8 ms·

Like most of what freedesktop.org does (pretty much since dbus), I look at Wayland and think, "hmm... that's a probably-interesting solution to a set of problem

Like most of what freedesktop.org does (pretty much since dbus), I look at Wayland and think, "hmm... that's a probably-interesting solution to a set of problems I just don't have." I've never in my life seen this "tearing" that people keep complaining about. OTOH I use X's network transparency daily. I'm sure several years from now Wayland will be able to replicate the use cases I get now from X, at which point I'll probably switch. So, I wish the best to the people working on it, even if I scratch my head over their intentions.

lomnakkus 10y ago
There's really very little standing in the way of network transparency: https://blogs.s-osg.org/wow-wayland-over-wire/ https://blogs.s-osg.org/wow-wayland-over-wire/
- bandrami 10y ago
  Which is why I'm pretty confident that in a few years it will be available, at which point I'll think about using Wayland, particularly since it will probably be getting the lion's share of updates by then.
madez 10y ago
I see tearing often and it bothers me a lot. Also, if you run a program with gui in X you will need to trust that program to act in your best interest since X doesn't protect against malicious clients. When I start a game on my computer, I do not want to have to trust it to behave nicely.
- bandrami 10y ago
  I mean, that's a great example of what I'm saying: worrying about an application screen-scraping my display (which is the only protection Wayland provides) is a kind-of-interesting thought experiment that I just don't care about.
  - maggit 10y ago
    For completeness; Wayland also protects against keyloggers. In Wayland, input events are sent only to the application that hosts the window into which the input goes. So, keyboard events go to the app that has the keyboard focus. I'm not sure exactly how X works here. I think as long as you have a visible window (1x1 pixel or more), you can get all keyboard input. This may or may not be central to your point, but I wanted to have it out there to better inform about how Wayland improves upon X :)
    - bandrami 10y ago
      Yes and no. Wayland protects from userspace keyloggers after libevent gets its hands on a keystroke. (For that matter, it also doesn't protect against screenscrapers that simply look at video memory.)
      - zokier 10y ago
        Doesn't exploiting both of those require root privileges? Protecting against malicious code running as root seems like a lost cause anyways..
        bandrami 10y ago
        In a system that doesn't use capabilities, generally yes (though, again, even simply with group ownership of devices you can do a lot of stuff that in traditional configurations requires root). But capabilities have managed to sneak into everything nowadays.
        nixos 10y ago
        Once you have regular user access, root is easy: http://security.stackexchange.com/questions/119410/why-should-one-use-sudo/119420#119420 http://security.stackexchange.com/questions/119410/why-shoul...
        zokier 10y ago
- pdkl95 10y ago
  > X doesn't protect against malicious clients Nor should it. That kind of sandboxing should be done as a wrapper around a particular program, not in the display server. A nested X server that sanitizes the protocol wouldn't be particularly difficult. Also, if your aren't fully sandboxing your potentially hostile application, a keylogger is the least of your problems. The display server isn't going to protect you from actual local attacks and privilege escalations; instead, it will only provide a false sense of security. Furthermore, doing this in the display server itself is shortsighted and unfortunately typical of the freedesktop.org development style that refuses to consider use cases outside their limited personal experience. I use the ability to send synthetic keyboard and mouse events to arbitrary X clients regularly. Occasionally I use the ability to keylog to work around poorly written software. If Wayland refuses to support these features, it isn't compatible with my software. Security is important, but simply removing features isn't the solution. Gnome/KDE may be popular, but many of us have software that uses X directly. Some of it written before those "desktop environments" even existed.
  - beagle3 10y ago
    > Nor should it. That kind of sandboxing should be done as a wrapper around a particular program, not in the display server. A nested X server that sanitizes the protocol wouldn't be particularly difficult. Also, if your aren't fully sandboxing your potentially hostile application, a keylogger is the least of your problems. The display server isn't going to protect you from actual local attacks and privilege escalations; instead, it will only provide a false sense of security. Nested X servers are a pain, if you've used one - the things you're used to, like functional copy/paste, performant operation, tend to disappear and make this a non-workable solution. Furthermore, if you look at the release not of (e.g.) firejail, a wrapper around a local program, you'll notice that indeed a lot of the revisions are trying to avoid X bugs that let applications act as key-loggers etc. People have tried, and it turns out to be difficult.
- michaelmrose 10y ago
  I remain entirely unconvinced that anything short of virtualization protects you from malicious clients and that the primary effective security measure we can take is installing from trusted sources. It seem that the same people that believe we need to secure our display server against malicious clients almost inevitably want some sort google play store like experience where people release software for linux in some sort of universal way wherein distros would have no input rather than repo concept that is traditional now. I feel like they haven't thought this through and will leave us on net substantially less secure.
