7 ms·
Security is the wedge. If something's complex, you can't tell if a failure is due to a transient fault, a bug, or an attack. In the meanwhile, each X11 applica
by danieldk 11y ago
Security is the wedge. If something's complex, you can't tell if a failure is due to a transient fault, a bug, or an attack.
In the meanwhile, each X11 application can read other X11 applications' keystrokes or obtain its windows contents. Moreover, the desktop security model is still 'an application should be able to touch everything in a user's home directory'.
So, honestly, I don't think security is a good argument for BSD or Linux on the desktop or laptop, especially compared to OS X (which has GUI isolation and application sandboxing).
Wayland will improve things a lot, but it will take some time before it replaces X11 completely and everywhere.
- fulafel 11y agoUnix apps running under the same user account run in the same security domain, so a security boundary in the window system does not help by itself. Qubes OS is currently the best thing for this on the desktop. OS X sandboxing has proven to be pretty porous.
- rdl 11y agoYeah, I believe in system-dedicated or system-high. Physical machines dedicated to very specific tasks, all at the same level. Virtualization is sort of at the level where you can then virtualize those dedicated machines (Qubes style), but there's an argument for dedicated $20 computers, too.