9 ms·

X11 screen locking: a secure and modular approach

92 points by luu 7y ago

kstenerud 7y ago
My experiences with screen locking on Linux over time, using various machines: * The screen doesn't lock, and remains on while the lid is closed. * The screen doesn't lock, but does turn off when the lid is closed. * The screen locks, but the machine doesn't suspend when the lid is closed. * The screen doesn't turn on after the lid is opened. Key commands work, though. * The screen turns on after the lid is opened, but is blank (no unlock requestor). * The machine doesn't resume from suspend, requiring a hard reset. * The screen locker gets completely bypassed and you're dumped into the desktop (possibly a fresh desktop because the entire environment crashed and restarted). Throw remote desktop into the mix and you're in for a world of hurt. I just disable screen locking, and make suspend a manual operation to keep my sanity intact. The trackpad still stops responding sometimes though...
- tony_goobret 7y ago
  This is one of the reasons I had to stop carrying around a Linux laptop. Had a few times where I'd open up the laptop to find the screen locker randomly bypassed
- hpaavola 7y ago
  Interesting. The only issue I've encountered regarding screen locking was that in the past the desktop would be visible for a split second after opening the laptop lid and before the screenlock is displayed. Haven't seen that behaviour in couple years, I think. I use latest Ubuntu at home and latest Ubuntu LTS at work. Typically Lenovo and HP laptops, some Asus Zenbooks also in the past.
  - shrx 7y ago
    This still happens to me. Asus UX305UA, Xubuntu 19.10 with xscreensaver.
  - wlll 7y ago
    Interestingly this has started happening on my mac, as of a few years ago. Obviously unrelated to Linux.
    - AnIdiotOnTheNet 7y ago
      Is it really unrelated? I dunno, maybe my distaste for certain development styles is leading me to see things that aren't there, but I fell like the Linux Desktop hacked-together "it's good enough for me" way of doing things is creeping into paid OSs like Mac and Windows.
      - wlll 7y ago
        Mac OS has gone downhill for sure, but I meant unrelated technically.
      - bitwize 7y ago
        "The desktop" is suffering from the same complexity breakdown that AAA gaming suffers from. It's hard -- and getting harder -- to produce a cohesive properly developed and QA'd AAA game because gamers now expect something way beyond the capabilities of a surgical team of 10-50 people. To even ship a AAA title requires a team of hundreds and a budget of tens to hundreds of millions. and when you're dealing with an wndeavor that large, it's difficult to enforce quality and cohesiveness at every level throughout the development process. Desktop environments are now reaching that threshold because users demand "modernity" and fanciness. They would be fantastically served by a desktop with the capabilities of Windows 9x, MacOS 7.x, or AmigaOS 3.x, but they demand much more than that, and the Windows and MacOS teams (and code bases!) have bloated in size to meet this demand. These problems showed up much earlier in Linux because in order to release a desktop OS, you need someone exercising strict control over all aspects of the system from the kernel (and even lower than the kernel, like the hardware and firmware) all the way up to the shell, GUI toolkit, and other user-visible features. You need that leadership to define and prioritize work and even prioritize OS concerns. (For example, a desktop OS should handle keyboard/mouse interrupts IMMEDIATELY.) You need to enforce a single set of user concerns on everybody, and fire anyone who doesn't play ball. And with Linux and open source, good luck getting everybody on the independent kernel, libc, X, and GUI projects to cooperate this way. Me, I've always been content with like fvwm95 (or lately, i3) and whatever independent programs I needed for desktop tasks. And if I have to say 'pm-suspend' at a command prompt to put my computer tk sleep, so be it. I can see the many hands all making the world a slightly better place, and since their work is all loosely coupled, it all sort of hangs together and is very robust. Conventional desktops are brittle to start with, and made even more so under Linux because of those issues I mentioned.
  - swebs 7y ago
    I haven't seen that in default Gnome for years, but it still happens when using i3 or Regolith.
  - joshuaissac 7y ago
    I have had this start happening on Windows 10, except instead of a split second, it could be several seconds, during which I could even launch and start using applications, before it finally locks. To get around this risk, I always lock using Win+L now, before closing the lid.
