Re: Comment on global shortcuts security

2012-10-01 Thread Bill Spitzak
Rick Stockton wrote: IIRC, The Qt/KDE design is the opposite: If they "USED" the key within some level of code (class or interface), then they suck it in and nothing comes back to Weston. Not quite. There is an "accepted()" field in events, which are passed by reference to event handlers. Th

Re: Comment on global shortcuts security

2012-10-01 Thread Rick Stockton
On 09/30/2012 09:08 AM, Bill Spitzak wrote: << SNIP >> I hope these comments are useful; if they're just a bunch of obvious "baggage", I apologize. All the normal keystorkes that a client handles are a roundtrip, so I really can't see this being a problem. I certainly agree with Wayland's d

Re: Comment on global shortcuts security

2012-10-01 Thread Daniel Stone
Hi, On 1 October 2012 02:08, Bill Spitzak wrote: > On 09/30/2012 01:35 AM, Pekka Paalanen wrote: >> You might invent elaborate schemes to overcome the latter cons, [and this did happen] >> but even the roundtrip argument alone is a serious one, and there >> would have to be a serious benefit in

Re: Comment on global shortcuts security

2012-09-30 Thread Bill Spitzak
On 09/30/2012 01:35 AM, Pekka Paalanen wrote: On Wed, 26 Sep 2012 08:21:44 +0200 Daniel wrote: El dt 25 de 09 de 2012 a les 11:15 -0400, en/na Kristian Høgsberg va escriure: On Mon, Sep 24, 2012 at 04:53:20PM -0700, Bill Spitzak wrote: Keystrokes should be sent to the application first. Only

Re: Comment on global shortcuts security

2012-09-30 Thread Pekka Paalanen
On Wed, 26 Sep 2012 09:14:15 +0300 Pekka Paalanen wrote: > On Tue, 25 Sep 2012 18:07:51 +0200 > Piotr Rak wrote: > > > Hi, > > > > 2012/9/25 Pekka Paalanen : > > > Hi Piotr, > > > > > > it sounds like you make a fundamental assumption on something, that > > > makes global shortcuts insecure, a

Re: Comment on global shortcuts security

2012-09-30 Thread Pekka Paalanen
On Wed, 26 Sep 2012 08:21:44 +0200 Daniel wrote: > El dt 25 de 09 de 2012 a les 11:15 -0400, en/na Kristian Høgsberg va > escriure: > > On Mon, Sep 24, 2012 at 04:53:20PM -0700, Bill Spitzak wrote: > > > Keystrokes should be sent to the application first. Only if the > > > application refuses the

Re: Comment on global shortcuts security

2012-09-25 Thread Daniel
El dt 25 de 09 de 2012 a les 11:15 -0400, en/na Kristian Høgsberg va escriure: > On Mon, Sep 24, 2012 at 04:53:20PM -0700, Bill Spitzak wrote: > > Keystrokes should be sent to the application first. Only if the > > application refuses them should they be considered global shortcuts. > > No. Could

Re: Comment on global shortcuts security

2012-09-25 Thread Pekka Paalanen
On Tue, 25 Sep 2012 18:07:51 +0200 Piotr Rak wrote: > Hi, > > 2012/9/25 Pekka Paalanen : > > Hi Piotr, > > > > it sounds like you make a fundamental assumption on something, that > > makes global shortcuts insecure, and so you set out to solve these > > problems. > > > > What is it that you assu

Re: Comment on global shortcuts security

2012-09-25 Thread Piotr Rak
2012/9/25 Timothée Ravier : > Le 25/09/2012 01:53, Bill Spitzak a écrit : >> Keystrokes should be sent to the application first. Only if the >> application refuses them should they be considered global shortcuts. > > > According to me, the main goal is to _never_ have global shortcuts. > That's why

Re: Comment on global shortcuts security

2012-09-25 Thread Piotr Rak
Hi, 2012/9/25 Pekka Paalanen : > On Tue, 25 Sep 2012 01:46:37 +0200 > Piotr Rak wrote: > >> Hi, >> >> Although I am not security expert, I'd like to share my input into >> this topic, so putting on my black hat... >> >> It is probably not great discovery, but I believe that minimal >> requirement

Re: Comment on global shortcuts security

2012-09-25 Thread Kristian Høgsberg
On Mon, Sep 24, 2012 at 04:53:20PM -0700, Bill Spitzak wrote: > Keystrokes should be sent to the application first. Only if the > application refuses them should they be considered global shortcuts. No. Kristian > I think this will fix most of the security problems you raise. It > also means th

Re: Comment on global shortcuts security

2012-09-25 Thread Timothée Ravier
Le 25/09/2012 01:53, Bill Spitzak a écrit : > Keystrokes should be sent to the application first. Only if the > application refuses them should they be considered global shortcuts. According to me, the main goal is to _never_ have global shortcuts. That's why each applications should register the

Re: Comment on global shortcuts security

2012-09-25 Thread Pekka Paalanen
On Tue, 25 Sep 2012 01:46:37 +0200 Piotr Rak wrote: > Hi, > > Although I am not security expert, I'd like to share my input into > this topic, so putting on my black hat... > > It is probably not great discovery, but I believe that minimal > requirement for given combination of keys, to be allo

Re: Comment on global shortcuts security

2012-09-24 Thread Bill Spitzak
Keystrokes should be sent to the application first. Only if the application refuses them should they be considered global shortcuts. I think this will fix most of the security problems you raise. It also means there can be simpler shortcuts, currenlty global shortcuts require the holding down

Comment on global shortcuts security

2012-09-24 Thread Piotr Rak
Hi, Although I am not security expert, I'd like to share my input into this topic, so putting on my black hat... It is probably not great discovery, but I believe that minimal requirement for given combination of keys, to be allowed as global shortcut is that is not printable and not whitespace g