not to completely block the whole site, while still trying to block the widest swath of the unwanted stuff. Not that I ever plan to go there, but this way it won't block it if I decide to check out their ToS or something.

Why should their Terms of Service require javascript to render???

Why collect that data?

[gmueckl]

The URL appending when cutting and pasting is easily defeated by pasting using the middle mouse button. That script still sends selection information, though. Can anybody tell me what this data is collected for? I don't see any value in it.

Re:Why collect that data?

[LMacG]

I wonder if they tracked me copying the URL for their page - Why Tynt Insight?

Re:Why collect that data?

[Nerdfest]

Many password storage utilities use the paste buffer to keep you from needing to type the password, although the good ones will blank it out after a short period of time. This has the potential for some fairly serious abuse.

Re:Why collect that data?

[Anonymous Coward]

The URL appending when cutting and pasting is easily defeated by pasting using the middle mouse button. That script still sends selection information, though. Can anybody tell me what this data is collected for? I don't see any value in it.

And the ability for most slashdotters to think beyond their own heads is made blindingly apparent yet again. Having some idea of what specific text people are highlighting or cutting/pasting from any given page is imminently useful. Hell, it can even be useful for a Linux HOWTO site -- the site owner could see that 10 out of every 15 people that visit the HOWTO always select the same block of text, which means that there are a shitload of people out there looking for that very specific piece of information. You could then move that block of text somewhere where it's more prominent, or add it to the FAQ, or whatever. I'm not saying they should be using this Tyntcrap to do it, but I'm merely pointing out how your failure to "see any value in it" is exactly that -- a failure of imagination on your part.

Re:Why collect that data?

[Anonymous Coward]

People using an OS that actually matters do not paste using middle click.

Re:Why collect that data?

[Anonymous Coward]

I think the fact that you can see what people are finding 'noteworthy' on your site is reason enough.

Plus if you find a blogger that seems to be quoting you without attribution and find that his IP has selected this text from you, bam copy infringement case.

Re:Why collect that data?

[noidentity]

Since the average content copied is between 200 and 300 words, even a site with only 100,000 page views would have up to 3 million words leave the site via copy each month (not to mention all the images!). That's also a lot.

Man, if people took that many words from my website a month, my pages would all be empty in no time! I better go check to be sure nothing's left my site. Fortunately I have local backup copies I can replenish the words from.

Re:Why collect that data?

[MathiasRav]

As far as I've gathered (haven't RTFA), the script is opt-in for the websites, and it only registers the text you select, copy and paste on the sites using it. If the sites in question have user login, that's too bad for the users pasting passwords on the sites. However, in that case, the script would already have access to the password input box and its unmasked contents, thanks to the coarse-grained security policies in JavaScript on that matter. Your sensitive information is safe in your clipboard as long as it isn't copied from or pasted to the sites linking with Tynt Insight.

Re:Why collect that data?

[Anonymous Coward]

Well you enjoy your privacy invasions, malware, and helping the botnet spamming cause while the rest of us who don't matter continue to use our computers and get work done. Better cough up another $300, I hear your Symantec, Mcaffe, and AVG subscriptions are about to expire.

Re:Why collect that data?

[causality]

The URL appending when cutting and pasting is easily defeated by pasting using the middle mouse button. That script still sends selection information, though. Can anybody tell me what this data is collected for? I don't see any value in it. And the ability for most slashdotters to think beyond their own heads is made blindingly apparent yet again. Having some idea of what specific text people are highlighting or cutting/pasting from any given page is imminently useful. Hell, it can even be useful for a Linux HOWTO site -- the site owner could see that 10 out of every 15 people that visit the HOWTO always select the same block of text, which means that there are a shitload of people out there looking for that very specific piece of information. You could then move that block of text somewhere where it's more prominent, or add it to the FAQ, or whatever. I'm not saying they should be using this Tyntcrap to do it, but I'm merely pointing out how your failure to "see any value in it" is exactly that -- a failure of imagination on your part.

A failure of imagination... or a recognition of the ease with which I can press CTRL-F and find the text on the page whether it's prominently in the first paragraph or not... Sorry, but it sounds like a solution for sheeple for whom a few seconds of effort is too much active involvement. I'd rather have my privacy, thanks.

Re:Why collect that data?

[rdavidson3]

In their privacy policy
http://www1.tynt.com/privacy-policy

Information obtained by virtue of your visiting TYNT web sites

When you use TYNT Products, we will collect the following information:

1. The Internet domain and IP address from which you access the TYNT Products;
2. The type of browser and operating system used to access the TYNT Products;
3. Screen resolution of your monitor;
4. The date and time you access the TYNT Products;
5. The page you are visiting with the TYNT Products;
6. If you linked to a TYNT web site from another referring web site, the address of that web site.

By using the TYNT Products, you are consenting to have your personal data transferred to and processed both within and without the United States of America

They don't allow anyone to opt out of their "service" either. I guess if you want something from one of their customers, then maybe heading to a competitor would be smarter choice.

Re:Why collect that data?

[UberMorlock]

I use Tynt's service on a cattery website for which I am responsible (www.tabaxipixiebob.com). The primary reason I use Tynt's service is for the attribution link because I need to know if another Pixie Bob breeder copies the site owner's content and uses it on their site. This has happened to at least one other breeder that I know of, where that person's personal information (information about their employment, the name of their spouse, etc) was copied and used verbatim. So, if something like this happens, then I need to be able to contact that breeder and negotiate a change to the content of their site. The attribution service also can help generate backlinks to the site, assisting with search rankings and such.

The other reason I use it is because I want to be able to improve the content on the site. So, if I know what content is being highlighted while being read, then I know what parts of a page are generating interest. A heat map, of sorts, and content that is not highlighted as often probably needs improvement. I view this aspect of Tynt as no different than a writer or movie producer lurking in forums where their work is being discussed to find out what parts are most interesting and what is most criticized/lampooned. I'll grant that I am not *asking* visitors whether they want to share this data, but at the same time, it isn't like I can exactly have a conversation with even a small fraction of the people who visit the site since I have no idea who they are or how to contact them. If I could round up a focus group and get some feedback, then I wouldn't need to use Tynt for this (but I would still use it for the attribution part of the service).

Hope this helps to demystify the use of Tynt a little for you.

Re:Why collect that data?

[PAStheLoD]

JS can't read from the clipboard, only write to. So your passwords are safe.

Based on Selection

[CritterNYC]

It's based on selecting text, not copying and pasting it. So when you select the text in your browser, as soon as you finish making the selection, it sends the info on what you selected back to Tynt. It also adds in the attribution link to the selected text (although you won't see it in the web page). Then when you CTRL-C or right-click and copy as usual after making the selection, you get your selected text and the attribution link.

That's how it avoids needing to use Javascript to do anything to directly touch the clipboard (which is disabled by default in your browser for security reasons).

Re:Based on Selection

[bjourne]

Yes but how does it translate from knowing that a mouse drag was performed to exactly which characters are selected? AFAIK, it is very hard in Javascript to tell what character corresponds to which mouse coordinates. Whatever Tynt's solution is, it must be something pretty cool.

Re:Based on Selection

[sproingie]

All browsers offer an API for getting at the current selection. You just hook MouseUp and read the selection. Nothing so low-level as translating mouse coordinates.

Re:Based on Selection

[QuoteMstr]

Yes but how does it translate from knowing that a mouse drag was performed to exactly which characters are selected?

Through the stanard API.

AFAIK, it is very hard in Javascript to tell what character corresponds to which mouse coordinates.

No, it isn't.

Whatever Tynt's solution is, it must be something pretty cool.

Not really.

A really good application of the technique would be removing text: e.g., removing footnote references from copy-and-pasted wikipedia section, and removing inline site notifications from Slashdot posts.

Re:Based on Selection

[clone53421]

A really good application of the technique would be removing text: e.g., removing footnote references from copy-and-pasted wikipedia section, and removing inline site notifications from Slashdot posts.

...and none of it should require phoning home.

Re:Based on Selection

[Anonymous Coward]

Guess what? With X, selecting actually copies text, without Tynt mangling it.

Re:Based on Selection

[dzfoo]

But then it'll just be plain old Web 1.0. Boooooooring.

          -dZ.

Re:Based on Selection

[Anonymous Coward]

The phoning home portion is probably to enable reporting on what is being copied for their clients. This is the service they are actually selling (the reporting), since any web developer could just write the necessary javascript to do the attribution insertion.

Then again, maybe any web dev couldn't do it, since Tynt's technology is apparently patent pending...

Re:Based on Selection

[clone53421]

The phoning home portion is probably to enable reporting on what is being copied for their clients.

I’m aware...

any web developer could just write the necessary javascript to do the attribution insertion.

You overestimate “any” web developer. “Any” web developer could write the phone home portion, too.

Re:Based on Selection

[bjourne]

I had no idea, thanks for telling me.

Re:Based on Selection

[vegiVamp]

Ahh, so that's why I'm not seeing this behaviour on Linux - I rarely ever use the clipboard, I just use the native X select and middle-button-paste.

Yep, just tried with explicit copy/paste, and then the link appears.

Re:Based on Selection

[JackRabbitSlims]

No, it sends BOTH your "select text" event and also your "copy text" (in my case via Cmd-C on my keyboard). I use LittleSnitch, an application firewall on the Mac and have verified this behavior: I get a connection request to tynt servers exactly after either of the mentioned events.

JS messing with clipboard

[Al Dimond]

This isn't the first instance of Javascript messing with the clipboard. One of my former co-workers encountered a real estate search site that repeatedly overwrote his clipboard. He had the page open while he was working and discovered the issue while trying to copy-paste some database queries from one file to another or something.

My first thought was that the browser shouldn't even allow that. But since each of the individual components (looking at the selection, capturing keystrokes, writing the clipboard) can be used in JS for useful things it's hard for browser makers to do much about it. Of course, we should all be surfing with JS under tight control...

Re:JS messing with clipboard

[maxwell demon]

My first thought was that the browser shouldn't even allow that.

Which is exactly why sane browsers do not allow JS to access the clipboard by default.

Re:JS messing with clipboard

[shutdown -p now]

My first thought was that the browser shouldn't even allow that. But since each of the individual components (looking at the selection, capturing keystrokes, writing the clipboard) can be used in JS for useful things

What useful things?

In any case, it is a fallacious argument. Running arbitrary native code, for example, can also be "used for useful things". It doesn't mean it's a good idea for browsers to provide this ability.

Now, mind you, someone somewhere might just need that, and that's why we have browser plugins, which can provide any such thing if needed. But supported out of the box, and turned on by default? It's insane.

Why do they even need the text posted back?

[JSBiff]

I don't get it - why does the JavaScript even need to send the text to a server? I mean, the browser knows what page you are on. Why not just have the JS snag the URL from the browser and append it to the text, so the selected text never leaves your computer? This whole setup just sounds like an excuse to send something back to the server, when it's technically completely unnecessary.

Re:Why do they even need the text posted back?

[Anonymous Coward]

The response it sends back to the server tells the site owner what you selected / copies off their site.

Why site owners want to know that, I don't know; but, then, I'm not an evil marketing schmuck who can think up all sorts of clever ways to abuse customers for personal gain.

Re:Why do they even need the text posted back?

[LordKazan]

that's the point.

Re:Why do they even need the text posted back?

[infinityxi]

So Wired knows who the sue for copyright infringement multiple times. You loaded the page, offense #1, you explicitly copied it to the clipboard, offense #2 and by selecting the text you agreed to some tiny print terms that you fully intended to send this text to tynt there by making content available, offense #3. Prepare to hear from their lawyers who will want hefty damages you dirty pirate.

rename extension.xpi to extension.zip ... profit!

[Anonymous Coward]

... closed-source software?

1. rename extension.xpi to extension.zip
2. open extension.zip with unzipper of your choice
3. read all source-code
4. ???
5. profit!

Kind of One Sided Review of the Service

[eldavojohn]

I can't get it to work when I copy paste from Wired (must be something with my setup and javascript) but I will make the unpopular statement of saying that 1) you are copying and pasting Wired's content and 2) as early as high school I was taught that if I was copying information verbatim, I had better have some sort of reference (MLA preferred).

Now, on Slashdot I drop in a link on some text like just did up there. But if I'm quoting it, I'll throw in a quote block and lead up to who said it and call it a day. Now, let's imagine a world where all that was automated when you copied something and the text you copied came with XML metadata saying all the things like where you got it, when you got it, who wrote it, etc. That could potentially be pretty useful. If you think of the web as actual works belonging to people then you can start to see how legitimately referencing other works could be made a lot easier with stuff like this. And maybe text editors could have plugins to digest it?

Unfortunately the submitter and editor of this site seem to cry privacy violation at any attempt to move past the wild wild west anything goes attitude of the world wide web. That's fine as this has an element of privacy concerns what with the phoning home. But please consider the issue from Wired's side, from the side of the author and content creators. They might just trying to help us with what we were taught in school.

Lastly, I would like to point out that another solution aside from Ghostery or Noscript is just to not use Wired's site at all. Vote with your feet and bring your eyeballs elsewhere for pageviews and adclicks. I'm sure Wired's not losing a whole lot of adclicks if you do.

Re:Kind of One Sided Review of the Service

[Anonymous Coward]

If that's all they wanted to do, it could be easily accomplished without sending whatever you copy to some third party webserver. It would be fairly trivial to track what you copied, so that when you copied, you copied the extra url, and that would be all.

What they're doing here (from what I understand from TFA, and not from actually seeing it happen) is sending whatever you select to some server to be (possibly) stored. This is what everyone's decrying, not the fact that an URL tail comes attached to the copied text.

