Re: master 4b98a79a50: Improve X event timestamp tracking

[Daniel Colascione]

On Sun, 2022-08-07 at 13:26 +0800, Po Lu wrote:
> The window manager doesn't get to decide what the
> author of some Lisp code wanted.

Yes, it does. That's the whole point of being the window manager. Are
you suggesting that application developers, not users, ought to get
the final word on what windows go where?

> Our users and developers are not sloppy programmers who write code that
> steals focus from other windows for no reason whatsoever.  

Yes, they are sloppy, just like all other users and developers, you
and me included, are sloppy. What's the old quip? Ah, right: "If men
were angels, no laws would be necessary". If developers were perfect,
we wouldn't need ASLR, or memory protection, or file permissions, or
fuzzing, or memory-safe languages --- yet here we are.

Developers of Emacs are no more angelic than developers using any
other toolkit, and focus stealing prevention mitigates their mistakes
as much as it does any others. If a user doesn't want focus stealing
preventation, he can disable it or use a window manager that doesn't
provide it. It's not the place of Emacs to override the user's
preference.

> The intent is
> demonstrated by code calling x-focus-frame being written.

If a process filter tries to asynchronously raise a window when the
user is the middle of browsing cat pictures, and that user has
configured his WM to block attempts by applications in the background
to raise windows, the WM is right to block that raise attempt. The WM
is where policy belongs.

> > server.el is a special case: it's okay to break the usual event
> > ordering here because the user *did* interact with Emacs, albeit
> > through a side channel, not the X server. It's not that developers
> > need to call two functions to make some API work, but rather,
> > developers should call an additional function to communicate
> > information to the core that allows an otherwise forbidden-by-design
> > state transition to occur after all.
> 
> Why would the activation otherwise be "forbidden-by-design" (_our_
> design, not the design of the window manager authors?)  Focus stealing
> prevention doesn't exist on any other platform we support, so
> x-focus-frame always works there.  
> 

It does exist elsewhere. From MSDN's page on SetForegroundWindow
(https://docs.microsoft.com/en-us/windows/win32/api/winuser/nf-winuser-setforegroundwindow)
:

  The system restricts which processes can set the foreground window.
  A process can set the foreground window only if one of the
following
  conditions is true:

  * The process is the foreground process.

  * The process was started by the foreground process.

  * The process received the last input event.

  * There is no foreground process.

  * The process is being debugged.

  * The foreground process is not a Modern Application or the
    Start Screen.

  * The foreground is not locked (see LockSetForegroundWindow).

  * The foreground lock time-out has expired (see *
    SPI_GETFOREGROUNDLOCKTIMEOUT in SystemParametersInfo).

  * No menus are active.


Also from that page:

  A process that can set the foreground window can enable another
  process to set the foreground window by calling the
  AllowSetForegroundWindow function. The process specified by
  dwProcessId loses the ability to set the foreground window the next
  time the user generates input, unless the input is directed at that
  process, or the next time a process calls AllowSetForegroundWindow,
  unless that process is specified.

Guess what API emacsclient calls.

> As such, users expect the same from
> X.  This is compounded by the fact that x-focus-frame says nothing about
> requiring "user interaction" before the frame is activated.
> 
> > In other words, the clean abstraction *is* telling Emacs "Oh, by the
> > way, the user interacted with this frame", not telling x-focus-frame
> > "please, actually do your job for some reason". There's nothing X-
> > specific about giving the Emacs core a hint that the user recently
> > interacted with a frame in some manner not reflected in the normal
> > flow of events. If most window systems want to ignore this hint,
> > that's fine, but that doesn't make the hint a leaky abstraction.
> 
> It is a leaky abstraction because such a hint only exists on X, and was
> never ever part of Emacs design.  Other window systems don't "ignore
> this hint", because such a hint simply does not exist.

It's a generic hint that only one or two backends care about right
now. That's not the same as a leaky abstraction.

> 
> > Don't you think it is the job of server.el to tell that window system
> > core code a fact that it wouldn't have otherwise known --- that the
> > user interacted with the frame in some manner the window system
> > wouldn't have otherwise know about?
> 
> No.  Lisp code not a platform implementation detail (be it in server.el
> or whatever) does not have to know about this at all.

Platform-implementation code shouldn't have to know about platform
specifics. That's why frame operations should be generic and
polymorphic, not ad-hoc and gated behind type tests.

I'll say it again: server.el hinting to Emacs that the user has
interacted with a frame is not an implementation detail of a window
system.

> 
> > I think an invocation of gnuserver that raiess a window ought to count
> > as interaction. There are probably other use-cases as well.
> 
> No, it's not.  There is an actual startup notification protocol, but
> it's not well suited for implementation in emacsclient.

Startup notification isn't suitable here because we're not starting
anything.

> 
> > Yes. Ideally, we'd detect in emacsclient that emacsclient and emacs
> > were running on the same X server and transmit the command buffer as
> > a ClientEvent --- and we'd update our user timestamp when we got that
> > event, giving us a globally correct event ordering. In the meantime,
> > the "user interacted out of band" hint seems like the most
> > conservative approach for working around focus stealing mitigations.
> 
> Client events don't include timestamps, so while you can ensure "correct
> event ordering" with those, you cannot get the server time from them.

Emacsclient could include *its* server time in the message.

> The actual protocol here is the startup notification protocol, which
> emacsclient doesn't support for an obvious reason.

Well, a related protocol would be nice. Feel free to propose one.