PLATFORM COVERAGE
Same questions.
Different OS evidence.
Collector implementations exist for Windows, macOS and Linux. Actual coverage depends on the OS, drivers, permissions and session.
| Capability | macOS | Windows | Linux |
|---|---|---|---|
| Raw EDID | Legacy and Apple Silicon I/O Registry profiles, uniquely matched | Active WMI blocks; registry cache labeled separately | Readable DRM connector sysfs EDID |
| Identity & active settings | CoreGraphics; System Profiler names, serials, firmware | WMI + user32 mode, rotation and primary | DRM identity; X11 mode/refresh when available |
| Desktop geometry | Online bounds, pixels, scale and rotation | Pixel bounds and rotation; scale unavailable | X11 xrandr; Wayland geometry unavailable |
| Display-change monitoring | Reconfiguration callbacks + polling | Polling; native events not implemented | DRM netlink wakeups + polling |
| Mirroring | Confirmed OS mirror relation | Clone-path analysis unavailable | Matching X11 geometry is an indirect indicator |
| Remote context | Unavailable | Narrow process-session metric; false negatives possible | SSH environment is an indirect indicator |
| Global capture detection | Unavailable | Unavailable | Unavailable |
| Hardware validation | One live configuration verifiedApple Silicon + Pro Display XDR | Fixtures onlyNative Windows untested | Fixtures onlyNative Linux untested |
VERIFIED HERE
A real Mac. A complete profile.
On an Apple Silicon Mac, the beta read a Pro Display XDR at 6016 × 3384 and 60 Hz, with a complete 768-byte EDID and six valid block checksums. Its name, OS identity, firmware and transport metadata were displayed and the raw download matched the collected bytes.
This validates that configuration—not every Mac, adapter, monitor or hotplug path. Physical hotplug delivery remains untested.
PARSER COVERAGE
Preserved does not mean decoded.
The parser implements base EDID 1.x, block checksums, selected structural checks and a subset of CTA capabilities. DisplayID and unknown extension payloads are retained but are not fully decoded.
Passing implemented checks is not full standards conformance or hardware attestation. An OS-exposed “live” profile may still originate from a driver cache or override.
Capture indicators and the Peek-o-Meter
Live metadata checks watch bounded screenshot folders and known capture/sharing executable names every five seconds, independently of EDID collection. Clipboard image-format checks are optional and off by default; Linux clipboard monitoring is unavailable.
A screenshot-like file may have been copied, and an open application may be idle. No screen or clipboard contents are read. Reliable system-wide capture absence cannot be established.
Mac screenshot-file, executable-name and optional metadata-marker probes were exercised. Clipboard adapters have fixture coverage; Windows and Linux native execution remain untested.
Permissions and resource requirements
macOS: normal host access to read-only CoreGraphics, I/O Registry and System Profiler. No screenshot/accessibility permission requested.
Windows: PowerShell/CIM access to root/wmi, user32 and readable display registry keys. Organization policy can restrict these sources.
Linux: readable /sys/class/drm, optionally xrandr and an accessible X11 session. Containers may block netlink events or hardware metadata.
Packaging is separate from collection
The portable Python package is intended for all three platforms. A native Mac app may be offered on the download page. Windows/Linux native executables and an Intel Mac app build are not yet published. Optional pywebview hosting is available from source, but native webview startup and installers are not validated across all environments.
A boundary that stays visible
EDID alone cannot reliably reveal downstream capture hardware. Unavailable telemetry is unknown, and anomalies do not establish misconduct. The beta provides evidence for research and troubleshooting; it does not provide a comprehensive proctoring detector or an automated disciplinary verdict.