InHand — Classroom Management for macOS
A macOS classroom management system — enforce wallpapers, broadcast the teacher's screen and view any student's screen from one dashboard over the school LAN.
Built with
Electron · Socket.io · WebRTC
Security
Ed25519-signed · ECIES-encrypted
Transport
Private LAN
InHand is a classroom management system for macOS. From one dashboard the teacher enforces wallpapers on every student Mac, broadcasts their own screen to the class and opens any student's screen live. It is built on Electron, Socket.io and WebRTC, and every privileged action is signed and encrypted.
Two apps, one classroom
- Host — the teacher's dashboard: live device list, wallpaper enforcement, screen broadcast, per-student view.
- Client — a background utility on each student Mac that enforces the wallpaper and takes part in screen sharing without needing attention.
Why the client is split into three parts
macOS records permissions against an app's signature, and replacing the app resets them. The client therefore splits into a main app that updates freely and two root-owned helpers that hold the one-time grants and almost never change: screen capture and the LAN firewall. Installing and updating never touches the helpers by default, so the grants survive every update.
Discovery, no per-student setup
The teacher registers the school once. Each client then finds the teacher automatically through a cloud-signed discovery response — no server address, no PIN.
Screen sharing
WebRTC, peer to peer. Broadcast puts the teacher's screen on every student Mac; view-student opens one student's live screen on top of the broadcast without interrupting it.
LAN-only mode
One signed command switches a client to LAN-only: the macOS packet filter blocks internet traffic while LAN traffic keeps working, so the machine stays reachable and the class keeps functioning. The lock auto-releases, and unlocking requires the teacher's signature.
Security posture
- Every privileged teacher→client event is Ed25519-signed and replay-protected; client→teacher traffic is ECIES-encrypted.
- Commands come from a whitelist, so there is no free shell on clients.
- Commands and screen sharing only work on the private LAN.
- The client is rootless; the only privileged component is the firewall helper.
- Both sides keep an audit log of key events.