4 ms·
> Upsides: more secure (in X.org every client can read every other client's keystrokes, pointer position, and do screen grabs) What if i want this as a feature
by slightwinder 7y ago
> Upsides: more secure (in X.org every client can read every other client's keystrokes, pointer position, and do screen grabs)
What if i want this as a feature? Does wayland allow this per app?
- sp332 7y agoThe screen-grabbing app would have to interface with the compositor instead of the display server. For example, krfb is adding Wayland screen sharing support with KDE.
- jandrese 7y agoIs this better from a security standpoint? Does the compositor verify clients in a more secure fashion? Presumably screenshotting is still a thing on Wayland so this has to be a solved problem.
- Bnshsysjab 7y agoThe point is apps can’t grab other apps input/output. If you run the app in an otherwise secure manner (eg execute in a perfect security chroot/container). A malicious application on your host can still do anything at the executing privilege level (read .ssh, inject malware into .bashrc) but can’t sniff your gksudo password
- michaelmrose 7y agoWhy would you assume it's a solved problem? Basically every compositor has to implement this feature.
- kelnos 7y agoThe idea is that the compositor can then pop up a dialog saying "App X wants to record your screen. Allow?"
- sp332 7y agoIt could also limit recording to certain windows, or heck even redraw the whole screen any way it wants, like pretending sensitive windows aren't there.
- Bnshsysjab 7y agoDoes this lead to a more fragmented application space? If each compostor required its own screen grabbing tool, and each DE has its own compostor?
- PlutoIsAPlanet 7y agoWhilst backend implementations are going to be different per-compositor, they're exposed as freedesktop apis so tools shouldn't need to be adjusted for each one.
- Bnshsysjab 7y agoI respect what your saying, but I’ve seen that model tried and failed multiple times
- asveikau 7y agoFurthermore I kind of wonder if anybody bringing up this point has ever in their life seen or heard of a malicious X11 client ... I know this is not how security works (a theoretical hole is often as bad as a practical one) but it's a bit like saying you should have antivirus software, to which I might say: where are the viruses?
- Bnshsysjab 7y agoIf containerisation takes off and ends up being perfect security it’ll make sense. An example would be running Android on X, apps would be able to read / modify windows of other apps via The X socket.
- michaelmrose 7y agoWhy would anyone suppose that containers on Linux which are designed to keep applications isolated enough not to interfere with each other ends up being perfectly secure when it's not really designed to be secure at all?
- Bnshsysjab 7y agoI’m not suggesting it’s sane particularly if your threat model is nation state level actors, but people use containers (chroot, docker, vms) as a security boundary all the time.
- michaelmrose 7y agoNeither chroot or docker is a worthwhile security boundary. People that act as if it is risk appearing incompetent when they get compromised.
- Bnshsysjab 7y agoI’d argue that anything but bare metal is not a good compromise, but I’m not balancing the books of a large company. People care about docker escapes so they’re getting more difficult, at least. Edit: Plus, I’d rather $app_i_dont_fully_trust be sitting in a container rather than on my host. And no, not running apps i don’t fully trust is not something which is at all viable for me.