[costco]

There's still no solution to the fact that everything by design must be mediated by the compositor. The article mentions protocols but they are far from standard. The assumption is basically just that everyone is going to use wlroots to make a compositor.

Gone are the days of 300 line of code apps like xbindkeys or maim that bind hotkeys or take screenshots and work everywhere. Instead it all must go through the compositor! So if you want to make your own accessibility app, you don't use xlib or xcb, instead you must modify your 30,000 line C code compositor to add a protocol for your app to work. And yes, there's supposed to be wlroots and standardized protocols, but not everyone implements them. So for instance KDE has their [own protocol](https://bbs.archlinux.org/viewtopic.php?id=298864) for screenshotting that's completely different than what wlroots uses.

Wayland is graphical communism designed to prevent a mythical class of software vulnerability. If someone has access to the point where they can read keystrokes on a Xorg system, realistically they already have arbitrary code execution. So yes, they couldn't just run their keylogger binary like they could on X, but there are 10 other things they could do to achieve the same effect. They could change the .xinitrc/other configs to load a modified compositor binary, or use some sort of LD_PRELOAD hook to intercept the "keyboard pressed" function on the compositor, as has been noted many times.