Re:Kind of One Sided Review of the Service

[LMacG]

Part of the problem is that the script seems to want to communicate to the server even when you've only highlighted text. As mentioned in another post (that the mods on acid seem to have gotten to), I highlight when I read. I don't know why, but it's what I do. I'm NOT copying, but tynt is still tracking me; the "cite your references" argument doesn't apply.

As far as just not using Wired.com, that completely ignores the fact that many other sites have this POS JS running; I first noticed it at the New Yorker magazine site.

Re:Kind of One Sided Review of the Service

[guido1]

The copy/paste/autolink behavior is not the privacy concern. I didn't read anyone here saying that it was.

The privacy concern is (from the summary): sends what you copy to Tynt's webservers...

So I, as a user of a random webpage, copy something for later pasting. That info, and my IP address, is sent to a third-party, theoretically for the purpose of appending a URL to the end of the text. Is that data also used for something else? Most likely. What company wouldn't try to make use of data it receives?

Since the same append functionality can be done trivially with some JS without contacting a home server, we immediately hop on the privacy horn.

Re:Kind of One Sided Review of the Service

[pdboddy]

Yes, it is Wired's content, but there are rules for fair use.

Some folks just use the highlighting part of copy to read.

Some folks copy and paste links to email themselves so they can find it later. Likewise some folks copy and paste articles, in part or in whole, to themselves to read later.

People do get annoyed when websites do things without saying such things are being done. Wired has every right to defend its content, however, it should do so in an open manner.

Re:Kind of One Sided Review of the Service

[fotbr]

Didn't notice anything on wired.com with either FF or IE.

Re:Kind of One Sided Review of the Service

[nbates]

As always, this will annoy the casual user, and expose him to security breaches, while being useless against those who want to do something bad like violating copyright.

It's like those stupid "right-click popup a copyright alert" javascript scripts. It is useless against web developers who are willing to steal source code or content, but it annoys casual users who just wanted to "Send page via email" to a friend.

Re:Kind of One Sided Review of the Service

[Anonymous Coward]

"but I will make the unpopular statement of saying that 1) you are copying and pasting Wired's content and 2) as early as high school I was taught that if I was copying information verbatim, I had better have some sort of reference (MLA preferred [cornell.edu])."

With such a citation, there is no legal or other problem with using such an excerpt. And for informal stuff or where the linkage is automatic (e.g., this post of mine that quotes yours is linked to yours via slashdot's comment system), it's unnecessary. If Tynt automatically added something like "Pasted from URL: http://... etc." to the text on the clipboard to help people avoid plagiarism, that would be genuinely useful and I'd have no problem with that aspect. Something like this packaged with configuration options would make a great browser plugin.

It's the tracking that bugs me. Why should you or, let's hypothetically say, the slashdot admins have any right to know that I did cut-and-paste part of your posting unless I make that quote public (e.g., by posting it myself)? If I want to cut-and-paste a bit of your prose into another file for whatever purpose (reading offline?), so what? As long as I'm not distributing it further, why does it matter? You publicly posted your comment and you expect that people are going to read and use it somehow. It's being copied off the /. server and onto people's machines everywhere. It has to work that way.

As for tracking who accesses a web page on a server and what's their IP or geographic location? Fair game. It's part of the delivery process and monitoring like that is expected. But exactly what I cut-and-paste on my computer screen once the page is delivered here should be my own business, not the server's. This tracking activity using Tynt is monitoring of user activities on the CLIENT side of things. It's a sneaky trick to embed JavaScript that monitors activity for reasons other than what is required to display the web page properly. I don't like it at all. At the very least its use should be disclosed on a web site.

What might be fun would be to write a browser plugin that would randomly crawl and cut-and-paste bits of a website to pull down the relevancy of this kind of information even if it is collected from the client.

Re:Kind of One Sided Review of the Service

[Anonymous Coward]

The copy/paste/autolink behavior is not the privacy concern. I didn't read anyone here saying that it was.

Neither did the grandparent. The summary complains that it's "utterly annoying, and how do I make that stop?" The complaint there isn't "how do I stop it from phoning home", it's "how do I stop copying with attribution".

The privacy concern is (from the summary): sends what you copy to Tynt's webservers...

So I, as a user of a random webpage, copy something for later pasting. That info, and my IP address, is sent to a third-party, theoretically for the purpose of appending a URL to the end of the text. Is that data also used for something else? Most likely. What company wouldn't try to make use of data it receives?

Since the same append functionality can be done trivially with some JS without contacting a home server, we immediately hop on the privacy horn.

Guess what? The moment that you load the JS file they know your IP and what page you're looking at. So do the advertisers. So does the content publisher. Complaining that they know you highlighted a specific sentence when they already know the content you're looking at is just splitting hairs.

Re:Kind of One Sided Review of the Service

[maxume]

Then that metadata should be appended to the part of the page that it is associated with (and then the browser can do the work of including it in the copied data), not retrieved from some third party site.

My way has the advantages of accuracy, speed and privacy (but speed probably isn't a real big factor, and like any data, it is only as accurate as the person creating it cares to make it).

Re:Kind of One Sided Review of the Service

[Chryana]

Most of the time, when I copy stuff from a website, it's for my personal use. I don't want or need my browser or any other program to guess what I intend to do with the content I copy and paste from a website. Furthermore, even if I wanted a feature like you're currently describing, I don't see any need for it to be done by an external website which I have absolutely no trust in. Finally, I use the clipboard very frequently to cut and paste passwords, so as far as I'm concerned, the clipboard has to be private. I'll keep my "wild wild west" internet like it is, thank you very much. Please keep your tagged and leashed internet away from me.

Re:Kind of One Sided Review of the Service

[dhTardis]

1) you are copying and pasting Wired's content and 2) as early as high school I was taught that if I was copying information verbatim, I had better have some sort of reference

• What if I see a phrase on Wired's site and decide to search for it on another site?
• What if I'm using someone else's machine, and the best I can do to defeat a potential keylogger is grab random letters from random places?
• What if I'm bookmarking their page and want some useful text for the description?
• What if I'm writing a point-by-point rebuttal and don't need to cite them after every quotation?
• What if I'm selecting a URL that isn't a hyperlink so that I can direct my browser there?
• What if I'm copying a quotation in their copy, and would prefer to cite the original source?
• What if I'm writing an email to a friend recommending the piece, and would like to include my favorite part as a hook?
• What if the article isn't written in my native language and I want to use a translator program on certain words?
• What if I want to copy a command into my terminal? (This is Wired, after all.)
• What if I'm doing statistics on journalistic writing and am feeding their prose into a calculator of the Gunning fog index? (Should I have to include a link to Wikipedia there because it's where I retrieved the name of the index? They don't own it.)

Provide an easy-to-use "cite us" link if you like, to encourage proper citation practice. But it is the height of narrow-mindedness to assume that you know what other people want to do with text you provide them, and of arrogance to assume that you know how to do it better than they do.

Re:Kind of One Sided Review of the Service

[jerryasher]

Hi,

I always attribute what I copy and paste. Frequently I copy more than one section out of an article separating each section within the quote with ellipses. What tynt does is add the URL to each and every copy/paste meaning I need to go back and find their little turds and delete them. Annoying. I'll do it myself thanks, and I do.

Adding that attribution doesn't mean the user will keep it there. So the site owner does little to nothing to help ensure his URL is attributed correctly by forcing tynt on us. But the site owner does annoy the good guys by doing that.

You don't need a server side round trip along with full text and IP address to add a URL to a block of text. Wired, if they were wired and not tired, could write that piece of javascript themselves, instead of opting all of their customers into tynt and privacy invasion.

Re:Kind of One Sided Review of the Service

[nametaken]

I do that too, and I think it's pretty normal. Maybe it's a focus thing. Maybe even a contrast thing... sometimes white on blue is easier to read for me.

As far as the parent post... I agree it would be nice if people could automagically cite their sources properly. That would be cool, but that's the sort of thing you want autoappended by a browser or browser extension, not some third, unrelated party that collects this info and surreptitiously controls what goes in your clipboard.

Re:Kind of One Sided Review of the Service

[JohnFen]

Lastly, I would like to point out that another solution aside from Ghostery or Noscript is just to not use Wired's site at all. Vote with your feet and bring your eyeballs elsewhere for pageviews and adclicks.

To be able to "vote with your feet," you have to know that the site is spying on you to begin with. The sites tend not to tell you, and it's a bit problematic to have to run every web interaction through a sniffer to catch the snoops.

The only realistic option is to block scripting.

The problem with Tynt, as others have pointed out, is not that they are "helping" us with attribution. It's that they are spying on what we highlight. Not what we copy -- although that would be bad enough (just because I copy it doesn't mean I'm republishing it) -- but what we highlight.

I actually believe that Tynt aren't trying to be bad guys here, but they're managing it just the same.

Re:Kind of One Sided Review of the Service

[Anonymous Coward]

If you think that people manually copying and pasting parts of your website is a threat to your business model, then I have bad news for you...

"bring [my] eyeballs elsewhere for pageviews and adclicks"

  You think I'm a bad person because I block ads, don't you?

Re:Kind of One Sided Review of the Service

[Anonymous Coward]

Unfortunately the submitter and editor of this site seem to cry privacy violation at any attempt to move past the wild wild west anything goes attitude of the world wide web. That's fine as this has an element of privacy concerns what with the phoning home. But please consider the issue from Wired's side, from the side of the author and content creators. They might just trying to help us with what we were taught in school.

The 'wild west' is what makes the internet valuable. Take that away and it becomes another form of cable television, censored, watered-down corporate-approved whitewash. Perhaps people shouldn't put stuff up they don't want copied.

Re:Kind of One Sided Review of the Service

[schon]

you are copying and pasting Wired's content

Wow, considering there are only 7 words there, it's amazing that you managed to fit at least four logic errors in there!

First of all, the text does not "belong" to anyone - Wired may (or may not, see point 2) have a limited legal right to prevent copying of the text, but that does not equate to ownership of the material - and it's dangerous to think that it does.

Second, the copyright doesn't necessarily belong to Wired - it could belong to one (or more) of their authors or contributors, or even one of their advertisers.

Third, this has nothing to do with copying. If you read the fscking summary, you'll see that this invasion of privacy takes place even if the text is never copied to the clipboard.

Fourth, as it has nothing to do with copying, it also has nothing to do with pasting.

Re:Kind of One Sided Review of the Service

[shutdown -p now]

That info, and my IP address, is sent to a third-party, theoretically for the purpose of appending a URL to the end of the text. Is that data also used for something else? Most likely.

There's nothing theoretic about it - they spell it out in large letters on their website. It's all about data mining first and foremost; autolinking is actually an optional add-on, and even then it's advertised as "driving up more visits" - i.e. it's a feature for site owners, not for end users.

Re:Kind of One Sided Review of the Service

[Anonymous Coward]

1) As mentioned this is "phoning home" when you're only highlighting - not just when you're copying.

2) There is no citation requirement anywhere for personal use.

3) MLA preferred? You must be a liberal arts major.

rho

Re:Kind of One Sided Review of the Service

[UberMorlock]

Of course it's a feature for site owners. The whole service is a service for site owners. Why does this confuse/surprise you?

Re:Kind of One Sided Review of the Service

[shutdown -p now]

It doesn't surprise me, but the person to whom I replied seems to be mistakenly thinking that there is some "beneficial" aspect for the community claimed by the service provider here.

Re:Kind of One Sided Review of the Service

[UberMorlock]

I don't see where Tynt is claiming that visitors to sites that use Tynt are their customers. The same thing is true of Google Analytics. These services exist for the site owners, not the visitors to those sites. Anyone who believes a site's visitors are the customers these services are targeting is simply deluding themselves in their arrogance and self-importance.

Re:Kind of One Sided Review of the Service

[Anonymous Coward]

Well, they do have the problem that the JS can only interact with your highlight and mouse clicks. It can't interact with their clipboard. So they _have_ to talk to the server at the time you highlight. If they wait until you hit Ctrl-C, it's too late.

Re:Kind of One Sided Review of the Service

[cybernanga]

as early as high school I was taught that if I was copying information verbatim, I had better have some sort of reference (MLA preferred).

This is perfectly true when you intend to quote the copied text in a paper or document you are writing that will be seen by other people. However, I often copy text from websites simply because I am interested, and want to keep a copy of an article locally, just in case something happens to the website.

Re:Kind of One Sided Review of the Service

[Anonymous Coward]

Your argument about sources and MLA is excellent food for thought. However, given how MLA ALA and others work, I'm sure we'd be better off with a solution which follows a standard for how this is done. It's pretty clear this isn't what tynt is trying to do given their implementation and the 'non-obvious' (ie: stealth) implementation of it on their client's web-sites.

However, as a browser/web standard this is something that maybe w3c should take a look at I certainly wouldn't mind making it easier to attribute work when I'm quoting or referencing it.

Re:Kind of One Sided Review of the Service

[Nyder]

I can't get it to work when I copy paste from Wired (must be something with my setup and javascript) but I will make the unpopular statement of saying that 1) you are copying and pasting Wired's content and 2) as early as high school I was taught that if I was copying information verbatim, I had better have some sort of reference (MLA preferred). ...

Maybe you should of read the article.

The problem wasn't with copying and pasting, the problem is that when you highlight something, it sends that info to tynt about what you highlighted.
Thats the privacy invasion peeps are complaining about.

hmmm

[xaositects]

seems like a CTRL+A, CTRL+C by a few thousand slashdotters might cause some issues.

