7 ms·

>This lists quite a few assumptions. Are there many distributions that provide these assumptions out of the box (specifically, the compositor running all applic

>This lists quite a few assumptions. Are there many distributions that provide these assumptions out of the box (specifically, the compositor running all applications, and all applications being sandboxed)? It's not the Wayland compositor's responsibility to provide an entire security solution, just like it's not the deadbolt manufacturer's responsibility to install an alarm system and security cameras. This isn't a criticism of Wayland, at best it's a criticism of your Linux distro. Flatpak does answer this question, but fwiw in the Sway camp we're still looking into lighter-weight solutions. >A Wayland compositor needs to implement: - the display server - the window manager - the compositor - the hotkey daemon - the screenshotting tool - everything else that is now unimplementable in Wayland, but needs to be in the Wayland compositor because users need them and Wayland compositor implementers have no choice but to provide the features as API extensions. This is only partially true. wlroots implements screenshots the same way that xorg-server does: by providing an API for exporting pixels to clients. The actual screenshot tool is a standalone program which can crash without affecting the compositor. This design is virtually identical to X, except easier to secure. The same can be said of many of your other points.

deleted 8y ago
[deleted]
nurettin 8y ago
Let's say every attack vector exposed by wayland involves user being root or somehow having sudo access or somehow being exempt in pam or somehow having special access to input devices or being promoted through an ssh config or being promoted through a vpn config. That is still a huge attack vector considering that the userbase is desktop users and not companies with security teams.
- ddevault 8y ago
  If you expect Wayland to protect users who give arbitrary programs root access, I have nothing more to say to you.
  - nurettin 8y ago
    I expect attack vectors to be equal or less than X. Also consider what I wrote instead of repeating the same mantra of full root access.
    - mort96 8y ago
      I don't quite understand. A rouge root user in X can just replace the /usr/bin/X binary with their own version which records the screen and logs user input or does whatever they want the next time the user restarts X, or better yet, install a kernel module of their own and have arbitrary code running in ring 0. What exact attack vectors do you see in X which you don't see in Wayland, which actually makes a difference and isn't completely overshadowed by all the other things a root user can do?
      - nurettin 8y ago
        Can you change /usr/bin/X if you are only given access to /dev ?
        ddevault 8y ago
        If you're running alone in a sandbox as root, you can just insert a kernel module which breaks you out of the sandbox.
- coldtea 8y ago
  >That is still a huge attack vector considering that the userbase is desktop users and not companies with security teams. Because the default in Linux is for Desktop users to login as roots? Where have you seen that?
  - nurettin 8y ago
    Because after you use linux for a couple of years you become dangerously knowledgeable and apply workarounds to make things more convenient, such as allowing no password with sudo. Surprised I had to explain this, though.
    - girst 8y ago
      If you leave your keys in your front door and get robbed, your insurance will laugh you out the window when you try to file a claim. Surprised I had to explain this, though.
      - bdowling 8y ago
        Whether a particular theft is covered would depend on the specific language of your insurance contract. For example, a theft might be covered where leaving the keys in the door was a rare lapse in otherwise good security (reasonable), but not in the case where it was the the regular procedure (negligent). Coverage might also depend on how the specific contract language has been interpreted by courts in your jurisdiction in the past.
    - coldtea 8y ago
      >Surprised I had to explain this, though. I'm surprised you even think taking such shortcuts has any bearing to wether Wayland is secure. People that "become dangerously knowledgeable and apply workarounds to make things more convenient, such as allowing no password with sudo" should not have much expectations for security. The same way if you leave your front door open in a street level inner city apartment, don't be surprised to be robbed.
      - 8y ago

deleted 8y ago

[deleted]

nurettin 8y ago

Let's say every attack vector exposed by wayland involves user being root or somehow having sudo access or somehow being exempt in pam or somehow having special access to input devices or being promoted through an ssh config or being promoted through a vpn config. That is still a huge attack vector considering that the userbase is desktop users and not companies with security teams.

ddevault 8y ago
If you expect Wayland to protect users who give arbitrary programs root access, I have nothing more to say to you.
- nurettin 8y ago
  I expect attack vectors to be equal or less than X. Also consider what I wrote instead of repeating the same mantra of full root access.
  - mort96 8y ago
    I don't quite understand. A rouge root user in X can just replace the /usr/bin/X binary with their own version which records the screen and logs user input or does whatever they want the next time the user restarts X, or better yet, install a kernel module of their own and have arbitrary code running in ring 0. What exact attack vectors do you see in X which you don't see in Wayland, which actually makes a difference and isn't completely overshadowed by all the other things a root user can do?
    - nurettin 8y ago
      Can you change /usr/bin/X if you are only given access to /dev ?
      - ddevault 8y ago
        If you're running alone in a sandbox as root, you can just insert a kernel module which breaks you out of the sandbox.
coldtea 8y ago
>That is still a huge attack vector considering that the userbase is desktop users and not companies with security teams. Because the default in Linux is for Desktop users to login as roots? Where have you seen that?
- nurettin 8y ago
  Because after you use linux for a couple of years you become dangerously knowledgeable and apply workarounds to make things more convenient, such as allowing no password with sudo. Surprised I had to explain this, though.
  - girst 8y ago
    If you leave your keys in your front door and get robbed, your insurance will laugh you out the window when you try to file a claim. Surprised I had to explain this, though.
    - bdowling 8y ago
      Whether a particular theft is covered would depend on the specific language of your insurance contract. For example, a theft might be covered where leaving the keys in the door was a rare lapse in otherwise good security (reasonable), but not in the case where it was the the regular procedure (negligent). Coverage might also depend on how the specific contract language has been interpreted by courts in your jurisdiction in the past.
  - coldtea 8y ago
    >Surprised I had to explain this, though. I'm surprised you even think taking such shortcuts has any bearing to wether Wayland is secure. People that "become dangerously knowledgeable and apply workarounds to make things more convenient, such as allowing no password with sudo" should not have much expectations for security. The same way if you leave your front door open in a street level inner city apartment, don't be surprised to be robbed.
    - 8y ago