xkbcat VS Mailspring

Yes, approximately. In X11 at least, the hardware codes are called keycodes, and the human readable names are called keysyms. Example ofuse of the XkbKeycodeToKeysym function in use: https://github.com/anko/xkbcat/blob/8abc3402cb679027a3bd0313...

Keysyms don't necessarily strictly match "key location"; keyboards are allowed to output whatever codes they want for whatever key they want (see e.g. QMK firmware; often used in custom keyboards to do complex conditional key remapping), but they're relatively consistent between common keys on most keyboards, and consistent on the same keyboard even if you switch keyboard layouts in software, or have some custom firmware which functionality is stateful.

>I don't know a single person that has ever fallen victim to a virus or malware on linux, and I've been using it almost exclusively for the past 20 years. If it was a threat vector, it clearly wasn't a very big issue.

So: no true Linux user succumbs to malwares and no true Scotsman puts sugar on his porridge.

Putting that aside, it doesn't take much effort to find an example of X11 keylogger that requires zero superuser privilege and zero explicit permission granting by the user. Here, the first result from DDGing "x11 keylogger": https://github.com/anko/xkbcat

It is hard to believe this has not occurred in the wild. If such attack really hasn't occurred before in the Linux world, I would rather use the unpopularity of Linux desktop as my justification.

i think you’re misunderstanding what a virus is or what it is a capable of. sudo (just like every other piece of software) can be exploited, which would allow anything (such as a malicious program) to get root privilege with no user input. there are also plenty of other approaches for viruses to take that wouldn’t require root, like X11 keylogging, and user namespace exploits just to name a few. being selective with what you run with sudo can help a lot don’t get me wrong, but it definitely isn’t some silver bullet. think of it like how windows can get malware without ever running something as administrator

For now, the focus is getting Wayland on par with Xorg. However, there are a number of infrastructure improvements behind the scenes that make it superior to Xorg. For example, applications can no longer silently capture keystrokes without elevated privileges. Demo.

It's a bit more complicated than that, but essentially yes, see e.g. xkbcat and some other of the keyloggers linked there.

Here's a keylogger i found while googling: https://github.com/anko/xkbcat

X11 provides no mechanism for keeping applications from reading potentially sensitive input. Consider this simple, 100-line program to log keystrokes, and consider what Zoom might be doing with this kind of power.

I fully agree, moreover this:

> Rolling release distributions like OpenSUSE Tumbleweed follow upstream much more closely while still maintaining stability through thorough automated testing

Shows the author hasn't used Tumbleweed for any reasonable amount of time himself[0][1][2]. I daily drove it for a short while before moving to Fedora.

0: https://github.com/Foundry376/Mailspring/issues/533

1: https://forums.opensuse.org/t/tumbleweed-breaks-after-update...

2: https://www.reddit.com/r/openSUSE/comments/v09hnc/tumbleweed...

/u/protonmail is the a reason why there's been no effort on this front? It appears that it comes down to some sort of handshake issue but I can't imagine this is that hard to fix.

I was hopeful that https://www.nylas.com/ would be the de-facto "adapter" placing a common API surface on top of the major providers and dragging them into a modern-API world. They even had an email client of their own as a proof of concept (forked by one of the original authors as https://github.com/Foundry376/Mailspring - and its reusable core https://github.com/Foundry376/Mailspring-Sync may be interesting to many here). But they've pivoted towards making their API only available behind B2B contracts and opaque pricing, and primarily used for corporate email monitoring and CRM use cases - perhaps because security and privacy considerations are nontrivial. I'm still rooting for them but it's a shadow of what it could have been.

Mailspring

Mailspring- A great email client for windows (Opensource + Freemium)

I love Mailspring, it's modern and open source: https://getmailspring.com/

The UI uses Electron, but the actual sync engine is in C++, so it's pretty fast.

The only app I’m aware of which translates emails is this; https://getmailspring.com

Mailspring is quite nice. It also has a paid version and is actively updated so I think it's likely to stick around for awhile.

Mailspring, which is open source, is currently my recommendation for a desktop email client.

Mailspring. Open-source and fully local, but an optional account and optional subscription for premium cloud-based features. Thunderbird was too cluttered and Geary, although I really wanted to like it, was just too minimal.