It's insane, that guy's Tynt

[0xdeadbeef]

Noscript FTW.

X FTW

[d3matt]

Selection to alternate clipboard (or whatever it's called) doesn't suffer from this nonsense :D

Re:X FTW

[Anonymous Coward]

It's simply called the "selection", and you can take this mechanism from me when you pry it from my cold dead superglued hands.

In my entire computing life, it has been the one and only feature of anything I have ever used that I have never had a complaint about, thanks largely to Netscape/Mozilla/Firefox's continued support for middle-clicking in a window to go to the selected URL. (Without that, I'd have to erase the URL in the address bar and paste it there without accidentally hilighting the old URL, and that'd be a bitch), and is probably the second place mistake I make when using a windows computer (trying to middle-click to paste selected text... number one is using :wq in Word).

How Tynt.com says to avoid being tracked...

[landrew]

This from their FAQ - Technical Topics (http://www1.tynt.com/faq-technical-topics):

Q. How can I block Tynt Insight from monitoring my actions?

A. Tynt understands that some people are uncomfortable having events from their web browsing recorded in a database. We take your privacy concerns seriously and we are therefore investing considerable effort into developing a feature that will allow users to block Tynt software across all the sites that are using it, from within their own browser. Until we have this blocking feature ready, it is possible to achieve a similar effect by using one of the many ad blocking components available on the net. For Firefox users, we have found Adblock plus to work well, and Super Ad Blocker is effective for IE users.

I can't wait to download and install software they've written to help me block them from tracking me with their software. Good thing I'm using Ad Block Plus and NoScript while I wait, or they'd know I cut-n-pasted that...

Re:How Tynt.com says to avoid being tracked...

[clone53421]

AdBlock Plus filter:

||tynt.com

Re:How Tynt.com says to avoid being tracked...

[Nakarti]

This from their FAQ - Technical Topics (http://www1.tynt.com/faq-technical-topics):

For Firefox users, we have found Adblock plus to work well, and Super Ad Blocker is effective for IE users.

Good thing I'm using Ad Block Plus and NoScript while I wait, or they'd know I cut-n-pasted that...

Good thing you're such a flagrant moron that we shouldn't have to worry about you reproducing.

Re:How Tynt.com says to avoid being tracked...

[BitZtream]

You do realize they didn't make either one of those things you're talking about installing, right?

The irony is that you're bitching about installing 'software they've written' yet ... you then follow up with saying you using the exact software they suggest.

Are you really that retarded?

Re:How Tynt.com says to avoid being tracked...

[Boogaroo]

You do realize the reason he said "he can't wait" is because he's referring to whatever software that Tynt is going to release to block Tynt, and not referring to ABP or NoScript.

The GP makes the assumption that the option Tynt will provide is software. It might be another way that doesn't involve software. Tynt wasn't clear on what method they were use for the opt-out.

Re:How Tynt.com says to avoid being tracked...

[Anonymous Coward]

You're making the assumption that they develop software to do this. The best way from a will work in all browsers point-of-view, is to use a cookie with your preference and have the javascript check the cookie to see if it is okay to send the info back to the server or not.

Re:How Tynt.com says to avoid being tracked...

[naam00]

Read it again, GP is talking about the blocking feature they're promising to get going at some unspecified time in the future. Possibly as soon as they know enough about your selection behaviour.

But do keep calling people retarded. It's quite amusing.

Trolls?

[jgtg32a]

Does Tynt have multiple /. accounts or something? I've never seen so many posts marked Troll

Re:Trolls?

[Culture20]

It looked like two people used their whole 10 points each to mark every post Troll when the thread was young.

Re:Trolls?

[TyntGuy]

We're not a big company, and I can tell you I'm the only Tynt guy commenting here. Derek

Re:Trolls?

[mhelander]

Yes, but how about moderating?

Re:Trolls?

[Anonymous Coward]

a-ha, you're spying on all your colleagues or how else would you know that for sure?

Re:Trolls?

[Anonymous Coward]

Why are you doing this, Derek? Did you actually not stop to think that creating malware that captures activity that people consider to be private and the domain of inside-their-home is going to make a lot of people angry, and rightfully so? What else would you justify capturing if you could? The site that the surfer was at previously? I think that you and your ilk are a cancer on the Internet, and the sooner you and your company fail and go away the better.

Re:Trolls?

[Nyder]

We're not a big company, and I can tell you I'm the only Tynt guy commenting here. Derek

sucks to be you

Re:Trolls?

[Anonymous Coward]

How did you know his name?

All Your base are belong to us

[TibbonZero]

"Not cookie based, not IP based, but stop it you creeps angry phone call based. It ain't a pure useful service, and it ain't a pure privacy invasion. But I sure wish they'd go away and have had the decency to never start up in the first place."

Please tell me that the writer is either a non-native English speaker, or they didn't read that twice?

Re:All Your base are belong to us

[flyingfsck]

Och mon, the Ol'gaffer surely is Amerikin...

Re:All Your base are belong to us

[e2d2]

I just creep angry phone call based all over myself.

Re:All Your base are belong to us

[gstoddart]

Please tell me that the writer is either a non-native English speaker, or they didn't read that twice?

On Slashdot, the answer to an "or" question is almost always yes. ;-)

Cheers

Re:All Your base are belong to us

[elysiana]

It's not the most beautiful of prose, but it made sense to me. What are you missing here? Maybe I can fix it a bit...

"Not cookie-based, not IP-based, but 'Stop it, you creeps'-angry-phone-call-based. It ain't a pure useful service, and it ain't a pure privacy invasion. But I sure wish they'd go away and that they'd had the decency never to start up in the first place."

Does that help? Am I misunderstanding what you're getting at?

Does anybody else not care?

[Anonymous Coward]

They give me content, I give them data so they can make their website and their ads better suit my needs, personally I don't type out my secrets on random websites then copy and paste them else where, I love the cock, If this technology means that a website author can analyse their site and see that most people selected TLAs (probably to google them) and as a result next time they use a TLA they expand it the first time then i can only see that as a win, if they see that I selected "hustler for young gay men" (probably to buy it) then they can replace the text with an affiliate link to amazon and make some money, while saving me a copy/paste, then i see that as a good thing too. In fact i wish wikipedia would do this so that they linkify the words when people actually look them up not just the where the editor decided to put the link or every single time (that would make it a mess)

Re:Does anybody else not care?

[Lawrence_Bird]

I would not care if they simply appended the url without sending it to a central server first (though I do find it a bit annoying when cutting multiple small sections of text).

Equally as annoying is the NYT. I'm not sure when this change happened as I'm not a big user of their site but I can no longer highlight a word and google (or other) search via context menu on any page except their front page. Instead they want you to use their own reference search wish is decidely not the same thing.

Fiddler is helpful is monitoring a site...

[klubar]

Fiddler (HTTP Debugging Proxy) is a pretty cool tool for checking on what a site is doing -- and much easier and more useful than looking at the TCP stack). Fiddler works with any browser and acts as a proxy between the browser and the web. It's also scriptable.

Highly recommend Fiddler for keeping tabs on who your browser is talking to. (Also, indespensible for debugging ajax.)

Re:Fiddler is helpful is monitoring a site...

[SpaceLifeForm]

Fiddler requires Windows and .NET so it really
has little market as most Windows users have no clue
as to what is going on and do not care anyway.

Re:Fiddler is helpful is monitoring a site...

[colfer]

Firebug can show all connections as well. Sites like NYTimes.com load an amazing amount of Javascript these days, about 40 requests.

Re:Fiddler is helpful is monitoring a site...

[klubar]

Agreed that most users don't have a clue, with /. readers being the exception. Almost all Windows users have .net installed, and I was pointing out that Fiddler is a pretty powerful tool for understanding what's being loaded by your browser and debugging ajax code. I'm sure linux/mac/amiga users have something equivalent--and perhaps one of them will point it out.

hosts file seems to work

[jtroutman]

I seem to have stopped this by adding the following to my hosts file:
127.0.0.1 www1.tynt.com
127.0.0.1 tynt.com
127.0.0.1 www.tynt.com
127.0.0.1 w1.tcr112.tynt.com

Re:hosts file seems to work

[jtroutman]

and... fail. For some reason it stopped and has now started again. I'll look into it further when I'm back in front of a computer.

Re:hosts file seems to work

[Anonymous Coward]

You nullroute with 0.0.0.0
Don't use 127.0.0.1, it is loopback.

It is better and more effective to use 0.0.0.0.

Re:hosts file seems to work

[Binestar]

Turning off your computer stops it too. (confirmed here)

Re:hosts file seems to work

[Anonymous Coward]

You need to also block these:
tcr.tynt.com
wau.tynt.com

Re:hosts file seems to work

[Anonymous Coward]

On a related note and of interest to anyone thinking about following your flawed implementation of a good practice. From Wikipedia:

Often, the local (loopback) address 127.0.0.1 is used for such purposes, but has been proved and is also shown to be a poor choice because:
        * Some programs will run services on the loopback address.
        * If you are running a web-server on your machine, you will receive unexpected hits from the browser which may hinder your server development and maintenance, including performance (statistics may also be skewed). Besides, the server may react unpredictably if a different server is running on port 80.
        * Some programs which have to deal with local and remote traffic may act strangely or report errors (e.g. ICSI Netalyzr or NoScript) when external requests are redirected to the local address.
        * 127.0.0.1 tries to automatically connect to the dead-end destination which wastes a bit of unnecessary time and delays performance slightly.

A more suitable choice is to use a truly invalid address, for example 255.0.0.0, as they are automatically invalid as a TCP endpoint. Apart from the above benefits these truly invalid addresses also employ the same speed benefits too since communication is immediately dropped.

Re:hosts file seems to work

[elcheesmo]

I also had to add

127.0.0.1 w1.tcr62.tynt.com

I'm guessing that they have a huge pool of *.*.tynt.com addresses.

Re:hosts file seems to work

[The MAZZTer]

Use 255.255.255.0 instead of 127.0.0.1, then the connection immediately fails as an invalid IP address instead of being rejected by your own computer or timing out or connecting to your locally run webserver.

Re:hosts file seems to work

[Anonymous Coward]

neg { name=tynt.com; types=domain; }

Re:hosts file seems to work

[Anonymous Coward]

alternatively, you could clean it up with:
127.0.0.1 www1.tynt.com tynt.com www.tynt.com w1.tcr112.tynt.com

AC

Re:hosts file seems to work

[Anonymous Coward]

Confirmed here, t

WHAT HOSTS DO THEY USE?

[Anonymous Coward]

Please, we need to know ALL of the hosts that they use so we can add them to our hosts file.

Re:WHAT HOSTS DO THEY USE?

[icebike]

That is a losing battle. You can't keep up.

I use OpenDNS as my upstream DNS server. Even on a free account you can set up block lists which can kill off a LOT of those nasty word tag thingies that underline specific words and pop up things as your mouse crosses the word.

I can't be sure that it will block tynt.com (yet) but I've already added it to my block list which includes (and works perfectly for) many of the other annoyances:

chitika.net
contextweb.com
intellitxt.com
kontera.com
optmd.com
tribalfusion.com
vibrantmedia.com
tynt.com

Re:WHAT HOSTS DO THEY USE?

[Anonymous Coward]

Just install Ad Muncher and all the ones you named and more are blocked by default.

It even works for all browsers including chrome and opera.

http://www.admuncher.com/

Lets me remain sane while browsing.

Re:WHAT HOSTS DO THEY USE?

[icebike]

But you have to run admuncher on each machine.

One fix in opendns and the entire company lan is protected from this nonsense. Why sandbag each house when you can just plug the leak in the Dam?

Re:WHAT HOSTS DO THEY USE?

[Anonymous Coward]

You can install Ad Muncher on a single machine and let that machine act as the network gateway and then the entire network of computers will be filtered.

Also Ad Muncher allows whitelisting and fixes javascript errors which are common when blocking ad domains. You can't do that with the hosts file.

Ad Muncher also blocks the video ads at virtually every site on the planet including www.hulu.com and www.cbs.com and www.abc.com and www.nbc.com and www.youtube.com

well you get the idea. ;p

Re:WHAT HOSTS DO THEY USE?

[Anonymous Coward]

So you're the sysadmin I should blame when I can't get stuff to work because your overzealous filter works at the DNS level?

Re:WHAT HOSTS DO THEY USE?

[icebike]

Why Yes, yes I am.

And if you are trying to access any site I block we will hold the meeting to discuss this in the HR department where you will need explain why you need to access sites blocked by company approved blocking policy. After which, we will do an analysis of your hard drive.

Re:WHAT HOSTS DO THEY USE?

[Anonymous Coward]

Really, so if I go to Wired, there will be a meeting with HR because my browser tried to access tynt.com? Or did you forget the context of the conversation? I was not trying to make the argument that there's no use for that kind of blocking, only that it is not the best method for script blocking. What happens if your company starts doing business with Tynt? Then someone will be talking to you about why you are blocking your business partner.

Re:WHAT HOSTS DO THEY USE?

[icebike]

If you go to Wired and your browser tries to access tynt only the access to tynt will be blocked. Wired will show fine.

You DO have a basic understanding of how browsers work don't you?

If my company starts doing business with tynt I will get a memo from powers higher than you to that effect.

Re:WHAT HOSTS DO THEY USE?

[Reaperducer]

And if you are trying to access any site I block we will hold the meeting to discuss this in the HR department where you will need explain why you need to access sites blocked by company approved blocking policy. After which, we will do an analysis of your hard drive.

