Add setClientMessageEvent'

[liskin]

The existing setClientMessageEvent can't be used to send EWMH
_NET_WM_STATE client messages as they need more than 2 items in data.
Furthermore, it doesn't set all of data and thus sends whatever was in
memory before.

The motivation here is that we want xmonad to be configurable to ignore some _NET_ACTIVE_WINDOW requests to prevent e.g. browsers from stealing focus, but it's nice to make that focus request visible somehow. And since the urgency handling machinery is already very configurable in xmonad, the easiest way to plug into it is to send a message to ourselves.

A draft of that is here: liskin/xmonad-contrib@7bac095
Usage example: liskin/dotfiles@18dfd71#diff-f3bd9f70ef878f30362ff11bbea7fd1d0d6abde1b4befa44b18cce5a27456204R257

Related discussions:
xmonad/xmonad-contrib#109 (comment)
xmonad/xmonad-contrib#110 (comment)
xmonad/xmonad-contrib#396
xmonad/xmonad-contrib#399

[geekosaur]

Hm. Is "sends whatever was in memory before" the security hole it sounds like?

…

On Fri, Nov 6, 2020 at 4:21 PM Tomáš Janoušek ***@***.***> wrote: The existing setClientMessageEvent can't be used to send EWMH _NET_WM_STATE client messages as they need more than 2 items in data. Furthermore, it doesn't set all of data and thus sends whatever was in memory before. The motivation here is that we want xmonad to be configurable to ignore some _NET_ACTIVE_WINDOW requests to prevent e.g. browsers from stealing focus, but it's nice to make that focus request visible somehow. And since the urgency handling machinery is already very configurable in xmonad, the easiest way to plug into it is to send a message to ourselves. A draft of that is here: ***@***.*** <liskin/xmonad-contrib@7bac095> Usage example: ***@***.*** #diff-f3bd9f70ef878f30362ff11bbea7fd1d0d6abde1b4befa44b18cce5a27456204R257 <liskin/dotfiles@18dfd71#diff-f3bd9f70ef878f30362ff11bbea7fd1d0d6abde1b4befa44b18cce5a27456204R257> Related discussions: xmonad/xmonad-contrib#109 (comment) <xmonad/xmonad-contrib#109 (comment)> xmonad/xmonad-contrib#110 (comment) <xmonad/xmonad-contrib#110 (comment)> xmonad/xmonad-contrib#396 <xmonad/xmonad-contrib#396> xmonad/xmonad-contrib#399 <xmonad/xmonad-contrib#399> ------------------------------ You can view, comment on, or merge this pull request online at: #71 Commit Summary - Add setClientMessageEvent' File Changes - *M* Graphics/X11/Xlib/Extras.hsc <https://github.com/xmonad/X11/pull/71/files#diff-c21bc5359714d5fc13c1ce57cc8ba65e5d2420003b0956d5fed69c50e8db06de> (20) Patch Links: - https://github.com/xmonad/X11/pull/71.patch - https://github.com/xmonad/X11/pull/71.diff — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#71>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAPRFIAC7PWFXFGHLFYHIADSORSF3ANCNFSM4TNE32TA> .

-- brandon s allbery kf8nh allbery.b@gmail.com

[liskin]

Is "sends whatever was in memory before" the security hole it sounds like?

Not really. You'd need to have xmonad handling sensitive data (somewhat unlikely) and you'd need a way to make xmonad send a ClientMessage on demand and observe that message, but you'd also need to not have the ability to control the X server in other ways, which you almost always do. Why would you extract information using a few leaked bytes in ClientMessages when you can just XTEST a keybinding to launch the terminal and then do whatever you want?

[liskin]

I'd like to merge this and #72 in a few days. Can we then make a 0.10 release so that this stuff can be used in xmonad and xmonad-contrib?

Unfortunately it seems the list of people who can actually upload the release and are active is quite small: https://hackage.haskell.org/package/X11/maintainers/
Would it perhaps make sense to add a few more of the active xmonad core folks to that list? (And to https://hackage.haskell.org/package/xmonad/maintainers/ and https://hackage.haskell.org/package/xmonad-contrib/maintainers/)

[liskin]

Oh and #42 can probably be merged as well after all these years. I can help with that, but I'd like to see a confirmation that the work won't be wasted first.

[dmwit]

Make your request more concrete, please: which Hackage users are you asking to be added to the maintainers list?

[liskin]

@dmwit geekosaur doesn't have a hackage account, so from the active core team maintainers, https://hackage.haskell.org/user/psibi and https://hackage.haskell.org/user/TomasJanousek (myself) are good candidates to add.