Hacker News Reader

Comment by navidkhn1 | Hacker News Reader

I'm not sure if anyone has seen this yet, but Catalina is letting me login without entering my password!

I have two users on my machine.

1. I "lock screen" from the Apple menu and close the lid. 2. I reopen the lid and it does not ask for password. 3. I start using laptop and lock screen suddenly pops up, but asks password for the wrong user. 4. I hit random key and the screen goes away, and i can continue working.

Also, it looks like a lot of settings don't work on the lock screen / choose user screen. For instance, the pointer speed doesn't match what I have set, font sizes don't match either, and the resolution looks wrong.

In all... It feels like windows?

View on HN

Despite having a lower quality than before since a few years, Windows has login and locking features that actually work (and I don't even really remember of bugs in there, like ever), so no, from what you describe it does not feel like Windows at all, it feels like some completely broken crap.

There were some good bugs in the login part of windows 2000/XP. Most of the ones I know of involve opening a browser while still on the login screen (my favorite was in the help for the screen reader), which is running as the System user that has complete control over the system.

IRC this was only possible on windows 95 and maybe 98.

You could do this on XP too.

They fixed most of them somewhere around XP SP2 or SP3, where they pretty much disabled help functionality on everything on the lock screen.

When Cortana was introduced, they had some issues of being able to launch the browser while the machine was still locked (though as the user that the computer was locked by). You couldn't do much as the previous bugs as the lock screen still covered everything.

While on the subject, on Linux I've also noticed that Xscreensaver (or GNOME screensaver, can't remember which) sometimes goes straight into the desktop after wakeup for a few seconds before the lock screen prompt actually appears. You can even run programs. Really bizarre and feels like this issue has been present for a while now. Has anyone else noticed this or is it just me?

X locking is notoriously difficult.

I run xlock on suspend rather than on resume, seems more reliable. I'm any case, locking is trivial to bypass by pressing Control-C a few times on resume to kill xorg, hence why I also start X with "startx; exit" so that this drops to the login prompt instead of the shell.

I think this still isn't secure. Try "sleep 5; exit" and press C-Z. You won't be logged out. You probably want to use "exec startx" instead.

Thank you, I took a look at my shell man page and this is very helpful.

I'm interested to understand why. Is it because of the design of Xorg?

Yes, it's one of the reasons Wayland was created. Screensavers didn't exist when X was designed. https://www.phoronix.com/scan.php?page=news_item&px=OTI5MQ

> Right now with screensavers under X it's basically capturing the input and continually redrawing over the display. > With Wayland, Kristian plans for the lock-screen to be part of the Wayland compositor. In having the compositor handle the screensaver role, it can ensure that no window can appear atop the screensaver surface, it can properly detect idling and grabs already, and has complete control over the screen. Unlike the X design, there wouldn't even need to be a screensaver "window" that's on top but the compositor could just keep painting a black screen. For those interested in a "fancy screensaver", a plug-in could be used or an out-of-process Wayland client for drawing whatever you desire.

Computers were a mistake.

Indeed. I recommend a Butlerian Jihad followed by rigorous reliance on Mentats.

It's a joke but sometimes I really do wonder.

Yeah, saw this the other day on an Ubuntu machine (running whatever the last release was, not LTS) I have hooked up to a TV. Flash of the desktop for a second or so before the login screen. Speaks to something fundamentally wrong with the way the whole thing works, I figure.

I had the same impression. That general feeling that the screensaver is like an app/overlay that is invoked only once the desktop is active. The speed of invocation also seemed related to how fast your machine is at launching general desktop programs...

>That general feeling that the screensaver is like an app/overlay that is invoked only once the desktop is active

That is how it is implemented (in X11)

for the record I used to be able to see a bit of the desktop on windows after waking from sleep before the lock screen came on. can't remember if that's still true, though.

Ah yes, I remember that happening on windows xp a lot when it was waking up or between screensaver and login timeout (when they overlap), you'd even get the transition-to-welcome-screen sound so you know it only just triggered the locking just then. I suspect if you are fast you can run something before it actually locks.

It's REALLY important to distinguish between Xscreensaver and GNOME screensaver.

Warning: copy-paste this link, if jwz sees an HN referrer, you won't be happy.

www.jwz.org/blog/2015/04/i-told-you-so-again/

I run the real xscreensaver though (I was building it from the source until around this time last year, now I run the one from alpine but I don’t think they’ve done anything weird (I haven’t checked though))

I’m pretty sure I’ve seen what everyone is talking about and it’s bothered me a little too (granted, my machine is configured in such an undiscoverable way that just opening an xterm window is obscure enough to be nearly equivalent to a very short pin, and then you need to know bash. Now that I’m not in college and don’t have anything important that’s probably good enough even without xcreensaver.)

