Hacker News Reader

Comment by federicoterzi | Hacker News Reader

Good point, I've wrote a short section to detail the security aspects: https://github.com/federico-terzi/espanso/blob/master/SECURI...

TLDR: It's not a keylogger, because it doesn't log anything :)

Moreover, on macOS the detection mechanism is automatically disabled on password fields

View on HN

Also, the biggest benefit of this approach compared to a VSCode-only snippet, is that it works on any application and also between different operating systems, which makes it easier to collaborate and reuse them :)

Thanks for the response, but unless I take the time to literally go to your entire repo and make sure you aren't doing anything weird, I'm not installing this thing.

If you're in a position to use this program[0], you're already taking the same risk by running most other programs on your machine - they also have access to your keypresses.

[0]: The only real reason you wouldn't be is if you're on a non-X Linux desktop. Wayland prevents this kind of program by design.

Fun fact, Wayland support is the most requested feature [1] and I think it's possible, although we will need to go deeper in the stack and exploit EVDEV

[1]: https://github.com/federico-terzi/espanso/issues/287

A nice technical writeup! The daemon approach sounds particularly promising. Have you also thought about a Wayland protocol extension? espanso is not the only program that will want total keyboard access, and it's one of the last big obstacles for a lot of X11 users.

Thanks!

> Have you also thought about a Wayland protocol extension?

I honestly didn't think about that! That might be an option, perhaps when espanso becomes more well-known in the community. Before that, it's unlikely that any change I suggest will make its way into the specification :)

That's absolutely ok! I'm also very open to feedback if you have any :)

Reply on news.ycombinator.com