phf: since applications (and that includes window managers) tend to send around lots of different messages as the focus is traveling around your window hierarchy, i wouldn't be surprised if gtk/qt does a very specific grab when you put a cursor inside your app's password box, and do a release whenever focus travels away ☟︎

phf: wayland "mitigates" keylogger issue by not fucking letting you start apps either as a remote user or ~even as a different user on same machine~ ☟︎

phf: so you could, theoretically connect to a compromised ssh box, with your x11 tunneling enabled, and get a silent agent snooping your keyboard

phf: it still works though when xterm is asking you for password because xterm doesn't know it's a password entry, and doesn't do a grab ☟︎

phf: if you simply load an x app, attach it to root, and start grabbing all the events then you can come to same conclusion as any random chick with a blog "omg all teh events" ☟︎

phf: (there's a handful of other extensions that might potentially be used to subvert that mechanism, but likewise they are not mandatory and can be disabled like XTEST)

phf: a security minded application can do what's known as a server grab, which isolates a chosen window and makes it a new root as far as events are concerned

phf: in addition there's a RECORD extension that allows any application to register for all keyboard events irrespective of their destination

phf: root, being a special window receives all the events (that's very handwavy but closer to truth)

phf: x11 allows you to attach your own windows to a window hierarchy, that starts with root window

phf: see architecturally wayland and x11 couldn't be more different. x11 supports a special network protocol that lets clients from different sources connect to the same instance of x. for example you can have a client from a different user on the same machine or a client from a network source (like over ssh) ☟︎☟︎

phf: that much is obvious from what he said so far, but i thought maybe he'll choose to think about it a little bit

phf: some people when they come back to old homestead take certain perverse pleasure in learning that joe now sucks cock for meth, while molly is married with three kids to a cop that beats her. not i, i'm sad to see my childhood friends debase themselves so

phf: they have a clothing line and everything https://ubuntumade.com

phf: s/n maybe. but if you're trying to buy "raw ingredients", like meat cuts, vegetables, bulk dry goods, wf is the cheapest option. can do safeway for some items, but there's a noticeable drop in quality

phf: actually in 2005 or so, i was reading a lot of hunter thompson and first got into the whole americana thing. i spent some time at kind of dirty biker honky tonk places. my guides, on more than one occasion, warned me not to speak at all (at first, and while i'm sober anyway), so as not to alert the locals to the fact that i'm russian. i'm pretty sure that at this point at the same bars i would automatically gain an honored guest status for being russia

phf: this is a highly amusing reversal from a decade ago, when left was pro-russia and right anti-

phf: also in the last two years, as putin became a kind of presidential role model for the midwest, i think it also became a lot more acceptable to come out in support of countries that are not america, so america and its people are seen as having lost the way, etc. it went from "red scare" to "i wish putin was our president" (a phrase i've heard more than once even before the previous election cycle)