- MisterTea 7y ago
  Most of what you describe isn't the screen lock but sounds more like something isn't communicating system events properly. That or bad hardware with poor open source driver vendor support. Also, this is why I don't use Linux any more. It's grown into a dumpster fire of ad-hoc patches from big corps looking to hammer every last drop of cloud server performance or poorly designed desktops made by people who obviously don't use them. Plan 9 front is my daily driver with OpenBSD/FreeBSD if I need a Unix. Windows 7 still powers my gaming rig by it most likely will move to Linux because Steam. Probably the only reason I need Linux and Windows 7 still isn't enough of a reason to switch....
  - simion314 7y ago
    > or poorly designed desktops made by people who obviously don't use them. Do you mean the design part or the coding part? From my limited experience desktops are made by contributors and volunteers work on whatever affects them the most or some might work on cool stuff. It is what it is, without someone with money hiring a large dev team and foucssing on user tickets it will never change. As a developer I prefer something customizable like KDE where I can fix a crash in an app if I hit it over a Windows like experience where important apps like the screen magnifier had hard coded shortcuts and you could not customize them.
    - AnIdiotOnTheNet 7y ago
      Being able to recompile from source to change hardcoded values isn't actually any better in my opinion. Especially given how much of a pain it can be to get a build environment set up for many projects.
      - cycloptic 7y ago
        You might want to look at something like GNOME Builder, which is designed to make it easy to contribute to existing projects and will clone the project and setup the build environment for you.
        7y ago
- uasm 7y ago
  It's 2020 and locking your screen on Linux is unreliable. It's difficult to promote Linux as a worthy consumer desktop OS alternative.
  - BiteCode_dev 7y ago
    Yes, it's imperfect and irritating in many ways. Many other actually (BT, Wifi, battery life, they all have their problems). But your alternative is one totally locked on ecosystem and one provided with embedded spywares. It's good enough, and since we are not giving millions of dollars to the editors like we do with products disrespecting us, I understand we can't ask for perfection.
    - AnIdiotOnTheNet 7y ago
      > It's good enough I've been hearing that for between 15 and 20 years now. I believe this mentality is part of the reason it never seems to get any better.
      - hpkuarg 7y ago
        Funnily enough, my 3-year-old Macbook Pro just died, and times being what they are with your usual build-to-order options being severely backordered, I stepped into a local store and bought a laptop off the shelf -- an LG Gram 17. It's not even a brand that's well-known for Linux compatibility (like Thinkpads), but all I've had to do to get Lubuntu 18.04 running more or less flawlessly was disable Secure Boot in the BIOS. Wifi, sound, and webcam all worked without needing tinkering. Bluetooth appears to work based on it being detected, but I haven't tried pairing anything yet. The only thing I hear doesn't work is the fingerprint sensor, but I wasn't going to use it, anyway. Suspend on lid down and wake on lid up hasn't been an issue at all. I'm actually very pleasantly surprised at how well this LTS version from 2018 runs on a 2020 model laptop.
      - catblast 7y ago
        > I believe this mentality is part of the reason it never seems to get any better. Or maybe it’s that authoring and supporting drivers for actual hardware is tremendous effort that is mostly thankless. Even Microsoft can’t get something much better and they literally have billions they need to throw at it.
- deleted 7y ago
  [deleted]
- jjoonathan 7y ago
  * The lock screen pops up, requests a password, and disappears after you enter it, but you find that your password and enter key also made their way into the foreground text field. I love linux, but it's not wart-free.
  - stabbles 7y ago
    Did that really happen to you or are you confusing it with this issue on MacOS? https://twitter.com/BenoitLetondor/status/939127296266588160 https://twitter.com/BenoitLetondor/status/939127296266588160
    - jjoonathan 7y ago
      It really happened, just last week. Although I use MacOS regularly, this was the first time I had ever seen it happen, and it startled me.
- speedgoose 7y ago
  Yes, sadly I think the best GNU/Linux for laptops is Windows 10 with WSL (Windows Subsystem for Linux). By far.
  - gbrown 7y ago
    Or a distribution with Wayland instead of X11...
  - catblast 7y ago
    I think you may have had something, and then oversold it. The only thing “by far” about Windows 10 is the distance it should be defenestrated. In other news... look up Surface Pro “hot bag”. The chucklefucks at Microsoft couldn’t get reliable suspend working on their own hardware for years.
  - tryauuum 7y ago
    I can't stop hating Microsoft for WSL. Yes, it is a way forward for the company but I still have a feeling they have found a perfect way to make younger generation ignore Linux completely.
