4 ms·

What's a desktop and what does it mean to share it? My applications share an X11 display, and if I'm not mistaken, they are pretty well isolated from each othe

by 08-15 8y ago

What's a desktop and what does it mean to share it? My applications share an X11 display, and if I'm not mistaken, they are pretty well isolated from each other. (Are you referring to MicroSoft Windows[TM] by any chance? Yeah, that's different.)

dasyatidprime 8y ago
What are you using for X security context isolation? I've been wanting a good solution for that one for a while now, and the end of my list is still “write my own isolating proxy” since I never found a good one.
- e12e 8y ago
  See: https://www.qubes-os.org/doc/gui/ https://www.qubes-os.org/doc/gui/ (they have essentially written 2500 lines of c that acts as a proxy of sorts)
- 08-15 8y ago
  Nothing... but can X11 applications actually steal data from each other? I wouldn't know how to do that, but I know precious little about the X11 protocol. (Screen shots are an awkward option, I guess.) If I was worried enough (I'm not), I could use multiple logins. Two different X servers under different users would be completely isolated.
  - icebraining 8y ago
    Even using two X servers under two logins, the fact is that desktop apps by default have much more freedom and therefore much more surface to attack. Even the kernel syscalls alone are not safe; exploits that elevate processes to root are not rare. You'd need to lock them down much more than just using different users. By the way, they may have an history, but nowadays I wouldn't bet on the security of the average distro vs Windows, and I say this as a dyed-in-the-wool Debian user. For example, their Desktop environment does have protections against cross-application attacks, unlike X.
e12e 8y ago
> My applications share an X11 display, and if I'm not mistaken, they are pretty well isolated from each other. You are probably mistaken. https://github.com/esonn/x11log https://github.com/esonn/x11log http://blog.martin-graesslin.com/blog/2015/01/why-screen-lockers-on-x11-cannot-be-secure/ http://blog.martin-graesslin.com/blog/2015/01/why-screen-loc... You might want to look at qubesos : https://www.qubes-os.org/doc/gui/ https://www.qubes-os.org/doc/gui/
bigiain 8y ago
I dunno if it's still true, but it used to be that every process running in your X11 window had access to every keystroke from every other application. Like, say, every password you type into a terminal window or browser... If it _is_ still true (and I've noticed a bit of recent discussion asking why Ubuntu 18LTS is switching back from Wayland to X11 which hints to me that it might be), then your apps are _very_ much not "pretty well isolated"...

by 08-15 8y ago

dasyatidprime 8y ago

What are you using for X security context isolation? I've been wanting a good solution for that one for a while now, and the end of my list is still “write my own isolating proxy” since I never found a good one.

e12e 8y ago
See: https://www.qubes-os.org/doc/gui/ https://www.qubes-os.org/doc/gui/ (they have essentially written 2500 lines of c that acts as a proxy of sorts)
08-15 8y ago
Nothing... but can X11 applications actually steal data from each other? I wouldn't know how to do that, but I know precious little about the X11 protocol. (Screen shots are an awkward option, I guess.) If I was worried enough (I'm not), I could use multiple logins. Two different X servers under different users would be completely isolated.
- icebraining 8y ago
  Even using two X servers under two logins, the fact is that desktop apps by default have much more freedom and therefore much more surface to attack. Even the kernel syscalls alone are not safe; exploits that elevate processes to root are not rare. You'd need to lock them down much more than just using different users. By the way, they may have an history, but nowadays I wouldn't bet on the security of the average distro vs Windows, and I say this as a dyed-in-the-wool Debian user. For example, their Desktop environment does have protections against cross-application attacks, unlike X.

e12e 8y ago

> My applications share an X11 display, and if I'm not mistaken, they are pretty well isolated from each other. You are probably mistaken. https://github.com/esonn/x11log https://github.com/esonn/x11log http://blog.martin-graesslin.com/blog/2015/01/why-screen-lockers-on-x11-cannot-be-secure/ http://blog.martin-graesslin.com/blog/2015/01/why-screen-loc... You might want to look at qubesos : https://www.qubes-os.org/doc/gui/ https://www.qubes-os.org/doc/gui/

bigiain 8y ago

I dunno if it's still true, but it used to be that every process running in your X11 window had access to every keystroke from every other application. Like, say, every password you type into a terminal window or browser... If it _is_ still true (and I've noticed a bit of recent discussion asking why Ubuntu 18LTS is switching back from Wayland to X11 which hints to me that it might be), then your apps are _very_ much not "pretty well isolated"...