Possible GUI protocol enhancement - cursor shape?

[Derek Fawcus]

Something I've noticed when using a web browser is that the cursor shape never changes,
always staying as a simple arrow pointer.

Referring to the protocol [1], I can't see any messages relating to changing the pointer shape.
So if one was to create the changes necessary to achieve this, would they be acceptable?
Or is there some overriding reason why the GUI protocol does not provide this mechanism?

DF

[1] https://www.qubes-os.org/doc/gui/

[Marek Marczykowski-Górecki]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Having control over cursor shape it may mislead the user actions. While
it shouldn't be a problem inside the same VM, it may be complex to do it
right - to not interfere with windows of other VMs.
In short: without prior proper design, which would be simple and simple
to implement, we don't want to have such feature, at least not by
default.

- --
Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAEBCAAGBQJWfqW3AAoJENuP0xzK19csdnsH/ivMGQC2lMG3KONIKHLazRyp
tubRXmWnci8te9AsJ//xJN+jswaRya0fT2TNcNT0+SyfHiwaLZR/lEyZ0i/mMT7N
aH4VbLD/8XQ2hX18bql01LTcDm2K7o62N9IGEWSynMgwr0b2xPoS8ULZUuZXdtgw
vsE6eSzt84xjnljX87KicqmZ9PqYvtToiZdtttnSKFdK83lHr8uhu58Lu22YSW1M
tSbiR+EgTjOzaoITk+XQ97Zna7pLEPjOV/fWJtIWOHtAaLjQOAeM0I78Pbv6eMLZ
uFWmpjml0068jikQM/072H+aG4pjivZzNWNDMBYfTQMRR1Q2X15Tl7qrxr52yNg=
=jFqE
-----END PGP SIGNATURE-----

[Chris Laprise]

On 12/26/2015 09:35 AM, Marek Marczykowski-Górecki wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA256
>
> Having control over cursor shape it may mislead the user actions. While
> it shouldn't be a problem inside the same VM, it may be complex to do it
> right - to not interfere with windows of other VMs.
> In short: without prior proper design, which would be simple and simple
> to implement, we don't want to have such feature, at least not by
> default.
>
>

It seems to me the cursor would just take on the assigned shape for
whichever window/VM is active. The only security problem I see is if
malware tries to mimic a different UI element (i.e. a menu with a white
or green border)...but without ability to control placement, using that
to exploit would be a lost cause.

Cursor shape is a functional part of the UI, to the point of being
critical for certain apps like spreadsheets and drawing. If Qubes deems
this a possible source of confusion then it should explain the threat
model for cursors (having already done so for windows).

[Marek Marczykowski-Górecki]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

I see the problem, we need to discuss it:
https://github.com/QubesOS/qubes-issues/issues/1551

- --
Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAEBCAAGBQJWgCUxAAoJENuP0xzK19csh88H/20mOn3Lp4fLRner8/69kyPo
bo1eCNDn/HW6aNgTl2zdUlPCLXTlm0rTvJxfE30EcXWDuwkzOXj0pk49k08JKeeQ
gYJHrWnvyeNRrrHj+oz77hrClSKCGphJc1WEXFUrMOCmAe9Eb7syKIJAzUlZofIe
1sCkLIU3YWmw1mrO3euwCrvh13Ah+hQPnwCJa7ZEORqoxSLHkLjL6exbhJuU903w
FICz0CwQHVpOnXVsbHi0s++uza+dMJ2M33JP40jEKOS+sMBK6dj4oLN8jNxYIHNE
omFUfezZxfKvFIKYh6xzOe3RlY9S+dmDawclGb+fj/OA80zl+BhJLpu1BbQR8Ds=
=tzDJ
-----END PGP SIGNATURE-----