The Patching Friars' AlmanacA calendar of CVE saints

August 16

xtrlockHoly card for xtrlock-multitouch, generated with AI (Claude, Anthropic) for the Lunario dei Frati Patchatori.CC BY-NC-SA 4.0 xtrlock DIGITUS NON CLAUDITUR
🤖 Image and text generated with AI

⬇ Download holy card: ·

Embed on your site

Saint xtrlock Multitouch, Who Let You Touch the Locked Screen

Patron of half-locked screens, touchpads, and gestures nobody had anticipated.

Life

In 2019 it emerged that xtrlock, a tiny program for locking the screen on X11, blocked keyboard and mouse but not multitouch events. In front of a locked laptop one could still scroll, pinch to zoom and even click in the open windows: the lock was there, but only for people who used one finger at a time.

Prayer

O Saint xtrlock Multitouch, who shuts the door and leaves the window open, let our locks count every finger. Amen.

How to celebrate

Celebrated by updating xtrlock to a release that also blocks multitouch, or by keeping your hands in your pockets.

Technical record

Disclosed on
August 16 2019
CVE
CVE-2016-10894

xtrlock through 2.10 does not block multitouch events. Consequently, an attacker at a locked screen can send input to (and thus control) various programs such as Chromium via events such as pan scrolling, "pinch and zoom" gestures, or even regular mouse clicks (by depressing the touchpad once and then clicking with a different finger).

Sources: nvd.nist.gov

Shortcuts: ← → to move, D day, W week, M month, T today.

📅 Add to your calendar

SaintsGoogle CalendarApple, Outlook (.ics)

Observances (feasts, scourges and miracles)Google CalendarApple, Outlook (.ics)

In Google Calendar you can also paste the URL in Settings → Add calendar → From URL. The first sync can take a few hours.