Wow, you're a real arrogant dickbag, aren't you? The next time you see an article on the internet about crappy egotistical IT folk, take a minute to walk down to the bathroom and look at yourself in the mirror.

Re:WHAT HOSTS DO THEY USE?

[k1t10]

I have to say i agree. I just work here, i don't make the policies. It's easier to let HR deal with people that think they should be exempt.

Re:WHAT HOSTS DO THEY USE?

[mlnease]

I use OpenDNS too as well as NoScript (is IPBlock relevant? I run it routinely) and, since installing Ghostery this AM (thanks, timothy) I've blocked eight of these--er--thingies that I'd no idea I hadn't blocked. Hmph.

Re:WHAT HOSTS DO THEY USE?

[slimjim8094]

You're using OpenDNS for your *company*??

Look, if you're going to screw around at the DNS level - don't. Use a proper transparent proxy that works regardless of what DNS server the user types in. And if you decide to anyway, at least run your own damn DNS server. It's really easy. Mooching off some free, questionable service is *not* a good idea for a business.

Re:WHAT HOSTS DO THEY USE?

[icebike]

I do run my "own damn dns server".

That's why i stated "I use OpenDNS as my upstream DNS server. ". The key word is "Upstream".

You can check that this is EXACTLY what I said here: http://slashdot.org/comments.pl?sid=1510934&cid=30770732

As for mooching, I pay of that service.

So, apologies are in order.

Quick and easy "plaintextify" for Windows

[terrahertz]

1) Copy desired formatted/linked/etc text to clipboard.
2) Windows key-R (opens Run box)
3) Ctrl-V (paste the text into the Run box)
4) Shift-Home (select the now-plaintext)
5) Ctrl-C (copy the now-plaintext)
6) Esc (close Run box)

I use this all the time when copying and pasting in Windows, and it works great for me.

Re:Quick and easy "plaintextify" for Windows

[Anonymous Coward]

When the average user does your step 1, all the text (and user info) is instantly sent to the spyware company.

Re:Quick and easy "plaintextify" for Windows

[Joce640k]

No good for /. readers - Model M keyboards don't have a Windows key.

Re:Quick and easy "plaintextify" for Windows

[clone53421]

I use Windows Notepad, because it works for multiple lines of text.

I'm torn on this one ...

[abbynormal brain]

We seem to be moving into a "corporate" model where everyone can use anyone's material without worry about plagiarism because - after all - it belongs to the company. The difference is, when I write a good piece of something for the company and it is re-used - I get paid. Not always so outside of corporate.

Concerning The Software and People Using It:
I don't think the software is evil. I think it helps those who do honest hard work. And if someone happens to choose this software and you don't like it, don't use their stuff. And if you do use their stuff, give them the goddamn credit.

Concerning These Types of Software:
And we should continue keeping companies like this in check by discussing them just like this. For now, we can still vote with our feet and wallets.

Concerning Hobbits:
Well, you know that story ...

in Opera...

[AliasMarlowe]

Just make sure that the option "Allow scripts to detect context menu events" is left unchecked (this is the default). Then you can select text/graphics/whatever, and copy operations via right mouse click are not observable by javascript.

In fact, javascript can't detect any right click actions in Opera unless you explicitly allow it. So copy, paste, translate, search, dictionary, encyclopedia, etc. actions can't be monitored by javascript in a web page.

This feature was in earlier versions of Opera as well, but the checkbox was named differently.

Re:in Opera...

[LordKazan]

having right click detection disabled breaks some very useful sites.. like Google maps

Re:in Opera...

[sconeu]

Then allow it in your site preferences for maps.google.com

Re:in Opera...

[freeweed]

Yes and no. It took my slow brain a while, but I eventually realized that when you right click in GM, and the context menu comes up, you can hit escape and it will go away - leaving the Google menu for "directions to here", etc visible.

Broken, but with a simple workaround.

Re:in Opera...

[LordKazan]

what would be nice is "3rd mouse button as 2nd java script mouse button" :D

Re:in Opera...

[Cylix]

Clever application designers will also allow you to skip their context menus by holding shift.

I would even go as to say it would be better if there were an auxillary site specific section within the context menu itself. A site could register the context specific items that would be access by that right click motion.

Now, everything is integrated and no hackery do is trying to thieve my context menus.

Re:in Opera...

[Sparr0]

I maintain public and private maps for a number of businesses, organizations, and events. I submit map data corrections both directly to google and previously to their map data providers on a weekly basis. I regularly use their walking directions and topographic maps to plan bicycle treks. I have implemented multiple business and gaming oriented applications including or built around the maps API. I am a Google Maps power-user...

And I never knew that there was right click functionality on the main maps interface. When I right click, I get the normal right-click-on-an-image context menu (View Image, Copy Image, Copy Image Location, Save Image, etc). What does that menu do for you? In what way is the site broken without it?

Re:in Opera...

[clone53421]

Directions from here
Directions to here
Zoom in
Zoom out
Center map here
What's here?

Re:in Opera...

[psithurism]

Then allow it in your site preferences for maps.google.com

Yes, but then you have to start a whole list of sites where you want right click detection allowed, among other rules to detect copy paste or whatever. Creating these exception lists always annoyed me and is only useful on the handful of sites you visit over and over again. Go to a new site and you are left wondering why certain features aren't working, until you remember to configure your allow lists accordingly.

Anyway, I never liked these lists as a solution.

Re:in Opera...

[zlexiss]

I just go to Block Content and put in an entry for *tynt.com*

Re:in Opera...

[JohnQPublic]

Yeah, this is why I love Opera. Firefox may have lots of add-ons, but Opera always does everything I need it to, right out of the box, and its defaults are extremely sensible.

Re:in Opera...

[Fjandr]

This thread is also the first time I've heard mention of right-click functions on Google maps. Zoom in, out, and recenter are all redundant because they're accomplished more easily other ways. For directions, I already know the start and end points, so using the map would take longer than simply typing them in.

The only function that's not easier or more intuitive to use some other way is the "What's here?" link. Then again, it's pretty much just a curiosity if I were randomly browsing a location on a map.

Guess there's a reason I never missed any of those functions, and will continue to not miss them.

Re:in Opera...

[Sparr0]

Is "What's Here?" anything like searching for "*"?

Re:in Opera...

[Anonymous Coward]

Funny. I say something similar about Firefox. Opera may have lots of...stuff?, but Firefox always does everything I need it to, right out of the box and its defaults are extremely sensible.

Re:in Opera...

[Fjandr]

No, less useful.

Pops up the latitude and longitude in the search field, but displays things that don't display if you search by lat/long specifically.

It shows photos and videos linked to locations, user-created maps that correspond to the area displayed, and a link to explore the area. For the most part it's stuff that's not very useful, as far as I can tell.

Re:in Opera...

[Sparr0]

Most of what you listed is on the [More] dropdown in the top right corner. I remain unimpressed, to the point of not bothering to figure out why I don't get the context menu in question.

Re:in Opera...

[Anonymous Coward]

From the summary: "there are some reports that it sends not just what you copy, but everything you select." So that may well not stop Tynt, if they see everything you select (which is a left-click action), then you get little benefit from blocking right-clicks, and you can't very well block left-click actions for javascript because it would break too much.

A comment from Tynt

[TyntGuy]

I work for Tynt. I appreciate the discussion here and want to make sure that everyone knows we want to be respectful of the opinions here. Not sure i I will get flamed just for wading in, but I hope not. To clarify on a few points 1. Tracking and Attribution – the attribution feature is separate from the tracking features. The tracking features work very much like any other analytics tool. We do not store any personally identifiable information, but we do want to help publishers learn what content people are choosing to preserve and promote. In addition, publishers can turn the attribution feature on or off on their sites. If you want to see what is actually collected - sign up for an account and look at the dashboard, you will see that we are tracking the content, not the user. 3. What if I don’t want this behavior? We are currently working on a global opt out for users who would rather not have Tynt monitor them. In the interim you can opt out on a site by site basis (i.e. the opt out for the SF Gate is here: http://www.sfgate.com/chronicle/faq.shtml#faq1.5%23ixzz0bxLIAbL7). More info on how to not have Tynt monitor you is available in our FAQs here: http://www1.tynt.com/faq-technical-topics#ixzz0bxGzIgPZ but as pointed out in the comments here, NoScript is a very effective tool for this. Derek

Re:A comment from Tynt

[Hatta]

we are tracking the content, not the user.

And when the content is personally identifiable?

We are currently working on a global opt out

Why not an opt in?

Re:A comment from Tynt

[Anonymous Coward]

What incentive do they have to make it an opt in? It's dumb to ask people to do things that won't benefit them. It's not like a few pissed off nerds are going to reduce their data flow significantly. You need to speak to actual incentives.

Re:A comment from Tynt

[Hatta]

What incentive do they have to make it an opt in?

None whatsoever, which is the point. If they actually believed that this service was something people actually wanted, they'd lose nothing by going opt-in. But, as few people would actually choose to have their clipboard tracked, there's a massive disincentive to going opt-in. I'd just like to hear an employee spin that in a way that doesn't sound unethical.

Re:A comment from Tynt

[clone53421]

How about scripting it with XMLHttpRequest so it invades people’s privacy in a less-annoying way?

*start.wav*, loading... every time I click is irritating as hell. I noticed it as soon as I tried clicking anywhere on Wired’s articles.

Re:A comment from Tynt

[Jeng]

If I was posting for the company I work for I would create a new account specific for the company I work for to post with. I would not use my everyday account.

I find his post rather credible and I don't see how old his login has bearing on the issue. I find his answer credible because of the argument made.

So, what is the reason that you are posting as AC? Just trolling are you?

Re:A comment from Tynt

[LordKazan]

A user shouldn't have to opt out of having slimeball tracking software. In fact, tracking software should have to disclose it's presence up front. Until you switch to Opt-in I blocked your entire domain at the firewalls I control.

Re:A comment from Tynt

[Anonymous Coward]

they aren't tracking your clipboard, they are tracking what people copy off the site. calm down and stop hyperventilating, nancy.

Re:A comment from Tynt

[ibpooks]

If you want to see what is actually collected - sign up for an account and look at the dashboard, you will see that we are tracking the content, not the user.

Doesn't signing up for an account with you kinda defeat the purpose of not giving you any of my information? Even signing up for your vaporware opt out gives you information about me that you will no doubt exploit in some way. In order to opt me out you need to be able to uniquely identify me.

Re:A comment from Tynt

[Anonymous Coward]

What they copy off the site, onto their clipboard. It's obvious what the parent meant. How about you calm down, stop acting like you're posting on 4chan, and think your posts through a bit more so you don't make yourself look like such an idiot.

Re:A comment from Tynt

[Dolohov]

I can't speak for anyone else, but I find a couple things wrong with this:
1) Like a number of people, I tend to highlight text as I read -- it's a good way to mark my place, and it helps overcome some of the stupid font and coloring decisions that sites make. That means you're not just telling publishers what I want to preserve and promote, but snippets of what I'm reading. That bugs me, and I can't imagine that it's useful.
2) Maybe you're not storing or tracking personally identifiable information, maybe you are -- I have no way of knowing. (I appreciate the offer of the dashboard access, but that's just what you choose to share) I have to trust you not to, and you are not behaving in a manner that makes me want to trust you: silently sending data? Asking me to opt-out rather than opt-in? Sorry, no. I've been to a couple of the sites mentioned here and had no idea that my reading habits were being monitored in this way -- that makes me feel like I'm being spied on, and I have to wonder what else you're doing that you just haven't been caught at yet. You guys launched without an opt-out, that tells me that you consider privacy concerns an afterthought.
3) Even if I trust you not to mistreat my data, how do I know that you're sending this in an intelligent fashion? I haven't done a TCPdump yet, but when I do, am I going to discover that you're sending what I highlight plain-text? Can someone who isn't you track me personally based on what you're collecting and sending? Is there any effort to make sure that the sites who use this are not being stupid and applying your tool to text on secure pages? How can I know without stopping and peering at the source for every page I visit?
4) If my choices are individual opt-out on your customers who are polite enough to offer it versus either blanket blocking or global opt-out, I'm going to have to pick global opt-out even if I don't mind the polite folks using it. Otherwise I have no control over how the less-trustworthy people use it -- as an opt-out service, your whole service is only as trustworthy as your least honest customers. And I cannot imagine that your customers who rely on ad revenue are happy to have you recommending that people who don't want to be spied on use an ad blocker.

I actually don't mind the attribution tool, I think it's clever and potentially useful -- but also something that could have been accomplished without tracking my reading habits.

If you want to be trusted and not "flamed", it's simple: make it opt-in, and give me a good reason to opt in. You make money off monitoring my browsing habits, maybe I ought to get a cut.

Re:A comment from Tynt

[Anonymous Coward]

And how did you KNOW we were talking about Tynt??

They're everywhere...don your tinfoil hats! ;-)

Re:A comment from Tynt

[Anonymous Coward]

Of course they'd lose something -- they're not marketing to the people whose clipboards they're scraping, they're marketing to websites who want information appended to copied text. Their service is going to be a lot more appealing if it works with most users instead of the tiny fraction that would opt-in (you say that "If they actually believed that this service was something people actually wanted..." -- what does that have to do with anything? They're not *trying* to make a product that "people" want. That's not their market).

I don't think it's necessarily ethical to scrape clipboards, especially without notifying the end user, but that's not an argument to get them to stop. Frankly, I'm a little shocked that this is a new service. Lots of websites have been aggregating selected text for a long time.

Re:A comment from Tynt

[Anonymous Coward]

I don't care. You're adblocked and noscripted anyway. My browser, my rules.

