3 ms·

> Screenshots and sharing the screen Works for years. And global hotkeys are not trivial - no, that “everything listens to everything” that X did is not a pro

by kaba0 3y ago

> Screenshots and sharing the screen Works for years. And global hotkeys are not trivial - no, that “everything listens to everything” that X did is not a proper solution.

bandrami 3y ago
It's worked fine for X for decades now, so simply claiming "it's not a solution" is kind of silly. I get that people pretend they are afraid some nefarious program is going to scrape their screen, but since I don't use closed source software this just isn't a real worry. Also do keep in mind this is about more than global hotkeys; there are several accessibility paradigms that simply don't and can't work on Wayland.
- sobkas 3y ago
  > It's worked fine for X for decades now, so simply claiming "it's not a solution" is kind of silly. It never worked "fine", it was always a failure from security and usability perspective. > I get that people pretend they are afraid some nefarious program is going to scrape their screen, but since I don't use closed source software this just isn't a real worry. You know that apps have security vulnerabilities that can be exploited over the network? Screen grabbing, keyloggers, input injection(you have open root terminal? let's type some commands there). And more.
- babypuncher 3y ago
  > I get that people pretend they are afraid some nefarious program is going to scrape their screen, but since I don't use closed source software this just isn't a real worry. Do you personally audit the source code to every piece of software you run on your computer? Do you have the expertise necessary to even do that if you wanted to? FOSS isn't magically immune to security exploits. Everything we build should assume any other software it interfaces with might be defective or even hostile. https://en.wikipedia.org/wiki/Heartbleed https://en.wikipedia.org/wiki/Heartbleed
  - bandrami 3y ago
    > Do you personally audit the source code to every piece of software you run on your computer? No more than Wayland users have audited the process protection code.
    - babypuncher 3y ago
      You're not really addressing my argument here. Of course Wayland users don't audit the Wayland source code. I was illustrating why Wayland's security paradigm is important. It doesn't assume all the apps it renders are safe. It can still (and probably does) have security holes, but it is already starting from a much more secure foundation than X11 ever had any hope of having. Similarly, my web browser probably has not publicly known exploits that I haven't bothered to discover myself, but that doesn't mean I should be OK with using a browser that doesn't sandbox its javascript engine.
- kaba0 3y ago
  As I have said many times, a good intentioned program with a bug only needs bad intentioned data. A malicious PDF file is enough to break havoc with a simple memory bug, so unless you claim that open source is also bug-free, or that you don’t use any external data (but visiting this site already invalidates that assumption), then you are just being naive. There is nothing inherent that couldn’t work with Wayland - there is nothing preventing the relevant teams agreeing on a new interface to broadcast accessibility information to the wayland server, that can thus share that with specific accessibility software (which is explicitly permitted to do it).
j16sdiz 3y ago
Global hotkey is do-able if the composer can do the event routing.
- vetinari 3y ago
  It is more than event routing, you do not really want for any client to be able to claim any combination, without any further insight by either compositor or user. Ideally, what you want, is for the client expose a set of (described) actions, with suggested key bindings. Users can then enable / disable / change the bindings in some central place, which would also take care about collisions, reserved global keybinding or reserved local keybinding (key shortcuts, that are always supposed to be available to the focused app).

by kaba0 3y ago

> Screenshots and sharing the screen Works for years. And global hotkeys are not trivial - no, that “everything listens to everything” that X did is not a proper solution.

bandrami 3y ago

It's worked fine for X for decades now, so simply claiming "it's not a solution" is kind of silly. I get that people pretend they are afraid some nefarious program is going to scrape their screen, but since I don't use closed source software this just isn't a real worry. Also do keep in mind this is about more than global hotkeys; there are several accessibility paradigms that simply don't and can't work on Wayland.

sobkas 3y ago
> It's worked fine for X for decades now, so simply claiming "it's not a solution" is kind of silly. It never worked "fine", it was always a failure from security and usability perspective. > I get that people pretend they are afraid some nefarious program is going to scrape their screen, but since I don't use closed source software this just isn't a real worry. You know that apps have security vulnerabilities that can be exploited over the network? Screen grabbing, keyloggers, input injection(you have open root terminal? let's type some commands there). And more.
babypuncher 3y ago
> I get that people pretend they are afraid some nefarious program is going to scrape their screen, but since I don't use closed source software this just isn't a real worry. Do you personally audit the source code to every piece of software you run on your computer? Do you have the expertise necessary to even do that if you wanted to? FOSS isn't magically immune to security exploits. Everything we build should assume any other software it interfaces with might be defective or even hostile. https://en.wikipedia.org/wiki/Heartbleed https://en.wikipedia.org/wiki/Heartbleed
- bandrami 3y ago
  > Do you personally audit the source code to every piece of software you run on your computer? No more than Wayland users have audited the process protection code.
  - babypuncher 3y ago
    You're not really addressing my argument here. Of course Wayland users don't audit the Wayland source code. I was illustrating why Wayland's security paradigm is important. It doesn't assume all the apps it renders are safe. It can still (and probably does) have security holes, but it is already starting from a much more secure foundation than X11 ever had any hope of having. Similarly, my web browser probably has not publicly known exploits that I haven't bothered to discover myself, but that doesn't mean I should be OK with using a browser that doesn't sandbox its javascript engine.
kaba0 3y ago
As I have said many times, a good intentioned program with a bug only needs bad intentioned data. A malicious PDF file is enough to break havoc with a simple memory bug, so unless you claim that open source is also bug-free, or that you don’t use any external data (but visiting this site already invalidates that assumption), then you are just being naive. There is nothing inherent that couldn’t work with Wayland - there is nothing preventing the relevant teams agreeing on a new interface to broadcast accessibility information to the wayland server, that can thus share that with specific accessibility software (which is explicitly permitted to do it).

j16sdiz 3y ago

Global hotkey is do-able if the composer can do the event routing.

vetinari 3y ago
It is more than event routing, you do not really want for any client to be able to claim any combination, without any further insight by either compositor or user. Ideally, what you want, is for the client expose a set of (described) actions, with suggested key bindings. Users can then enable / disable / change the bindings in some central place, which would also take care about collisions, reserved global keybinding or reserved local keybinding (key shortcuts, that are always supposed to be available to the focused app).