Ubuntu unveils its next-generation shell and display server [LWN.net]

Ubuntu unveils its next-generation shell and display server

Posted Mar 7, 2013 10:25 UTC (Thu) by renox (subscriber, #23785)
In reply to: Ubuntu unveils its next-generation shell and display server by dlang
Parent article: Ubuntu unveils its next-generation shell and display server

I totally agree with you that normal applications should be able to go full screen, but I don't understand your use case for input event generation (that is the core of the security issue).
You wrote: "to move the mouse pointer out of the center of the screen so that it didn't obstruct and distract from the page being displayed."
so when you clicked on your media player it moved the mouse pointer?? Why didn't you just hide the mouse pointer if it stays idle a few seconds?
That's what most media player do and this doesn't require input event generation..

(Log in to post comments)

Ubuntu unveils its next-generation shell and display server

Posted Mar 7, 2013 11:12 UTC (Thu) by hummassa (subscriber, #307) [Link]

> I totally agree with you that normal applications should be able to go full screen,

I don't. At least not without some kind of overlay (*). The minute a normal application can go fullscreen it can spoof security measures (for instance, ask the user for his password and store/send it somewhere).

(*) One possible solution here is an OSD overlay that can be shown for a limited time, like two to five seconds, after any input -- keystroke, mouse move &c and, after that, vanish (like youtube's and xbmc's fullscreen mode video controls). This way the user can watch a video or even read a book or a webpage using the whole screen estate but can't be deceived in thinking its login page &c is being displayed.

Ubuntu unveils its next-generation shell and display server

Posted Mar 7, 2013 11:33 UTC (Thu) by renox (subscriber, #23785) [Link]

>> I totally agree with you that normal applications should be able to go full screen,
> I don't. At least not without some kind of overlay.

It depends on the situation.. On your home PC, is-it really an issue?
To fool you into entering your password, the trojan must be able to replicate somehow your environment, which is quite difficult if it isn't allowed to generate input events (like Wayland does).
Where security is important, I think that it should be possible by administrators to disable full screen windows.

Ubuntu unveils its next-generation shell and display server

Posted Mar 7, 2013 19:39 UTC (Thu) by dlang (✭ supporter ✭, #313) [Link]

> You wrote: "to move the mouse pointer out of the center of the screen so that it didn't obstruct and distract from the page being displayed."
so when you clicked on your media player it moved the mouse pointer??

There was no mouse or keyboard attached to the machine. There was no media player software running, just firefox viewing a HTML/javascript page.

I used a command-line tool (xwit) to inject a mouse movement action into the input event queue