Re:A comment from Tynt

[wbav]

First, let me say I agree this should be an opt-in thing. Major websites, such as Wired should be very transparent about this as well.

That said, I'm concerned, (and while I may be off base here) that rather than reporting a vulnerability, Tynt went for profit. Not only can other people use similar techniques (especially since they have a blueprint now) but any patches are delayed that much longer. I suspect it won't be long until someone else exploits this for much more sinister purposes.

Re:A comment from Tynt

[thesolo]

Why not an opt in?

Do you really need to ask? Because no one would opt-in for it! But just do it without telling anyone, and most people outside of tech groups don't even know what it is or that it's operating in the background.

Quoth Grace Hopper, "It's easier to ask forgiveness than it is to get permission."

Re:A comment from Tynt

[Anonymous Coward]

Oh how I long for bygone days, before someone coined the phrase "opt-in", and then made it not an option the very next thing.

Re:A comment from Tynt

[kbg]

The problem is that you are a company. Therefore what any employee says now has no meaning or bearing on what happens in the future. You may well be very nice people and all and nothing is being done with this information now. However being a company means you can be bought, and those people that buy you can be evil and can misuse the information, hence you can not be trusted, ever.

Re:A comment from Tynt

[NeutronCowboy]

You make money off monitoring my browsing habits, maybe I ought to get a cut.

The cut that you get is the free access to information that cost money to gather, format and distribute.

Re:A comment from Tynt

[Blakey Rat]

We are currently working on a global opt out for users who would rather not have Tynt monitor them.

Why would you even LAUNCH this without a global out-out?

I mean, I don't really object to your service, but... well... what the holy fuck were you thinking in the first place? Even the seediest porn ad networks have global opt-out, it's virtually *required* when doing business on the web, and you need to walk into your boss's office right now and smack him for allowing that.

Re:A comment from Tynt

[Anonymous Coward]

Exactly. If this thing is being done in good faith, then why not make it obvious to the user. I don't see anything ethical about this technology.

Re:A comment from Tynt

[Anonymous Coward]

I can't speak for everyone here, but I suspect a lot of people agree with the sentiment - Get the fuck off our internet!

Re:A comment from Tynt

[kindbud]

No one has any right to change what my mouse does. Not right-click, not select, nothing. Period, end of story, this is not up for debate: You, personally, are doing evil.

Re:A comment from Tynt

[BitZtream]

Bullshit.

Anyone who has been around for any length of time knows its not uncommon to not realize how much you like something until you use it.

Did you know you wanted a web browser before they existed?

Did you know you wanted your OS to have a GUI before one existed?

Did you know you wanted tabbed browsing before anyone did it?

Let me answer for you, no, you didn't. It wasn't until you got those things and started using them, without opting in, that you realized you liked them.

Finally, it is opt in, don't visit the site using it. Its not hacking you and installing a service on your PC.

Please, get some perspective and soda.

Re:A comment from Tynt

[Whorhay]

That's not entirely true. Their customers whom they provide a service to is the site owners, not the users viewing those sites. They don't have any obligation to us as users. I would view their even working on a global opt-out as being very charitable. It's moot in my opinion anyways because anyone that doesn't want their computer zombified should already be using a browser configured such that tynt can't track it via this javascript.

Re:A comment from Tynt

[Anonymous Coward]

How about instead of creating some sort of opt out crap that mostly wont work 100% anyway...

You just give us a nice little list of all servers that anything will be sent to. ever.

And we can add it to our hosts file and pretend you don't exist at all?

It is the simple solution. And you could publish that list right now. As in right here on slashdot.

Re:A comment from Tynt

[whois_drek]

You're not the customer, the websites are. They have no reason to ask the visitors to the websites to opt in or out.

Re:A comment from Tynt

[The MAZZTer]

Why not an opt in?

Easy, no-one would. You have to give people incentive to lessen their privacy, unless it's happening by default and they just don't realize it.

Re:A comment from Tynt

[shutdown -p now]

Here's a question for you.

There is this concept which is called "reasonable expectation of privacy". Historically, it was reasonable to assume that any input on a web page was not private, but this has not been the case of highlighting. Tynt changes that, but how many users are aware of the fact that they're now sharing data when doing something as trivial as highlighting a few lines of text? What if the site they're browsing isn't explicit about it (I suspect that most aren't, tucking it somewhere on umpteenth page of their privacy policy, which is linked in tiny font from the bottom of the page)?

Don't you feel that you're committing a massive yet covert privacy violation against million of users (not legally, but ethically)?

Re:A comment from Tynt

[Anonymous Coward]

From the looks of it, they're sending a word count back to the server by requesting an invisible .gif file. The request doesn't seem to contain the text that's actually been selected, just the number of words selected. As far as user tracking goes, that's probably as innocuous as you can get.

However, it does report when you've selected text, not when you copy it. So it likely generates a lot of false data.

Re:A comment from Tynt

[Anonymous Coward]

whoops, you forgot to click 'post anonymously' there retard. btw, nice karma bonus fuck-knuckle

Re:A comment from Tynt

[Dolohov]

If that's what they consider a fair trade, fine: Then they can damn well say forthrightly that that is the cost, instead of hiding it. Let me make the decision of whether reading their rag is worth being spied on.

Re:A comment from Tynt

[Dolohov]

A simple word count would be fine by me; I must have misunderstood the fellow from Tynt when he said they were "tracking the content, not the user", as I thought he meant that they were indeed sending text.

Re:A comment from Tynt

[Anonymous Coward]

I work for Tynt.

Hopefully not for long. This is one of those times for a gut-check. Your company is evil. I'll let other people make my case in logic.

Re:A comment from Tynt

[Anonymous Coward]

So is one's hosts file and firewalls, even better, it makes everything from your company disappear, which upon hearing this, is my preference.

If companies such as yours are going to insist on going the opt-out route instead of opt-in like you should, then when I opt out, I do it in a big way and I bring all of my client's with me while I'm at it too.

Re:A comment from Tynt

[mcon147]

Opt-out? Oh wow, that's so nice. It's very clear that no regular person actually wants to be subjected to your company's "service". If I ran a company that went through your trash (you know, to track the content...) before the collectors came to get it, you'd probably be rather annoyed to find out that it was opt-out.

Re:A comment from Tynt

[Anonymous Coward]

How is content ever personally identifiable? It isn't *your* content that is being tracked. If you are so worried about the content you view being linked to you, then I suggest not viewing any content.

Re:A comment from Tynt

[Tim C]

Why not an opt in?

Because nobody would, obviously.

Re:A comment from Tynt

[Tim C]

i.e. the opt out for the SF Gate is here: http://www.sfgate.com/chronicle/faq.shtml#faq1.5%23ixzz0bxLIAbL7

I clicked on that link, then opened the AdBlock Plus console. One of the blockable items is indeed a script served from one of your servers (r1.tcr60.tynt.com). However I notice that the URL of this page is appended to the URL of the script - the full link is

http://r1.tcr60.tynt.com/a/v/0bxLIAbL7?site=ad1_AICmWr3PaXab7jrHtB&url=http%3A%2F%2Fwww.sfgate.com%2Fchronicle%2Ffaq.shtml%23faq1.5%2523ixzz0bxLIAbL7&referrer=http%3A%2F%2Fyro.slashdot.org%2Fstory%2F10%2F01%2F14%2F1818222%2FTynt-Insight-Is-Watching-You-Cut-and-Paste%3Fart_pos%3D16

The same is true of your second link, there's a script referenced in the page with the URL of this page as part of the query string. So you're tracking referrers too. No offence, but this is starting to look shadier and shadier the deeper I dig.

Re:A comment from Tynt

[Anonymous Coward]

This isn't a vulnerability, it is making use of a feature of JavaScript. To make it clear, they aren't copying anything from your clipboard, just what you select on websites their JavaScript runs on. There is nothing to be fixed. If you think there is then you should be running NoScript because JavaScript is inherently insecure.

Re:A comment from Tynt

[Anonymous Coward]

If you want to see what is actually collected - sign up for an account

This might actually help you to make hitherto anonymous information identifiable. I wouldn't know.

  We are currently working on a global opt out

What gives you the right to opt-in the whole world? What you do may be fine in the US but it's at least questionable in my country.

Why wasn't an opt-out available from day one? I am still subscribed to one newsletter which promises that unsubscribing will be implemented real soon now. With e-mail, I can at least set s.th. up to shove their newsletter, erm, back to them until maybe they unsubscribe me. At least support your claim by a real-world date when unsubscribing will be available.

Fortunately I noticed Tynt due to a bug with an old browser. At first I thought the site had been hacked and banned it. Their loss and yours.

Re:A comment from Tynt

[Nyder]

I work for Tynt. I appreciate the discussion here and want to make sure that everyone knows we want to be respectful of the opinions here. Not sure i I will get flamed just for wading in, but I hope not.

To clarify on a few points

1. Tracking and Attribution – the attribution feature is separate from the tracking features. The tracking features work very much like any other analytics tool. We do not store any personally identifiable information, but we do want to help publishers learn what content people are choosing to preserve and promote. In addition, publishers can turn the attribution feature on or off on their sites. If you want to see what is actually collected - sign up for an account and look at the dashboard, you will see that we are tracking the content, not the user.

3. What if I don’t want this behavior? We are currently working on a global opt out for users who would rather not have Tynt monitor them. In the interim you can opt out on a site by site basis (i.e. the opt out for the SF Gate is here: http://www.sfgate.com/chronicle/faq.shtml#faq1.5%23ixzz0bxLIAbL7). More info on how to not have Tynt monitor you is available in our FAQs here: http://www1.tynt.com/faq-technical-topics#ixzz0bxGzIgPZ

but as pointed out in the comments here, NoScript is a very effective tool for this.

Derek

thats all good and well.

Except:

What happens when the owner of Tynt decides to sell the company? Is the new owner going to keep doing what you say your doing?

We are talking about the tech world, where new startups get bought up left and right.

how about if someone happens to copy and paste something that isn't legal in possible the USA but is okay in another country. You going to give up all the info on the person at the request of the law enforcement?

Honestly, I don't like how you choose to make your paycheck. I seriously hope this sort of business model doesn't pan out, and that you, well, go broke, and do the honorable thing.

Re:A comment from Tynt

[Nyder]

You make money off monitoring my browsing habits, maybe I ought to get a cut.

The cut that you get is the free access to information that cost money to gather, format and distribute.

Please, that is pure bullshit.

tynt didn't gather, format, or distrbute jack shit.

But they want your info about what you highlight, not what you copy and paste, but what you highlight.

Re:A comment from Tynt

[NeutronCowboy]

Who do you think Tynt is paying? Yup, the content providers. They either pay you, or they pay the content providers. If they pay you, they aren't paying the content providers.... who won't be able to provide the same content.

Comprende?

Re:A comment from Tynt

[PAStheLoD]

How exactly is this spying? They, at best, have your IP, some text and a few cookies from that domain. What could anyone do with the fact that you've been reading this and this at some site?

It's not like someone is constantly sending your passwords to a 3rd party. It's as harmful as someone seeing you read the news as you commute, wait at an airport, etc..

(NYT uses something similar; they seem to try to block blacklisted users from copying their text.)

Re:A comment from Tynt

[Dolohov]

Spying on trivial crap is not the same thing as not spying. For what it's worth, I also object to being followed in department stores to see what hats I try on, or videotaped on the street to see what shop windows I look into. Just because I can't off the top of my head think of some nefarious use for the data does not make it OK to collect it without my permission.

Re:A comment from Tynt

[Anonymous Coward]

You're picking a fight with AC?

Do you have the slightest idea of what you're doing?

Re:A comment from Tynt

[Anonymous Coward]

Your service is the worst kind of shit, and I've blocked it.

When some clever script kiddie bashes together something to fill your servers with garbage data, your company will die. You have no sensible way to defend against this, since you rely on self-reporting from end-user browsers. The script can just load itself up with text from the sites you monitor, and let it rip. Get the 4chan kiddies to run the script for the lulz and you're gone.

Terrible Summary

[RealErmine]

Not cookie based, not IP based, but stop it you creeps angry phone call based. It ain't a pure useful service, and it ain't a pure privacy invasion.

This is barely English and is a grammatical cluster-fuck. Come on editors, read past the first two lines please.

Re:Terrible Summary

[clone53421]

Not cookie-based, not IP-based, but “stop-it-you-creeps”-angry-phone-call-based.

Happier now?

No big deal

[Anonymous Coward]

Sites already track which page you're looking at, so we're quibbling about which bits of content are more meaningful to you. If it bothers you that sites are tracking which fragment of a page you're copying, either disable scripts or save the source and muck with it offline. If the part that offends you is the added hyperlink, just delete that after you've pasted. It's a convenience for webmasters and for bloggers who want to quote bits of a site with automatic attribution. You do want to credit your sources, right?

Mouse clicks

[QuoteMstr]

A website can monitor practically anything it wants. One idea is to record the user's mouse movements and report the areas he mouses-over the most (presumably for site optimization).

Incidentally, this is one reason Flash is evil: Flash provides 1) hidden cookies, and 2) clipboard access. It's evil.

Makes so much sense now...

[FreakinSyco]

This must have been placed on a bunch of websites recently. I'm a habitual "highlight as I read" person. I noticed a couple months back that quite a few websites started the FireFox activity indicator spinning when I highlighted (New York Times included).

I wonder how much useful information this "service" is actually providing to content hosters. I must send dozens of small chuncks of text every time I read an article.

Can I disable this through AdBlock?