    - brokensegue 7y ago
      Ignore Linux by using Linux?
      - JdeBP 7y ago
        In the first Windows Subsystem for Linux, Linux was the thing that was actually missing, with Windows NT taking its place.
  - darkwater 7y ago
    I don't want ads in my application menu, sorry. Good for you if you like them.
    - speedgoose 7y ago
- BiteCode_dev 7y ago
  +1. I'll add: * The screen locks, unlock, but the network card cannot wake up anymore and requires a reboot. * The screen locks, let you enter things, but doesn't seem to react, then suddenly, replay all the things for 20 seconds in 1 seconds, and displays an error message * the screen locks, but you can see the unlock screen for a few seconds when you wake the laptop up
  - catblast 7y ago
    The first 2 sound more related to suspend rather than screen locking.
    - BiteCode_dev 7y ago
      It is, but the whole experience go together. Just like booting flickers is caused by many problems, but it is about one experience.
    - JdeBP 7y ago
      I've had the second, and it wasn't related to suspend. For some reason, the GUI decides to do a software bit-blit of the entire screen, which takes tens of seconds, before it lets xscreensaver put up its dialogue box. So don't assume that this is always suspend-related. There are several quite varied possibilities.
      - catblast 7y ago
        Most modern computers can software/CPU blit to a 4K screen at multiple frames per second. So this explanation doesn’t make much sense as is.
        JdeBP 7y ago
        Indeed. But since it's so slow that I can see the blit happening, scanline by scanline, it's definitely what is happening, even if it's not apparent why. (I do know that the particular window manager in use decides to move windows back and forth by 2 pixels to work around some sort of bug.) Not being able to explain why the software does this does not negate the fact that it is doing this, and that it is a quite different possible reason for lengthy pauses in the user interface, one of several, that is nothing to do with suspending the machine; indicating that, as I said, one should not assume that these things are always suspend-related.
- rvz 7y ago
  Seriously, If these distros still can't come together and get something as simple as screen locking right and consistent on X11, Wayland with a DE like GNOME or KDE, etc then it is difficult to recommend / market any Linux desktop distro to a typical consumer. It really is one of the smallest issues that would turn off a user moving to Linux, just to get work done. I wouldn't blame them if I see any of them ending up staying on Windows or moving to macOS or outright iPadOS.
  - spease 7y ago
    Yeah, I tried to get xsecurelock working with LXQt and systemd. What a mess. Eventually I had to just give up on it and switch back to xscreensaver-lock. I posted a thread asking for advice and did get responses, but I haven't worked up the resolve to go back and try to get it working again. Last I checked, people were just suggesting I try something else, which kind of misses the point of the activity to uses the most secure lock screen that seemed to be available. I appreciated the help, it just seems like the whole issue should be something provided by a systemd utility that you specify your lock screen for in a config file. I know people hate on it, but systemd really does tend to make it easier if you just kind of want your system fundamentals to stay in the background and just work rather than having to constantly meddle with them. It's a point of pride to me that I've kept my Linux system going for so long (it's outlived one Windows and two Mac laptops) but it does feel like there's often a very myopic design to a lot of applications. That is, the author often expects you to be willing to context switch out of whatever you were doing for a few hours to learn their software to use it, and doesn't feel like there's any usability problem with the state of affairs. In the case of a lock screen, this was turning into multiple days. I can only imagine that if things were simpler, it would make it easier to involve more people, bring them on board, and/or just to get stuff done. Anyway - enough soapboxing. https://github.com/google/xsecurelock https://github.com/google/xsecurelock
- rauhl 7y ago
  Oddly enough, I don’t have any of those issues anymore. Screen locking tends to just work these days. What doesn’t work well anymore is user switching: when I switch virtual consoles to either another user or the gdm screen the keyboard stops registering and the mouse gets slower and slower until it stops completely. Then some time later it starts responding again. The length of time it is unresponsive seems to be proportional to the length of time the virtual console has been suspended. The system continues to be available via SSH. I suspect that the issue has something to do with a huge backlog of invalid events being delivered, but I don’t know for sure. It may also somehow have something to do with the NVIDIA proprietary drivers. I kinda blame dbus/systemd, because it first started happening at the same time as I started using systemd, but I don’t actually know that. It’s annoying because I’ve grown to rely on fast user switching over the past decade or more.