senko 10y ago
> I've never in my life seen this "tearing" that people keep complaining about. Here's one data point: It has caused endless troubles on a digital signage project I worked on a couple of years ago. Having a proper solution then would save us tons of hours trying various workarounds to minimize the effect (while at the same time having decent performance). On the other hand, the last time I (successfully) used X's network transparency was back in '98 on a couple of Sun workstations (when I had access -- most of the time it was VT220 instead :) Since then, every time I did try it, I ended up regretting it since the bandwidth and the latency were too poor for any sane usage (VNC ended up working way better). Which is not to say networked X is not valuable -- just that it's misleading to think you're (or myself, for that matter) a typical user.
- derefr 10y ago
  As you say, anything networked X can do, VNC can do better. I can't help but think, though, that the arrangement we have now—where VNC servers on ⋆nix are implemented in terms of being a sort of pixbuf caching proxy for the local X server—is actually a nice, optimal arrangement that allows for a good separation of concerns. It's a bit like Mapbox: you've got a database full of semantic geometry state that applications can poke (the X server), and then you've got a fronting daemon that renders, serves, and caches graphical "tiles" created by querying that geometry (the VNC server), along with exposing a protocol through which clients can easily poke at the database by referring to it in terms of the tile-server's screen coordinates. Also, other people might say it's clumsy, but personally I really enjoy the architecture of containerized GUI apps: you've got xvfb running in the container as an X server, and then x11vnc or the like also running in there, talking to xvfb, serving VNC "tiles" and receiving key and pointer inputs over a socket. It's like the OSI network layers: X11 is the application layer, VNC is the presentation layer.
  - bandrami 10y ago
    anything networked X can do, VNC can do better VNC does single window clients which interact with the primary and secondary selections on the display server now?
- 10y ago
nwah1 10y ago
The point is that the X Server is an ancient mess of code held together by duct tape, with countless deprecated APIs. Most login managers don't even let you run it rootless, which means the vast majority of desktop users have all this running as root, and rootless X wasn't even possible until very recently... and was motivated by Wayland anyways. So the point of Wayland is to have a clean and simple foundation, with no obvious security vulnerabilities, no overhead, and no kludgey workarounds or ancient APIs.
- bandrami 10y ago
  Ah, the "throw away decades of bug fixes because This Time We'll Do It Right" temptation. I definitely get that sense from Wayland, which is a reason I'm leaving it alone for several years until it builds up the kind of fixes (a.k.a. "bloat" or "cruft") that make X11 Just Work for me. As far as the user permissions, fair enough, though I personally think hardware access should require root, for the most part.
  - cmurf 10y ago
    You think average Joe User needs to be root or an admin capable of using sudo, to format a USB stick, or use a printer already connected to the computer? There is something that a locally logged in user is privileged to do without needing to be or become root. Apple and Microsoft have tossed out their window managers more than once also. X is older than anything they've had.
    - bandrami 10y ago
      You think average Joe User needs to be root or an admin capable of using sudo, to format a USB stick, or use a printer already connected to the computer? I do, yes, which is why I avoid things like PAM and all the various FOO-kits (sadly Slackware has since succumbed to consolekit, which is why I've been moving to OpenBSD). I want to know that anything I do as my user without su or sudo or doas (depending) will not have an impact outside of my home directory. (Though to be clear, I think a display server could conceivably be justified for a dedicated non-root user -- fbterm seems like a good model here: getty hands over the VT to a user who has write access to the framebuffer.)
jmclnx 10y ago
> I use X's network transparency daily Same here, it is the one feature I need. Then again I have seen 'tearing', but only when using nouveau, I still have hopes of nouveau, I really wish NVIDA would help out more than they have been with nouveau. Knowing what I know now, I would not have bought a MB with integrated NVIDIA graphics. My NVIDIA Chip will soon be out of support, so I will be faced with either buying a new graphic card or living with nouveau.
- bandrami 10y ago
  Yeah, ever since I got very irritated with a radeon card I've used intel exclusively, other than an ancient laptop I had with a trident card. I don't think I've ever even tried nvidia, and with the things I read about it online I'm glad.
renox 10y ago
1) the X developers thinks that an X server is too hard to maintain, so they're deprecating X, so eventually it will be a problem for you. 2) X cannot provide a secure environment, this is a problem for users. Wayland is at lower lever than X and it's 'security by default' creates problem so replicating the use case you get from X will take time and many synchronisation/interoperability efforts.