Re:Makes so much sense now...

[clone53421]

||tynt.com^$third-party

Or subscribe to the EasyPrivacy list, since it contains that filter already.

Re:Makes so much sense now...

[mozzis]

Also IE7Pro for IE users

Re:Makes so much sense now...

[clone53421]

Also http://www.getfirefox.com/ for IE users

FTFY.

It's a Feature

[ffejie]

I don't understand what the big deal is. I'm stealing someone's content to quote verbatim in an email, or something like that, they have the right to know they're being quoted. Maybe not the "right", but they should have the ability.

I also like that it recently added the trackback URL below the text I was copying. This is something I usually do when I send a quote to someone, and this saved me step. Pretty cool feature, if you ask me. I could see how it would be annoying, but it can also be handy.

Re:It's a Feature

[JohnFen]

I don't understand what the big deal is. I'm stealing someone's content to quote verbatim in an email, or something like that, they have the right to know they're being quoted. Maybe not the "right", but they should have the ability.

No, they shouldn't. First of all, it is perfectly possible, and extremely common, to quote someone's content verbatim and still remain within both the letter and the spirit of the law. It's called "fair use." (Even if you are engaging in copyright violation, yuo are NOT "stealing" anything, either legally or ethically. You are breaking the law, but a different law.)

The content creator has no natural right to track all uses of that content. If I quote a paragraph in an email as part of a larger discussion, the original author has no right, and should not expect, to be notified about it. Period. If a mechanism is installed that notifies the creator without the participants being aware of it, that is spying and that is evil.

(I know that tynt doesn't spy on email, I'm just running with the commenter's example.)

Re:It's a Feature

[ffejie]

Good points all around, especially legally speaking.

Considering you've correctly evaluated that the legal argument is bunk, would you consider that it's not actually hurting the end user?

Someone knowing that you're copying text and analyzing that is not actually preventing your fair use of the content. They are also not demanding payment for this content, so what is the end user concern?

Re:It's a Feature

[JohnFen]

Someone spying on me is harm, even if it doesn't directly cost me money or stop me from engaging in activity. Harm comes in a lot of flavors.

Would you argue that it is harmless for entities to observe your every move even if they do not prevent you from engaging in legal behavior? I believe it is not harmless, that such surveillance does great harm to the social fabric, as well as simply being immoral.

Re:It's a Feature

[ffejie]

I think the best comparison would be something like a mall, or a big department store. While I'm on private property, shopping in their facility, I expect to be monitored. Conceivably, they can observe my every move, notice that I try on some pants, then send me a notice next time those pants go on sale. Pretty creepy, yes, but useful for both entities. This also assumes that they can identify that this is me as opposed to "shopper #1". I expect stores to collect information like: "people are stopping and looking at this display with lots of bright colors."

I think we need to consider browsing a webpage on a domain as similar as being on someone's private property. How is this different from a company monitoring that this page gets more click-throughs than that page? Monitoring what is being selected allows them to see what the really interesting parts of the story are.

I explicitly reject that such monitoring is immoral.

Re:It's a Feature

[JohnFen]

I think we need to consider browsing a webpage on a domain as similar as being on someone's private property. How is this different from a company monitoring that this page gets more click-throughs than that page? Monitoring what is being selected allows them to see what the really interesting parts of the story are.

When I go to a page and download it to my computer to be viewed, which is what a web browser does, I have visited the "private property" and understand that the web site has a record of what I've done -- which is to download their page.

However, once I have the page I am no longer on their property -- I am on my own private property now, and they no longer have any right to record my activities. To use the shopping center analogy, what Tynt is doing is like putting a tiny camera on a piece of merchandise and then reporting what I'm doing with it when I get it home. Although in the case of Tynt, it's even worse because they are using my own computer (my own private property) to engage in the snooping. That's highly objectionable to me, but not necessarily immoral per se.

The immoral part is when this is done without my knowledge, as it is with Tynt. If I could know that such a system was being used then I could choose whether or not that was something I was OK with. Keeping it secret means I am deprived of that choice. Even shopping centers have signs disclosing that they are watching you.

Or, to summarize...

[marcsherman]

Taint: not quite assholes, but pretty close.

Re:Or, to summarize...

[bdwoolman]

I am very surprised to see how many posts went by before somebody noticed that the name of this firm was an alternative spelling to 'taint'. Kudos.

Now. That is not a name I would ever want on my business card. So even though these guys are dorks we can all be comforted that none of them are getting any dates. Oh wait! This is Slashdot. Never mind.

Privacy invasion?

[Registered Coward v2]

OK, I'll probably be in a small percentage of /.'rs here; but I don't see how this a privacy issue. According to Tynt Insight's page, no individually identifiable info is provided. It seems reasonable, to me, for a website to want to know what information is actually of interest to viewers; this provides a tool get that information. I realize some people want to be absolutely untrackable and anonymous when surfing; but I happen to think site owners have a right to implement tracking tools as they see fit, and users can chose wether or not to visit a site or to use blocking tools. Ghostery blocks doubleclick on /.; should we be offended that /. tries to make money off their site?

Re:Privacy invasion?

[LordKazan]

"According to Tynt Insight's page, no individually identifiable info is provided."

apparently you don't know how things work... IP address + "list of search topics" is enough to personally ID someone even if they never search for themself or a relative.

IP Address + "things they've highlighted" have a very high probability of being able to do that too

Re:Privacy invasion?

[shutdown -p now]

I happen to think site owners have a right to implement tracking tools as they see fit, and users can chose wether or not to visit a site or to use blocking tools.

I agree, but with one correction: the users have the right to know that they're being tracked, so they can use blocking tools as they see fit.

So far as I can see, this isn't the case with Tynt, as it's possible to configure it such that it just reports selection, and doesn't do autolinking. Yeah, a techie can check page source and find the script reference, but that accounts for what, 1% of all people surfing the Web?

Stuff like that should have a prominent notification before it starts tracking, so that I can leave the site that wants to do that (or block it to the best of my ability).

Re:Privacy invasion?

[Registered Coward v2]

"According to Tynt Insight's page, no individually identifiable info is provided."

apparently you don't know how things work... IP address + "list of search topics" is enough to personally ID someone even if they never search for themself or a relative.

IP Address + "things they've highlighted" have a very high probability of being able to do that too

OK, so explain it to me.

IP address plus list of search topics would be able to say "this particular person has interest in this," or "these searches were all done by the same person;" but I fail to see how that says "this is person X." A static IP address would help someone garner more information; but that only means the source, not the individual, is the same for the searches.

To use the required /. car analogy, knowing that a car with a certain tag was seen at x y, and z does not tell you who was there; but you can infer it probably was the same person (although that may or may not be true.)

From what I can see from Tynt's website they do not provide specific IP addresses, which means you'd have to tie Tynt's info to IP logs, even further adding to the uncertainty of who did what. Do they provide IP address with their info?

So, from where I sit the statement "no individually identifiable info is provided" is true; although I would agree the info could be used to build a profile of what users do.

Civil Disobedience

[Anonymous Coward]

To me, this would just prompt me to write a small script that randomly selected text on a page, copy, repeat... and let it spam their servers all night. Eventually, one would hope, with enough people sending in trash data, they would get the idea to KNOCK IT THE FUCK OFF.

Just my 2 cents.

As someone who compulsively selects...

[CAIMLAS]

As someone who compulsively selects articles as i read them (repeatedly and randomly) let me just say I'm glad to see that my compulsive behavior is corrupting their 'service'.

Re:As someone who compulsively selects...

[UberMorlock]

I don't view you as corrupting their service. Instead, you are providing exactly the kind of information that I'm looking for as someone who uses Tynt. I doubt your highlighting is exactly random, as you are reading the text you've highlighted at some point. If you're repeatedly selecting text, then that tells me you are lingering in that area of the content, which means that either I need to improve it and make it more clear or you find that information particularly interesting. The tricky part is determining whether you are particularly interested in the content or if word choice+sentence structure+order of information presented+etc is impairing comprehension.

What Tynt Does

[Anonymous Coward]

--- request url ---
http://w1.tcr112.tynt.com/a/t/2?guid=0ccFYZWUT&total=1&_charset_=UTF-8&site_guid=ac4i_23GOr3QjHab7jrHcU&name=Google%20Fights%20China%3B%20Will%20Yahoo%20and%20Microsoft%20Follow%3F%20%7C%20Epicenter%20%7C%20Wired.com&word_count=2310&first_type=1

--- request headers ---
Host: w1.tcr112.tynt.com
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Pragma: no-cache, no-cache
Referer: http://www.wired.com/epicenter/2010/01/yahoo-microsoft-china/
Cache-Control: no-cache

--- response headers ---
Date: Thu, 14 Jan 2010 19:18:17 GMT
Server: Apache
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false
Expires: Sat, 26 Jul 1997 05:00:00 GMT
Last-Modified: Thu, 19 Nov 2009 22:52:50 GMT
Accept-Ranges: bytes
Content-Length: 42
Connection: close
Content-Type: image/gif

Taken from Wired.com's page on the Google/China story, ironically enough... as for me, I think I'll keep tynt.com OFF the list of sites that NoScript allows.

Incidentally, it's obvious in Firefox that something weird is going on, as you can see the data transfer happen in the status line.

Oh, come on now!

[Anonymous Coward]

Everyone knows that if you save text from a web page to your machine to read it later (or have text-to-speech read it to you) that is blatant STEALING! I mean come on, you're accessing the content without being exposed to the ads on the page! :)

On a serious note, thanks for giving me another reason to disallow javascript.

I've seen instances where right-clicking was not allowed on a given page. Too bad for the Nazi that implemented that, because we can just use ctrl+c.

I'm in ur clipboard...

[noidentity]

...watching ur copies

Re:hosts file ... Tynt is watching

[b4dc0d3r]

You post a hosts-based solution, then it stops working. Combined with this post linked below, I'd say Tynt is trying to supress data. Or that someone is trying to make it look like they are.

Chances are if you add another round of entries, they will mysteriously stop working again. It's like Tynt knows when someone copies info from their FAQ page, or something. Eerie.

http://yro.slashdot.org/comments.pl?sid=1510934&cid=30768510

selectitis

[bencoder]

Hah. If it's just based on selection then they are going to get some really shoddy results from me. I appear to have selectitis... while reading text on a page I randomly select and deselect parts of the page. I'm not sure why, it's just like a nervous tick in my hand and I can't help it. It's not related to the part I'm reading.. normally the selection is above or below where I'm reading.

Intercepting keyboard shortcuts

[Anonymous Coward]

I've long wished the browsers would offer an option to stop pages (including plugins) from intercepting important keyboard shortcuts. Every now and then I run across a site that intercepts Alt-D or Ctrl-E (and/or ctrl-k and ctrl-l), and they're annoying as hell. Having to put my hand back on the mouse to click the address bar when I'm already ready to type the new address I want feels like the site is trying to stop me from leaving, one step short of a "Are you sure you want to navigate away from this page!?" popup. And in almost every case it's either a gimmick by someone who apparently didn't know those shortcuts existed, or it's done in the name of 'accessibility', which I am all for right up to the point that the page is less accessible for me.

The browsers do (at least in current versions of FF and IE) ignore 'accesskey' attributes that conflict with their shortcuts, and NoScript helps with Javascript captures, but I still haven't found a way to get important browser shortcuts to be passed through Flash (ie, youtube).

Obfuscation on one of the big lyric sites

[tepples]

The simple fix I use is to Ctrl-U/View source and copy from that window.

I've seen one lyric site that thwarts this by encoding every character of each song's lyrics as a numeric character reference (for example, hello for hello). It expands the size of the markup, but for one thing, that's what mod_gzip is for, and for another thing, obfuscation of View Source makes it that much easier for sites to keep their licenses from the music publishers.

Re:Obfuscation on one of the big lyric sites

[Lunzo]

That's where Perl comes to your rescue!

Let it be

[iamacat]

All the posts here are focusing on defeating the script with technological measures. But basically:

1. You get to read wired for free
2. You get to copy sections of their articles and post them to your own blogs
3. All wired gets is increased chance of attribution (you could still delete the link after pasting) and anonymous statistics on which portions of their stuff people found interesting.

This is much less invasive than paywalls, disabled mouse right clicks or excessive popup/over/under ads. In fact, if you are cool with google analyzing your goat pr0n queries, you should be cool with that because only someone else's thoughts are captured rather than yours. If we want to enjoy good quality free stuff on the web, we should learn to live at least with moderate wishes of its creators.

Re:Let it be

[LMacG]

OK, this is a wacky idea, I know, but next time, how about READING THE FORTY-FIVE MINUTES WORTH of posts that are sitting in front of you. The script reports what's been highlighted, not just what's been copied. And it's not just Wired. And even if I do copy the text, it's MY clipboard.

Dick.

Re:Let it be

[Fantastic Lad]

1. You get to read wired for free
2. You get to copy sections of their articles and post them to your own blogs
3. All wired gets is increased chance of attribution (you could still delete the link after pasting) and anonymous statistics on which portions of their stuff people found interesting.

You have it all backwards. Yes, industry (and slave-masters) would very much like everybody to think that way, but really it works like this. . .

1. Wired is able to exist because your attention holds value. They OWE their entire existence to you. You are the prize, not them.
2. The material they give you is payment for the time and attention they extract from you.
3. By controlling and tagging your time and attention, they are attempting to increase the value they extract from you without increasing the value of the material they offer in return. Since they do so without your consent, (and why should they? The web is free range, after all.), then there is no reason to feel any sort of guilt in disabling their little tracking device in order to protect your value.