  - jcelerier 7y ago
    I use VT switching all the time, on a desktop with an nvidia card and a laptop with intel / nvidia, and I don't have any of your issues. I'm on arch linux so with recent kernels, systemd, etc... if that can help but I don't remember ever having them.. I don't use GDM however.
- beeforpork 7y ago
  I have encountered another one, a lot of fun: * The screen turns on when the lid is opened, the login prompt appears, but the backlight is still off so you cannot see anything (except by using a super strong flashlight).
- fanatic2pope 7y ago
  My own experience using various laptops (mostly thinkpads, but also a couple of asus and one dell) over the last 10 or so years under Fedora has been pretty consistently good. There was a period between Fedora 28 and 30 when it took 10 seconds to un-suspend (instead of it being instant) but that is fixed again in Fedora 31.
- asveikau 7y ago
  I haven't had any of these issues with freebsd and xscreensaver on my thinkpad. It seems like mostly power management issues rather than the screen lock. If you removed the screen lock program entirely (remember that it is possible to run without one) this would still be a set of bug reports, eg. not suspending when you expect, not coming back from suspend..
- paulie_a 7y ago
  Screen lock is all around useless. It's a security threat more than anything.
- globuous 7y ago
  I'm lucky not to experience such problems on my arch with my current machine, but I've run into these issues on my past machines. However, my graphic designer friend working on Windows (he needs Adobe cs and blender and therefore needs a good gpu in an affordable machine ruling out Macs) keeps on having this problem. Drives him nuts because he'll close the lid, pack the laptop in his backpack to go somewhere only to realise when taking it out that the laptop is close to being to hot to touch. On a 3k msi that's a few months old, it scares him to death ever time it happens, which is quite often. So I guess this is a harder problem than it seems !! I don't remember ever having this problem on my Mac.
- Lammy 7y ago
  * The screen locks, the machine suspends when the lid is closed, but then at some point the machine wakes itself up and overheats in your bag.
hendry 7y ago
I'm getting by mostly by `xss-lock -- /usr/bin/slock` https://github.com/kaihendry/dotfiles/blob/master/.xinitrc#L66 https://github.com/kaihendry/dotfiles/blob/master/.xinitrc#L... But yeah, one of those things that's surprisingly tricky to get right.
- djsumdog 7y ago
  I see you used xautolock at one time. I was using that too. I'm currently using xidlehook + i3lock and it's been working reliably.
- rdslw 7y ago
  That's what I'm also recommending and working more/less reliably in terms of locking. One thing which I'm also analysing recently is electron shit^H^H^Happs, triggering XSS (X screen saver) idle detection on some internal app events (not user actions!). Being: if you dont move mouse, nor touch keyboard, plus you're receiving slack messages, XSS considers youre NOT idle, in result not allowing lock to work if relying on xss-idle-detection. needing it as I'm expermineting with some cool X11 software from 199x. I added XSS support, as original detection engine(*) dont work reliably on modern X11. Anyone?
ubercow13 7y ago
I prefer https://github.com/muennich/physlock https://github.com/muennich/physlock It seems more secure as it bypasses X, and you can be sure (can you? I just assume this, I don't really know) your input is not even being passed to X when your screen is locked. In practice I've found it very reliable.
- danharaj 7y ago
  This is what I use as well, I have a hotkey to invoke it and lock my screen reflexively when I leave my computer.
- eximius 7y ago
  never been able to get it to work. I've been using i3lock on my machines, not sure how well it does on suspend, though.
  - secure 7y ago
    I recommend to combine i3lock with xss-lock to get automatic screen locking on suspend: xss-lock --transfer-sleep-lock -- i3lock --nofork
tomcooks 7y ago
suckless' sloc works great and it's very customizable https://tools.suckless.org/slock/ https://tools.suckless.org/slock/
- klibertp 7y ago
  > it's very customizable Yeah, lots of features and options in this one. Worth a look! ;) I rewrote it in Nim some time ago to see how it works, and it was a good lesson in X11 and POSIX APIs. Short and to the point.