lomnakkus 10y ago

There's really very little standing in the way of network transparency: https://blogs.s-osg.org/wow-wayland-over-wire/ https://blogs.s-osg.org/wow-wayland-over-wire/

bandrami 10y ago
Which is why I'm pretty confident that in a few years it will be available, at which point I'll think about using Wayland, particularly since it will probably be getting the lion's share of updates by then.

madez 10y ago

I see tearing often and it bothers me a lot. Also, if you run a program with gui in X you will need to trust that program to act in your best interest since X doesn't protect against malicious clients. When I start a game on my computer, I do not want to have to trust it to behave nicely.

bandrami 10y ago
I mean, that's a great example of what I'm saying: worrying about an application screen-scraping my display (which is the only protection Wayland provides) is a kind-of-interesting thought experiment that I just don't care about.
- maggit 10y ago
  For completeness; Wayland also protects against keyloggers. In Wayland, input events are sent only to the application that hosts the window into which the input goes. So, keyboard events go to the app that has the keyboard focus. I'm not sure exactly how X works here. I think as long as you have a visible window (1x1 pixel or more), you can get all keyboard input. This may or may not be central to your point, but I wanted to have it out there to better inform about how Wayland improves upon X :)
  - bandrami 10y ago
    Yes and no. Wayland protects from userspace keyloggers after libevent gets its hands on a keystroke. (For that matter, it also doesn't protect against screenscrapers that simply look at video memory.)
    - zokier 10y ago
      Doesn't exploiting both of those require root privileges? Protecting against malicious code running as root seems like a lost cause anyways..
      - bandrami 10y ago
        In a system that doesn't use capabilities, generally yes (though, again, even simply with group ownership of devices you can do a lot of stuff that in traditional configurations requires root). But capabilities have managed to sneak into everything nowadays.
      - nixos 10y ago
        Once you have regular user access, root is easy: http://security.stackexchange.com/questions/119410/why-should-one-use-sudo/119420#119420 http://security.stackexchange.com/questions/119410/why-shoul...
        zokier 10y ago
pdkl95 10y ago
> X doesn't protect against malicious clients Nor should it. That kind of sandboxing should be done as a wrapper around a particular program, not in the display server. A nested X server that sanitizes the protocol wouldn't be particularly difficult. Also, if your aren't fully sandboxing your potentially hostile application, a keylogger is the least of your problems. The display server isn't going to protect you from actual local attacks and privilege escalations; instead, it will only provide a false sense of security. Furthermore, doing this in the display server itself is shortsighted and unfortunately typical of the freedesktop.org development style that refuses to consider use cases outside their limited personal experience. I use the ability to send synthetic keyboard and mouse events to arbitrary X clients regularly. Occasionally I use the ability to keylog to work around poorly written software. If Wayland refuses to support these features, it isn't compatible with my software. Security is important, but simply removing features isn't the solution. Gnome/KDE may be popular, but many of us have software that uses X directly. Some of it written before those "desktop environments" even existed.
- beagle3 10y ago
  > Nor should it. That kind of sandboxing should be done as a wrapper around a particular program, not in the display server. A nested X server that sanitizes the protocol wouldn't be particularly difficult. Also, if your aren't fully sandboxing your potentially hostile application, a keylogger is the least of your problems. The display server isn't going to protect you from actual local attacks and privilege escalations; instead, it will only provide a false sense of security. Nested X servers are a pain, if you've used one - the things you're used to, like functional copy/paste, performant operation, tend to disappear and make this a non-workable solution. Furthermore, if you look at the release not of (e.g.) firejail, a wrapper around a local program, you'll notice that indeed a lot of the revisions are trying to avoid X bugs that let applications act as key-loggers etc. People have tried, and it turns out to be difficult.
michaelmrose 10y ago
I remain entirely unconvinced that anything short of virtualization protects you from malicious clients and that the primary effective security measure we can take is installing from trusted sources. It seem that the same people that believe we need to secure our display server against malicious clients almost inevitably want some sort google play store like experience where people release software for linux in some sort of universal way wherein distros would have no input rather than repo concept that is traditional now. I feel like they haven't thought this through and will leave us on net substantially less secure.