You owe them nothing, but they are the honey trap; just showing up is payment enough. And you cause no danger to them in showing up, where by contrast, tracked data can be used to cause harm in a very real way.

-FL

Re:Let it be

[iamacat]

Please explain what value Wired gets from my time and attention unless I click on ads, subscribe to printed magazine and so on? If I post a portion of their article on a blog without attribution, they are deprived of this possibility for a portion of readers of their work. This may or may not be illegal or enforceable, but it seems enabling the behavior by default is not that draconian.

tracked data can be used to cause harm in a very real way.

How?

Re:Let it be

[iamacat]

It's a very wacky idea to spend 45 minutes reading each slashdot article. Or to randomly highlight the text without doing anything with it. On the other hand, if you post it in a blog, it's THEIR text, so an attribution by default seems warranted.

Re:Let it be

[Fantastic Lad]

Please explain what value Wired gets from my time and attention unless I click on ads, subscribe to printed magazine and so on?

Well that's a rather rhetorical waste-my-time kind of question. Surly you grasp that "eyeballs" are bought, sold and generally coveted in the ad industry. You don't have to act directly on an advert for you to have delivered your value simply by seeing it. --By increasing the percentage of possible click-throughs an ad may receive, your presence increases the value. There's a reason ads during the Superbowl cost a gazillion dollars and late night ad spots on local cable channels are as little as a few hundred bucks.

But static eyeballs are one thing; they have even more valuable if they can be labeled and tracked. If somebody knows your psychological profile, income level, cultural background, sex, education and general interests, etc., then the value of your eyeballs increases. But you know that already.

If I post a portion of their article on a blog without attribution, they are deprived of this possibility for a portion of readers of their work.

"Deprived?" Seriously? You're trying to make them sound like victims because the knowledge they put into the world happens to spread according to the naturally efficient systems developed through evolution over millions of years? Why is it that conservative business types seem to be locked in a permanent pitted battle against the very backbone of reality? (Actually, I know the answer to that, but it may be something for you to ponder between prayer studies.)

Okay. . .

First of all, this is just another banal argument in favor of locking down the flow of knowledge and information, keeping poor people uneducated and various other nasty things. I have little patience for anybody who has chosen to fight for a world where greed and fear of want trumps human awareness. The more we know, the stronger we are as a species, whereas the dark side wants us to remain stupid and easy to manipulate and generally enslaved. Intent is the key here, and every argument which INTENDS to increase slavery is just a semantic bit of bullshit which adds to the pile of human misery. To make such an argument, in essence, declares that in order to avoid the fear (just the FEAR) of not having enough for the self it is okay to make sure that others live in deprivation. This is the essence of reptilian brain thinking versus the higher brain functions we are capable of as a species. Those who want us to go back to sleep versus those who want us to wake up as fully as possible.

Secondly. . , Wired is, without asking permission, selling knowledge of you to advertisers. Why is it okay for them to do this when it is not okay for you to share the knowledge you glean from them?

Thirdly. . , your example is just plain silly. It has no bearing on anything. If information is cut and pasted from an on-line magazine and re-published whole cloth in a blogging effort somewhere, then for that information to hold validity, the blogger is going to add a link back to the source in order to be taken seriously. Heck, if it doesn't contain a link, then it is plagiarism and there are a whole set of laws which come into play during such an event. It is simply not the issue in question.

And finally. . , if you REALLY have to ask how tracked data can be used to cause harm, then you have been living under a rock for more than a decade. Please don't waste my time with such deliberately ignorant questions.

-FL

Hell yeah!

[argent]

Oh god yes, and it shouldn't be possible for javascript to intercept things like right click at all.

Adblock Plus and

[landoltjp]

Another site I read mentioned that it's blocked in the AdBlock Plus EasyPrivacy subscription. https://adblockplus.org/en/subscriptions

I added that subscription and it worked like a charm

wondering

[KharmaWidow]

so after reading a mess of comments here I wonder if they are storing the content with an ip or just processing it and pushing it back? Yes, this is a privacy concern, but so is copying copyright protected works. A random web surfer should be covered by Fair Use... but what if the entire document is copyied. (I do this when I know the source takes it off the web at a later date - mostly for discussing politics. I hate it when my sources disappear.)

We are never truly anonymous. Web server logs store every item we view and our ip address. I am not sure how this is a greater intrusion.

Re:wondering

[shutdown -p now]

Yes, this is a privacy concern, but so is copying copyright protected works. A random web surfer should be covered by Fair Use... but what if the entire document is copyied.

If the entire document is copied for personal use via a clipboard, what's the problem?

And this thing doesn't even track clipboard copying. It tracks selection.

Noscript FTW

[fast turtle]

I've been using Noscript since forever dude. Sure it broke lots of things to start with but that's finally settled down as I've built up my whitelist of allowed websites. The important thing is to block all by default then whitelist as needed and that prevents crap like this from happening in the first place.

DomainCage

[Anonymous Coward]

The firefox extension DomainCage looks promising, unfortunately, it doesn't seem to work for me? Anybody else have it working?

Privacy Policy

[saaaammmmm]

Check out Tynt's privacy policy. The "Information obtained by virtue of your visiting TYNT web sites" section is particularly interesting. http://www1.tynt.com/privacy-policy

Make it play nice.

[pubwvj]

Turn off Java, Javascript, plugins. The web is so much nicer without those. Turn them on for sites you want them on. Machete them. Use something like Pithhelmet for Safari to hack the web back to your specs. Works for me.

Am I Missing Something?

[MyFirstNameIsPaul]

Even with ABP disabled for wired.com NoScript doesn't report a tynt.com script.

Re:Am I Missing Something?

[ColdWetDog]

Even with ABP disabled for wired.com NoScript doesn't report a tynt.com script.

Even with ABP enabled, on Firefox 3.5.7, OS X 10.6.2 - I'm blocking tynt (and metric shitload of other scripts.)

Really, Wired - that's impressive: google-analytics, twimg.com, amung.us, sharethis.com, tynt.com, facebook.com, brightcove.com, reddit.com, digg.com, yimg.com, tweetme.com, the ever present doubleclick.net and finally, wired.com.

If this isn't a record in it's own right, it should be enough to give you at least a cookie. Or a dog biscuit.

Re:Am I Missing Something?

[MyFirstNameIsPaul]

mercurynews.com is pretty bad, too.

I'm on XP using FF 3.5.7 and I don't see tynt in the NoScript menu. Seems odd. I even tried allowing globally just for the Wired page and still didn't see any scripts from tynt.com

Re:Am I Missing Something?

[Logic Worshipper]

Fuck no, their cookies are denied too!

Web browsers should work on a default-deny basis for everything but html.

Re:rename extension.xpi to extension.zip ... profi

[clone53421]

Why bother to rename it?

7zip / Winzip open up the .xpi just fine.
7zip will even open nested archive files inside of the .xpi (e.g. .jar).

Linux highlight + Paste

[Anonymous Coward]

I tried this on their home webpage -- apparently you have to use the explicit "copy" buffer in order for the website to be tagged.

Using the highlight buffer (emacs-style) with the center-click paste doesn't append the website to whatever it is you are looking at.

YMMV

ABP

[CSFFlame]

I popped up ABP on a wired story page and it was trivial to block tynt's scripts. Stop whining and do it.

perfect security is simplistic

[Onymous Coward]

Giant problem? Perhaps in the context of perfect security. But there is no such thing.

I use YouTube without JavaScript (I also use a video downloader add-on).

Anyway, if I want to view a particular YouTube page, I press the NoScript "temporarily allow" button. Am I then subject to every possible XSS that could be happening at YouTube across the entire site or every time I visit the site? No. Am I subject to as much vulnerability as if I always visited YouTube with JavaScript enabled? Not nearly.

There is substantial security gain.

Saying there's a "giant problem" with NoScript is like saying there's a "giant problem" in being given $200 when you're wanting $20,000. Fine, give me that $200, then.

Simple solutions:

[m6ack]

View Source? NoScript Plug-in?

I used to have NoScript

[TorKlingberg]

I used to have NoScript with default to not run scripts, but I have given up. It is doable as long as you just browse the web, though you will have to whitelist a lot of sites to get them to work and embedded video will often just not play. The real problems come when you want to use travel booking sites, corporate career sites, banking and many online shopping sites. Those require a lot of JavaScript and will send you around between different domains and servers in ways that appear to be indistinguishable from XSS attacks. You cannot know before you start either, there will just be a blank page in the middle.

I still use NoScript, but in the blacklist mode. It stops some common attacks and lets me block annoying scripts such as in the article here.

Ignorant Blog Owners Giving Away Data For Free

[Pitawg]

Anyone using this "tool" on their own site could have written it themselves. Instead they choose to give away their viewers activities to a third party to make money off of it. They are paying another company to encourage tool use that disables the functionality of their own web pages and ads. They are helping a third party build a massive database of viewer data.

This is a malware/spyware tool that alters their own viewers' operating system clip board through the use of a web application. If something is selected on their own machine, this tool alters it so the viewer does not know what is in the clip buffer even after they carefully chose to select a particular set of data. This is not going to go over well at all.

Re:Ignorant Blog Owners Giving Away Data For Free

[UberMorlock]

Why should I write this tool myself? I can sign up for Tynt (and did some time ago) and use a tool that has already been written. The same thing can be said of Google Analytics. Given enough time, knowledge, and incentive, I am sure I could write a similar tool myself. Again, why should I? Someone else has already written it and it does what I need it to do. Since you're such an advocate of writing your own software tools, then I would expect that you've written your own operating system/browser/whatever entirely from scratch. No? Certainly, anyone using an operating system/browser/whatever could have written it themselves instead of giving money to a third party.

Furthermore, I very much doubt that *anyone* who uses Tynt on their site could have written it themselves. I've seen it in use on smaller websites created and maintained by people who are clearly not programmers, but they are able to follow directions on copying and pasting some pre-written code into their site.

Since Google Analytics is also building a massive database of viewer data, then I assume you'll be happy to rant against that, as well?

I Agree

[tobiah]

Not with the stealing data bit, I don't think of copying as stealing. But attempting to monitor copying doesn't seem any more criminal, it's just one more level of copying data.

The trackback URL feature is nice, I use it the same way. This article was interesting in that I didn't know how that was being done, but it really doesn't seem that intrusive.

taynt

[Onymous Coward]

If you think you're getting the actual words from a page by copying and pasting... you may be surprised to find your copy taynted.

And that folks have been spying on your mouse.

This explains...

[LordAndrewSama]

...what the AJAX request was every time I selected something

I have a habit of selecting each line as I read it, and when I saw the request, I wondered what they could possible do with the knowledge that i'd selected a specific line. so I re-read(and re-selected each line as I went) just to fuck with them. My habit hopefully makes any data they collect about me worthless, but i'll still be blocking the script's domain

Re:This explains...

[clone53421]

It’s not even AJAX. It’d be slightly less annoying if it was.

Re:This explains...

[LordAndrewSama]

Oh, right, I didn't actually look, I just saw the silly firefox loading image spin around on the left of the tab and assumed. My bad.

Re:This explains...

[clone53421]

I just saw the silly firefox loading image spin around on the left of the tab and assumed.

AJAX requests would happen a lot more quietly, if I’m not mistaken.

Syntax error

[Myopic]

What is this supposed to mean?

Not cookie based, not IP based, but stop it you creeps angry phone call based

I can't figure out if there is a missing word, a mis-spelled word, or what. If anyone knows how to parse that, reply and let me know.

Re:Syntax error

[LMacG]

Allow me copy-and-paste a bit more from the summary:

"Tynt provides no opt outs. Not cookie-based, not IP-based, but stop-it-you-creeps-angry-phone-call-based. "

1 - Tynt does not provide any way to opt-out of this "service."
2 - There is no cookie-based opt out.
3 - There is no IP-based opt out.

Thus, the submitter feels that an angry phone call (to either Tynt or Wired, it's not clear), during which he shouts "Stop it, you creeps" is his only available method for dealing with this tracking script.

Sadly, said phone call will probably not result in an opt-out.

Re:Syntax error

[Myopic]

Okay, that's a good interpretation; it is probably what the submitter meant. Still, the last phrase doesn't fit with the rest of the sentence (which he incorrectly constructed as two sentences). If there is no opt-out of any sort, then what does "but phone-call based" mean? Does it mean that there is actually a phone-based opt-out?

In any case, surely we agree that the shamelessly poor writing resulted in both deep ambiguity as well as impossible interpretation. I normally don't pick on the Slashdot editors, but wow, in this case they really let through a stinker. Is it contrary to the Slashdot editorial policy to find and fix grammatical errors? If not, is the only remaining explanation that the editors are unable to recognize such incredibly poor writing?

Perhaps we will never know.

Don't Blame Tynt

[Anonymous Coward]

Don't blame Tynt. They are only providing a service that their customers desired and pay them for. Instead blam Tynt's customers. Blame Wired.com and SFGate.com and any other sites that use this crapware.

Message to Tynt: Change your business model. You are an Adblock update away form going out of business.

Re:Don't Blame Tynt

[clone53421]

Message to Tynt: Change your business model. You are an Adblock update away form going out of business.

The EasyPrivacy list already blocks Tynt.

Browser extension to crapflood Tynt

[jerryasher]

I like this idea. If you visit a site using tynt, then you have a browser extension that crapfloods tynt with random quotes, probably taken from the site's privacy page.