cycloptic 7y ago
These are good suggestions, but it seems that xsecurelock still can't provide a workaround for the bug where the screen doesn't lock if a popup menu happens to be open or the pointer is grabbed in any other way [0]. I couldn't find any good way to fix this and the only suggested workaround seems to be to switch to Wayland. I've switched on all of my machines (for this and for other reasons) but please make sure you know the details of this if you still use Xorg. [0] https://github.com/google/xsecurelock#known-security-issues https://github.com/google/xsecurelock#known-security-issues
- Jasper_ 7y ago
  There is no way to fix it. Also, X11 has several ways of writing keyloggers to get around input locks. I've written one here https://github.com/magcius/keylog https://github.com/magcius/keylog
anaphor 7y ago
It's worth reading this article as well, "Why screen lockers on X11 cannot be secure". I'm not sure how xsecurelock bypasses all of these issues. https://blog.martin-graesslin.com/blog/2015/01/why-screen-lockers-on-x11-cannot-be-secure/ https://blog.martin-graesslin.com/blog/2015/01/why-screen-lo...
- asveikau 7y ago
  This mentions writing the screen lock UI in QT. jwz, maintainer of xscreensaver, had a rant about why he avoids the use of a big toolkit. The short version is he wants minimal code size because the consequence of a crash is to unlock the screen. The rant was prompted because of a real life gtk+ bug which made another screen locker crash. I would find a link and include it but jwz is hostile to links with HN as a referrer.
  - deleted 7y ago
    [deleted]
  - cycloptic 7y ago
    The author mentions what they did to mitigate this in the previous post in the series, see the part about XScreenSaver: https://blog.martin-graesslin.com/blog/2014/05/screenlocker-architecture-in-plasma-next/ https://blog.martin-graesslin.com/blog/2014/05/screenlocker-...
    - asveikau 7y ago
      > the screen content can be exposed. Consider for example the linked screenshot. That's funny, because the effect there is obviously intended, because, uh, it looks cool. > For a screen saver of the last millennium this was a suitable solution It's true that this particular effect was much more impressive in the 90s. Personally I use the 'blank' demo in xscreenaver. Which I guess I could replace with the script in TFA without noticing much. > Today users also expect the current time, battery state and many more information on the lock screen. We need to provide accessibility features which is not possible in XScreenSaver. I don't see why this is not possible with Xlib. Yes I have written Xlib code. Seems to be just an "omg xlib is so old" argument, and things being old does not by itself make them incorrect. > We need DBus integration > and logind integration Says who? I certainly don't need these.
quotemstr 7y ago
I don't understand why we don't just lock screens by switching to a different virtual terminal running a different X server. If the lock screen doesn't share an X server with the user session, a lot less information can leak. This entirely-separate-session approach is what Windows uses, and it works great there.
- JdeBP 7y ago
  It's a separate desktop, but not a separate window-station, let alone a separate session. The clipboard and atom table are not separate, because they belong to the window station; and a session is something rather different on Windows NT. * http://jdebp.uk./FGA/windows-nt-session.html http://jdebp.uk./FGA/windows-nt-session.html
  - quotemstr 7y ago
    Ah, right. I remembered incorrectly. My larger question stands though.
anthk 7y ago
openbsd, apmd, xidle, slock (base has xlock, but slock is much smaller (no fX), thus, maybe more reliable.
haecceity 7y ago
Linux kernel needs to support something like a secure attention sequence.

92 points by luu 7y ago

My experiences with screen locking on Linux over time, using various machines: * The screen doesn't lock, and remains on while the lid is closed. * The screen doesn't lock, but does turn off when the lid is closed. * The screen locks, but the machine doesn't suspend when the lid is closed. * The screen doesn't turn on after the lid is opened. Key commands work, though. * The screen turns on after the lid is opened, but is blank (no unlock requestor). * The machine doesn't resume from suspend, requiring a hard reset. * The screen locker gets completely bypassed and you're dumped into the desktop (possibly a fresh desktop because the entire environment crashed and restarted). Throw remote desktop into the mix and you're in for a world of hurt. I just disable screen locking, and make suspend a manual operation to keep my sanity intact. The trackpad still stops responding sometimes though...

tony_goobret 7y ago
This is one of the reasons I had to stop carrying around a Linux laptop. Had a few times where I'd open up the laptop to find the screen locker randomly bypassed
hpaavola 7y ago
Interesting. The only issue I've encountered regarding screen locking was that in the past the desktop would be visible for a split second after opening the laptop lid and before the screenlock is displayed. Haven't seen that behaviour in couple years, I think. I use latest Ubuntu at home and latest Ubuntu LTS at work. Typically Lenovo and HP laptops, some Asus Zenbooks also in the past.