senko 10y ago

> I've never in my life seen this "tearing" that people keep complaining about. Here's one data point: It has caused endless troubles on a digital signage project I worked on a couple of years ago. Having a proper solution then would save us tons of hours trying various workarounds to minimize the effect (while at the same time having decent performance). On the other hand, the last time I (successfully) used X's network transparency was back in '98 on a couple of Sun workstations (when I had access -- most of the time it was VT220 instead :) Since then, every time I did try it, I ended up regretting it since the bandwidth and the latency were too poor for any sane usage (VNC ended up working way better). Which is not to say networked X is not valuable -- just that it's misleading to think you're (or myself, for that matter) a typical user.

derefr 10y ago
As you say, anything networked X can do, VNC can do better. I can't help but think, though, that the arrangement we have now—where VNC servers on ⋆nix are implemented in terms of being a sort of pixbuf caching proxy for the local X server—is actually a nice, optimal arrangement that allows for a good separation of concerns. It's a bit like Mapbox: you've got a database full of semantic geometry state that applications can poke (the X server), and then you've got a fronting daemon that renders, serves, and caches graphical "tiles" created by querying that geometry (the VNC server), along with exposing a protocol through which clients can easily poke at the database by referring to it in terms of the tile-server's screen coordinates. Also, other people might say it's clumsy, but personally I really enjoy the architecture of containerized GUI apps: you've got xvfb running in the container as an X server, and then x11vnc or the like also running in there, talking to xvfb, serving VNC "tiles" and receiving key and pointer inputs over a socket. It's like the OSI network layers: X11 is the application layer, VNC is the presentation layer.
- bandrami 10y ago
  anything networked X can do, VNC can do better VNC does single window clients which interact with the primary and secondary selections on the display server now?
10y ago

nwah1 10y ago

The point is that the X Server is an ancient mess of code held together by duct tape, with countless deprecated APIs. Most login managers don't even let you run it rootless, which means the vast majority of desktop users have all this running as root, and rootless X wasn't even possible until very recently... and was motivated by Wayland anyways. So the point of Wayland is to have a clean and simple foundation, with no obvious security vulnerabilities, no overhead, and no kludgey workarounds or ancient APIs.

bandrami 10y ago
Ah, the "throw away decades of bug fixes because This Time We'll Do It Right" temptation. I definitely get that sense from Wayland, which is a reason I'm leaving it alone for several years until it builds up the kind of fixes (a.k.a. "bloat" or "cruft") that make X11 Just Work for me. As far as the user permissions, fair enough, though I personally think hardware access should require root, for the most part.
- cmurf 10y ago
  You think average Joe User needs to be root or an admin capable of using sudo, to format a USB stick, or use a printer already connected to the computer? There is something that a locally logged in user is privileged to do without needing to be or become root. Apple and Microsoft have tossed out their window managers more than once also. X is older than anything they've had.
  - bandrami 10y ago
    You think average Joe User needs to be root or an admin capable of using sudo, to format a USB stick, or use a printer already connected to the computer? I do, yes, which is why I avoid things like PAM and all the various FOO-kits (sadly Slackware has since succumbed to consolekit, which is why I've been moving to OpenBSD). I want to know that anything I do as my user without su or sudo or doas (depending) will not have an impact outside of my home directory. (Though to be clear, I think a display server could conceivably be justified for a dedicated non-root user -- fbterm seems like a good model here: getty hands over the VT to a user who has write access to the framebuffer.)

jmclnx 10y ago

> I use X's network transparency daily Same here, it is the one feature I need. Then again I have seen 'tearing', but only when using nouveau, I still have hopes of nouveau, I really wish NVIDA would help out more than they have been with nouveau. Knowing what I know now, I would not have bought a MB with integrated NVIDIA graphics. My NVIDIA Chip will soon be out of support, so I will be faced with either buying a new graphic card or living with nouveau.

bandrami 10y ago
Yeah, ever since I got very irritated with a radeon card I've used intel exclusively, other than an ancient laptop I had with a trident card. I don't think I've ever even tried nvidia, and with the things I read about it online I'm glad.

renox 10y ago

1) the X developers thinks that an X server is too hard to maintain, so they're deprecating X, so eventually it will be a problem for you. 2) X cannot provide a secure environment, this is a problem for users. Wayland is at lower lever than X and it's 'security by default' creates problem so replicating the use case you get from X will take time and many synchronisation/interoperability efforts.