I, for one, welcome our behavior tracking overlord

[robi5]

Minority vote: I scanned the responses which show an overwhelming disapproval. On the other hand it occurs to me that such a feature, which would monitor my activity on a web page would be useful as it would allow fine-tuning the web page, learning on the content creator 's part as to what people find interesting or useful. We already give away info by clicking on links and measuring how long we stay on a page. It is also a pain to see web content chopped up to small pieces just to increase hit numbers or better understand user behavior. So there is this general concept that understanding behavior is cool, and a current misunderstanding that the granularity allowed for this is one HTML page. It is OK for the privacy concerned that inter-page activity is analyzed, but intra-page is a big no-no. This is an arbitrary threshold. In fact, there is the vision that better, more complete pages are encouraged by measuring a lot of intra-page activities. Scrolling behavior, spent time on sections of the page, based on scrolling behavior or cursor behavior. In fact eye tracking would be an awesome indicator. Before any uproar let me suggest that those privacy buffs should remember that you already give this information not only at the level of HTML page visits, but also when you visit a physical shop. So I applaud this development as one more step toward providing feedback between content creator and user. I might spontaneously highlight passages that are interesting or being read. Others may paste in a copybook. No big loss of privacy.

CrazyEgg is another service that does this...

[Anonymous Coward]

If you look at http://crazyegg.com/ you see that they do something similar to this. It's actually looks like quite a useful tool for working out where your site gets the most attention.

Re:rename extension.xpi to extension.zip ... profi

[Eil]

Just because you can read the code doesn't mean it's not closed-source.

What is the harm?

[sorak]

What is the harm in collection of analytic data? Assuming that the only thing they record is

somebody from the zip code xxxxx copied and pasted 'yyyyyy'. He was using firefox and had flash installed on his system

, then what is the harm? (As for any further accusations, I would ask for evidence)

How would people know to opt out?

[Anonymous Coward]

I think I understand what you're trying to do here, and for those who want it, it sounds like a very useful service.
Frankly, I'd like the option to have my web browser to do something like this automatically when I copy and paste from any site (but not if it means sending the text to other servers, unfortunately).

However, as an end-user, if I hadn't come across this article on Slashdot, how would I know to opt out? And if I highlighted text and never copied-and-pasted it, how would I know that everything I highlighted was being sent to your servers? (Like other readers, I often highlight to make text easier to read and to keep my place within an article.)

In other words, it's great that I'm a reasonably tech-savvy person who reads Slashdot, but my parents aren't necessarily, and they have many of the same privacy concerns I do. What about them?

You do not own wired's website

[shish]

Cool, and utterly annoying, and how do I make that stop? ... And Tynt provides no opt outs.

The opt out process is very simple -- if you don't want to view wired's website under wired's conditions, then don't visit their website. Having an internet connection does not automatically entitle you to free access to everything you want on your own terms... (Yes, doing stuff like this might turn their readers away, but that's their choice, not yours)

Re:You do not own wired's website

[Ant P.]

if you don't want to view wired's website under wired's conditions, then don't visit their website.

Where in Wired's conditions or privacy policy do I agree to let them track which text I copy and paste off their site? Come on, you should have this answer since you're the one bringing it up.

Re:You do not own wired's website

[Fantastic Lad]

The opt out process is very simple -- if you don't want to view wired's website under wired's conditions, then don't visit their website. Having an internet connection does not automatically entitle you to free access to everything you want on your own terms... (Yes, doing stuff like this might turn their readers away, but that's their choice, not yours)

Entitled or not, a Cat, as they say, can look at a King. And it works both ways; If Wired doesn't want Joe Public to visit their site, then they don't have to put content out on the vast internet commons.

And anyway, what the hell. . ??

I simply cannot understand why anybody would suggest that individuals ought to shut up and let large bodies mistreat them.

Is that what you were taught about your own value as a human? That you are a disposable worker ant and you should bloody-well take crap when it is served to you? I'd like to submit the possibility that you have been lied to. You are worth more that that.

For my part, I've already installed the little pac-man ghost on my browser. Entitled or not, fair or not, whatever the clever argument about justice, (and there always is one), I do not care. I simply will not submit like a good little cog, comrade, citizen or whatever. But feel free to allow yourself to have your earlobe tagged and your hind leg branded. If you want to play cattle, then that's your business. Just remember what happens to cattle.

-FL

Re:You do not own wired's website

[shish]

I never said it was formally written in their legal documents :-P

Re:You do not own wired's website

[shish]

If Wired doesn't want Joe Public to visit their site, then they don't have to put content out on the vast internet commons.

They *do* want people to see their content, they just also want to know who's hilighting passages of text on their pages (because apparently this correlates with copy & pasting); as far as they're concerned, the current situation is fine.

I simply cannot understand why anybody would suggest that individuals ought to shut up and let large bodies mistreat them.

I'm not saying "shut up and take the abuse", I'm saying "shut up and stop visiting sites that you know will abuse you".

I hope they escape their input

[muridae]

There is only one good answer to this sort of thing. Paging Mrs. Roberts to the javascript department.

The javascript hook itself has exploit potential

[Anonymous Coward]

The method used in js here is getSelection(). They then use DOM to append the url onto that selection through, I believe, overloading the Ctrl-C and Right-Click events.

I personally think it's a neat idea - yeah, privacy hell etc, but there's nothing stopping Google silently adding this to Analytics, and I wouldn't be surprised to see it. NoScript is all good for the tinfoil hatters. I have in fact seen a considerable number of backlinks through using this in the short time I've had it on a test site, so it's great for small original content producers to get decent attribution.

What concerns me is the potential exploit on this if, say, running an Ubuntu help site. I know I've copypasta'd with known-good code off help sites before, straight into Terminal. There's nothing stopping this type of code silently tacking a \n and a few lines of nasty code onto totally innocuous code snippets. Before I found Tynt I'd certainly have fallen for it (and I consider myself a pretty hard person to hit with a 'sploit)...I've since changed my behaviour to proxying via gEdit before pasting any code into Terminal.

I've no account (Anon everywhere), but someone with one might consider adding this advice to UbuntuForums stickies on how not to get stung.

Re:rename extension.xpi to extension.zip ... profi

[DarkOx]

Just because you can read the code doesn't mean it's not closed-source.

Yes it does mean its open source. It might not be Free Software, it might not even be free as in beer but it IS open source. Anyone having the ability to look at the source code via ordinary means is the only necessary condition for software being open source.

For Privoxy users

[Obispus]

Get rid of this tracking JavaScript by adding this to your user.action file:

{ +block{Tracking scripts.} +handle-as-empty-document -handle-as-image}
.*tynt.com

Why are browsers allowing this shit at all?

[ArsenneLupin]

when I copy and paste text from Wired and other websites, the pasted text has had the URL of the original website appended to it.

In addition to being an annoyance, this is a huge security hole.

Indeed, if this malware can append an URL to the pasted text, it can append anything. Just imagine attempting to paste some bit of information into a command line (filename, URL for wget, ...), and this piece-of-shit script adds \nrm -rf $HOME\n to the selection. This nonsense is a clear sign that the javascript craze has gone way too far. Javascript should never be allowed to interfere with basic controls such as selecting and copy-pasting.

Re:CmdrTaco

[Anonymous Coward]

CmdrTaco is short for "command her taco", which means to pwn her vagina.

ceiling Tynt Insight

[blanck]

ceiling Tynt Insight is watching you mast... wait what?

Irony...

[EmagGeek]

Ghostery's website has 3 tracking bugs, all of which are blocked by Ghostery.

Re:rename extension.xpi to extension.zip ... profi

[Nyder]

Just because you can read the code doesn't mean it's not closed-source.

Srsly?

Dude, you should be ashamed.

What you said is, once we take away the double negative (which is, of course, a no no in english. sorry for the pun!) is:

Just because you can read the code means it is open source.

Which is weird, considering your replying to someone who is saying the same thing.

I think you might of meant "just because you can read the source code doesn't make it open source." Which really isn't true in this situation.

that's funny

[Anonymous Coward]

Because I have this nasty nervous habit of randomly selecting and deselecting unrelated blocks of text as I read an article... this reminds me of the old Calvin and Hobbes article:

Calvin: "I'm filling out a reader survey for Chewing magazine. See, they asked how much money I spend on gum each week, so I wrote '$500.' For my age, I put '43' and when they asked what my favorite flavor is, I wrote 'garlic/curry.'"
Hobbes: "This magazine should have some amusing ads soon."
Calvin: "I love messing with data."

Re:rename extension.xpi to extension.zip ... profi

[Eil]

Can I use drunkenness as an excuse?

Re:rename extension.xpi to extension.zip ... profi

[LionMage]

once we take away the double negative (which is, of course, a no no in english. sorry for the pun!)

A couple things. First, you're being overly simplistic when you say double negatives are a "no no" in English. (Note that English is capitalized, by the way.) In fact, many fine examples of English prose from days of yore contain double and even triple negatives; one example would be the Declaration of Independence, and another would be the U.S. Constitution. Back in those days, it was expected that the reader would sit there and ruminate for more than half a second to divine the meaning of a sentence, and therefore was adequately equipped to discern the meaning of said double negative.

The only time in English that double negatives are a "no no" is when they are unintentional, as when some poorly educated speakers mean one thing but say the opposite. "I ain't got nothin'!" The speaker meant he has nothing, but in fact is literally saying that he has something.

Secondly, "no no" doesn't really qualify as a pun. Even if you disagree, it's pretty weak -- even for a pun.

At any rate, the person to whom you are responding clearly falls into the "unintentionally self-sabotaging" category. :-)

My only observation is that there's some validity to his viewpoint, even if he did mangle the expression of it. If the source code for a plugin is readable only by disassembling the plugin, I'm not sure if that plugin really qualifies as Open Source (as defined by the industry). It seems to me that to meet the definition of Open Source, the author or publisher of the browser plugin ought to explicitly publish the source for the plugin.

Yes, I know my use of "disassemble" might seem strained to some folks, but the steps you have to take to get at the source for the plugin are not that far removed from decompiling a Java class you extract from a JAR file, for example, or running a binary through a disassembler. I'm sure others will grouse over what "explicitly publish" means -- frankly, I'd be satisfied with distributing commented source along with the plugin as a separate, human-readable file, or exposing it on a web site.

Still Selection

[CritterNYC]

It's still based on selection. When you select the text (which occurs when you finish the click, drag to highlight, release operation)... and Tynt modifies the selection to add their bit and sends back to the server what you selected. Then, when you hit CMD-C, your browser sticks the selected bit in your clipboard and *unselects* the text. Since the selection changed, Tynt gets another ping.

It's not the clipboard, it's what you selected (and then unselected) that's the trigger. Javascript can't get at the clipboard by default.

Re:Still Selection.

[JackRabbitSlims]

That's an interesting hypothesis, but this is not the way it apparently works according to my tests (see below). As other commenters have pointed out it does not access the clipboard but "capture" the Cmd-C keystrokes to trigger the code.
I have tried to replicate your hypothesis with Safari and LittleSnitch, both on Mac. First,I have to say thaton Safari, the selection does not disappear after you press Cmd-C.

1- I accessed this Wired article.
2- Upon selection of any text, it tries to open a connection to w1.tcr112.tynt.com, port 80. I "Deny Once" on LittleSnitch.
3- Re-selecting any other portion of text causes the same behavior of point 2, but deselecting text does not generate a connection request.
4- When pressing Cmd-C on the keyboard I get another connection request to w1.tcr112.tynt.com, followed by another one to wau.tynt.com, both on port 80.
5- Either by allowing these connections or not, the Javascript code detects this text has been already selected and copied and ignores subsequent Cmd-C sequences over the same selection. You need to deselect and select again to create another connection request

One really interesting finding is that the JS code does retain in memory what text you have selected previously on thet page and compares your new selections to the previous ones, only generating new connection requests when new text. It ignores the position of the text (so a single word selected in different parts of a page is only sent once when selected), and it is case sensitive so it you select "The" and "the", you get two connection requests (but only the first time). I suppose this is a way for them to clean requests.

Simple.

[RDeichsel]

Open Notepad, paste, select-all, cut. Now you have regular text.

Re:rename extension.xpi to extension.zip ... profi

[Gaffod]

The parent was a little rude, but thanks for the helpful reply, Anon. If I was of the parent's opinion your reply would be exactly the kind I'd want to get.

Big Brother?

[seekertom]

From the looks of most of these posts about folks surreptitiously observing and acting upon what you do on your computer, we all have the same idea about it, except maybe the tynt-guy. I don't like the idea of BB watching everything I do either, but maybe, to shine a different light on the subject, we need to do a 'declaration of independence' for the web. It ought to say in general terms, what we, the web-users of the world expect from our encounter with the world. This would include words like 'no spying on me by anyone, including the govt', or, 'what I do is my own damn business, not yours!'. But ya know this will never happen. Soooo, the bottom line is, we keep on fightin' 'em tooth and nail, exposing them as best we can (and 'thank-yous' to those who brought this to our attention) but ALWAYS remember, when you pick up a cell phone, open your browser, do email or read an article from whoever, or take an ad out in the local Gazette, even drive your car down the street or take a walk along the avenue, whatever you do is open for the rest of the world to see. Your govt has given itself the right to watch-and-report, and so has big business. Our only recourse, since this type of activity is not illegal, is to stay aware, and be careful with everything we do. Helluva way to live, but in case ya din't notice, there's a war going on. The game is different now, altho freedom and liberty are still the targets. The rules have changed, the attacks are different, and our responses ought to keep up with the times. TELL EVERYONE YOU KNOW what is going on, even in bits and pieces, and maybe someday, we'll all get the big picture and do something about it! Thanks fer lis'nin! seekertom