I think this is because xscreensaver confines (grabs) the mouse cursor to the area occupied by the "Please enter your password" window. If this area somehow suddenly happens to be out of your screen boundaries (e.g. when xrandr --offing external screens), the mouse is ungrabbed and can be used to interact with the desktop. It takes a while before xscreensaver notices and grabs it again. Someone should probably figure out the exact steps to reproduce this and report it.

As said elsewhere, locking X is really hard, and xscreensaver architecture doesn't help. This week I managed to crash xscreensaver login prompt twice, unlocking the desktop without entering my password, and that was the last straw, I switched to xsecurelock which separates the login entry into another process, making such bugs much less severe.

Unfortunately I can't reliably reproduce the crash. A hardware fuzzer (also known as a faulty ThinkPad keyboard) was involved, and I don't possess the device any more. I think what it did was press certain keys very often — the keyboard matrix is sampled at 125 Hz, so I'm guessing it was pressing the keys about 60 times per second, but I'm not sure which keys they were. If anyone manages to reproduce this, please do give me a shout. :-)

That bug has been open for 6 years or more.

Wouldn't know about the windows lock screen particularly, and I haven't been a windows user since Vista, but such low quality software and UX is what I remember being accustomed to during my time with windows.

To be fair, it was also vista...

Windows 7 was the peak. Stable, simple to use, performant.

Of course it didn't have all the features that were introduced since, but it also didn't have as bad a UX as the more recent versions.

Recent Windows login issues I've had to deal with:

* Non-consensual insertion of Windows Update latency into my schedule. Often I don't mind. Sometimes, though, I really, really do.

* Said updates failing but giving no indication of failure other than taking infinitely long.

* Keyboard layout sometimes gets swapped back to QWERTY with no visual indication. This interacts especially poorly with stringent Active Directory 3-try-lockout policies.

* Network hiccups + active directory (or something) can cause login to spin indefinitely, requiring a restart.

* Login screen background occasionally changes to a random picture from my computer. Usually a wildly upscaled application resource. I haven't entirely ruled out my own clumsiness as a contributing factor, but I've also seen this in the wild, so it's at least a UX issue somewhere.

None of this is as bad, in a theoretical sense, as Apple's no-password fiasco, but it has resulted in a far larger footprint on my day-to-day activity.

I've never seen a bug like that on Windows. Honestly, it feels like a lot of Mac users live in a bubble where Windows is a buggy pile of crap. Meanwhile most Windows users around the world are getting on with life on a stable OS with a great choice of hardware. While nothing's perfect, Windows is in a really good place at the moment.

You must not have ever used Windows 98.

It was released 21 years ago and its extended support ended 13 years ago

Except that I can not open "Windows Search settings", since it crashes after loading a few seconds. And all the other shit. It might not be as bad as this Mac update, I don't feel confident doing a comparison. But certainly take issue with "Windows is in a really good place at the moment"

Not OP but there will always be counterexamples for any software with a sufficient number of users. I've never experienced the bug you're referring to.

My brand new PC running Windows 10 will simply not wake up from sleep, requiring a hard restart. A google search turns up thousands of similar complaints (and no solution).

I had the same issue. A bios update was what fixed it for me.

> While nothing's perfect, Windows is in a really good place at the moment.

Sure, minus the fact that my Windows box would be _spying on me_ if I wasn't a very technically capable person. That's a non-trivial driver for a lot of folks when they decide to pick Apple products. Or, at least, it was until recently with the iCloud / China debacle.

As a Linux user I feel like windows users live in a bubble where where computers are more or less expected to behave like diseased wild animals rather than machines.

On the other hand, I could scale my external monitor perfectly with W10, while on Linux the answer is still xrandr. Which makes everything blurry. Unless you scale Gnome/KDE to 2x and downscale.. which makes everything slow.

Gah... i hate computers.

Good joke. Sounds like you haven't used windows since ME.

Diseased animal fits Windows 8.0 quite nicely I think.

I came up with that idea (windows makes computers behave like organisms and not machines) during an internship where everyone was required to use corporate computers running Windows 10.

I haven’t used it on a personal computer since XP though so I guess you’re not far off.

I've spent 15 years on a Mac before switching (back) to Windows *

I must say that Windows has... changed... In a good way. But that's not even the point. The point everyone keeps forgetting, is that OSX is tightly coupled with native Apple hardware, while Windows has to work on a zoo of devices.

[*] I actually blogged about this here, sorry for a shameless plug: https://www.jitbit.com/alexblog/277-back-to-pc-after-14-year...

Since Mojave, waking my 2012 rMPB results in a flash of desktop and content before showing the lock screen. This sounds similar, if not a continued degradation.

This has been a thing for longer than that.

The huge spam of confirmation popups reminds me of the "debacle" of Windows Vista introducing UAC. It's kind of inexcusable that, a decade later, Apple did exactly the same UI fiasco.

report to Apple and get the bug bounty

Reply on news.ycombinator.com