I think a warning for "running Wireshark/tshark as root is dangerous" is
very appropriate. There is a legitimate discussion to be had on whether
it should be more or less forceful and what to do about Kali.
I agree, but it should not require any feedback from the user (as clicking on a button) or it should be possible to deactivate it. But if we rely on some action on the way it is run (like setting an option or an env var) we could end up to nothing since it is under the control of the distribution, not ours.
Something appearing in the toolbar, in the titlebar or in whatever bar sounds good to me, but I guess it should be done from the core, not from init.lua.
The 2 changes proposed by Peter sound good to me as well.
