Scary keystroke logging dialog on macOS 10.15 Catalina (JDK-8231513)

[Sebastian Stenzel]

> To: Mac app developers / users
> 
> I started looking into JDK-8231513 [1] -- "JavaFX cause Keystroke Receiving prompt on MacOS 10.15 (Catalina)" -- a couple days ago. The effect of this bug is that a scary dialog is shown for all users the first time they run a JavaFX application and move the mouse is moved into the JavaFX window. It also is reported to block apps from being accepted in the Apple store.
> 
> This bug is caused by a change in macOS 10.15 to require additional permissions for using CGEventTap, which JavaFX uses to track touch events.
> 
> The suggested replacement API, NSEvent::addLocalMonitorForEventsMatchingMask, works just differently enough (it tracks events delivered to a specific view, whereas the current code is implemented using a global monitor and a global set of touch points), that it would be too risky to change it this late in the release.
> 
> Since there isn't an easy / safe fix that is feasible for JavaFX 14, I wanted to get some input from Mac users on the list. I can think of the following possibilities for JavaFX 14:
> 
> 1. Do nothing (defer the bug to FX 15)
> 2. Disable touch events completely if running on macOS 10.15 (or later) -- we could consider a system property to re-enable it, but I don't really like that idea, and I'm not sure how useful it would be anyway since setting that flag would cause the scary dialog again.
> 3. Defer enabling of touch events until the first time the application requests them -- this would require new interfaces in Glass, isn't risk free, and doesn't solve the dialog problem for those apps that do use touch.
> 
> I'm leaning towards option #2 (without the system property to force enable it), but wanted to get a sense from app developers as to whether that would be more of a problem than doing nothing (i.e., option #1). I only listed option #3 for completeness, since it doesn't really solve the issue.
> 
> Whatever we do for 14, the solution for 15 will very likely be to switch to tracking per-View (per Window) touch events, either directly, or maybe using local event monitoring.
> 
> -- Kevin
> 
> [1] https://bugs.openjdk.java.net/browse/JDK-8231513 <https://bugs.openjdk.java.net/browse/JDK-8231513>
I'd also vote for #2 as a quickly available workaround (not as a long-term fix, though). Here are my thoughts:

Are there any (non-hackintosh) devices running macOS that have touch screens at all? Recent MacBooks have this thing called Touch Bar, which caused problems with JavaFX apps in the past (touching it crashed the application - is this related?). I'm not even sure why the touch event handling exists on macOS in the first place. Is it only the attempt to implement a Glass API that is intended for different device classes?

Maybe touch events are facilitated by applications that register events on third party devices like graphics tablets. If there are applications out there using it, we should have some flag to reenable it (despite the "scary dialog"). Otherwise I think it is fair to just disable it all together.