Sidekey 1.1.0 (security fix: pairing)

Sidekey for Mac 1.1.0 fixes a serious security problem in 1.0.0 and adds pairing. If you installed 1.0.0, replace it with this version.

Security fix

Sidekey 1.0.0 accepted connections from any device that could reach the Mac over a network and ran the action that device sent, including shell commands. It has been withdrawn. In 1.1.0:

• Pairing: a Mac accepts an iPad only after you pair them with a 6-digit code shown on the Mac. Until then the iPad receives only the Mac's name and a pairing request, and its taps are refused.
• Only built-in actions: a tap names a key, and the Mac runs that key's action from its own built-in layout. It never runs an action sent over the network.
• Not encrypted yet: Traffic between the iPad and the Mac is not encrypted yet. Someone who can watch or tamper with your network could read what Sidekey sends (app names, window titles, the keys you tap and both device names). If they capture the one-time pairing exchange or interfere with a live connection, they could also press your Mac's built-in keys, for example to open Terminal or lock the Mac, until you choose Forget Paired iPads on the Mac. Use Sidekey over USB or on a network you trust. Encryption is planned.

Also new

• Microsoft Word layout: New, Open, Save, Print, Find, Bold, Italic, Underline, Link, Center, Comment, Track Changes, Undo, Redo and Focus.
• VS Code: the Git Stage All key, which could not work, is replaced by Source Control.
• Removed the "Open Settings..." menu item, which did nothing.

Install or update

1. Quit Sidekey 1.0.0 if it is running. Download Sidekey.dmg below, open it and drag Sidekey to Applications, replacing the old copy.
2. Open Sidekey from Applications. It lives in the menu bar.
3. If macOS asks, switch Sidekey on in System Settings › Privacy & Security › Accessibility. If keys stop working after updating, remove Sidekey there with the minus button, add it back with the plus button and switch it on.
4. Choose Pair iPad... in the Sidekey menu and type the code on your iPad. The iPad app needs the matching update: TestFlight build 3 or later for beta testers, otherwise build it from source at this version until it reaches the App Store.

Requires macOS 13 or later. Signed with Developer ID and notarized by Apple.

Known limits

• Zoom meeting state (mic, camera, sharing, recording) is built from Zoom's documented menus and not yet tested in a live meeting.
• The Do Not Disturb key runs a shortcut named Toggle Focus, which you create in the Shortcuts app.

SHA-256: 3fcfd81a0ad9454fa35a5646df9b6d8db4486d3f7bec8fc4e360af201d21d0e5