- shrx 7y ago
  This still happens to me. Asus UX305UA, Xubuntu 19.10 with xscreensaver.
- wlll 7y ago
  Interestingly this has started happening on my mac, as of a few years ago. Obviously unrelated to Linux.
  - AnIdiotOnTheNet 7y ago
    Is it really unrelated? I dunno, maybe my distaste for certain development styles is leading me to see things that aren't there, but I fell like the Linux Desktop hacked-together "it's good enough for me" way of doing things is creeping into paid OSs like Mac and Windows.
    - wlll 7y ago
      Mac OS has gone downhill for sure, but I meant unrelated technically.
    - bitwize 7y ago
      "The desktop" is suffering from the same complexity breakdown that AAA gaming suffers from. It's hard -- and getting harder -- to produce a cohesive properly developed and QA'd AAA game because gamers now expect something way beyond the capabilities of a surgical team of 10-50 people. To even ship a AAA title requires a team of hundreds and a budget of tens to hundreds of millions. and when you're dealing with an wndeavor that large, it's difficult to enforce quality and cohesiveness at every level throughout the development process. Desktop environments are now reaching that threshold because users demand "modernity" and fanciness. They would be fantastically served by a desktop with the capabilities of Windows 9x, MacOS 7.x, or AmigaOS 3.x, but they demand much more than that, and the Windows and MacOS teams (and code bases!) have bloated in size to meet this demand. These problems showed up much earlier in Linux because in order to release a desktop OS, you need someone exercising strict control over all aspects of the system from the kernel (and even lower than the kernel, like the hardware and firmware) all the way up to the shell, GUI toolkit, and other user-visible features. You need that leadership to define and prioritize work and even prioritize OS concerns. (For example, a desktop OS should handle keyboard/mouse interrupts IMMEDIATELY.) You need to enforce a single set of user concerns on everybody, and fire anyone who doesn't play ball. And with Linux and open source, good luck getting everybody on the independent kernel, libc, X, and GUI projects to cooperate this way. Me, I've always been content with like fvwm95 (or lately, i3) and whatever independent programs I needed for desktop tasks. And if I have to say 'pm-suspend' at a command prompt to put my computer tk sleep, so be it. I can see the many hands all making the world a slightly better place, and since their work is all loosely coupled, it all sort of hangs together and is very robust. Conventional desktops are brittle to start with, and made even more so under Linux because of those issues I mentioned.
- swebs 7y ago
  I haven't seen that in default Gnome for years, but it still happens when using i3 or Regolith.
- joshuaissac 7y ago
  I have had this start happening on Windows 10, except instead of a split second, it could be several seconds, during which I could even launch and start using applications, before it finally locks. To get around this risk, I always lock using Win+L now, before closing the lid.
MisterTea 7y ago
Most of what you describe isn't the screen lock but sounds more like something isn't communicating system events properly. That or bad hardware with poor open source driver vendor support. Also, this is why I don't use Linux any more. It's grown into a dumpster fire of ad-hoc patches from big corps looking to hammer every last drop of cloud server performance or poorly designed desktops made by people who obviously don't use them. Plan 9 front is my daily driver with OpenBSD/FreeBSD if I need a Unix. Windows 7 still powers my gaming rig by it most likely will move to Linux because Steam. Probably the only reason I need Linux and Windows 7 still isn't enough of a reason to switch....
- simion314 7y ago
  > or poorly designed desktops made by people who obviously don't use them. Do you mean the design part or the coding part? From my limited experience desktops are made by contributors and volunteers work on whatever affects them the most or some might work on cool stuff. It is what it is, without someone with money hiring a large dev team and foucssing on user tickets it will never change. As a developer I prefer something customizable like KDE where I can fix a crash in an app if I hit it over a Windows like experience where important apps like the screen magnifier had hard coded shortcuts and you could not customize them.
  - AnIdiotOnTheNet 7y ago
    Being able to recompile from source to change hardcoded values isn't actually any better in my opinion. Especially given how much of a pain it can be to get a build environment set up for many projects.
    - cycloptic 7y ago
      You might want to look at something like GNOME Builder, which is designed to make it easy to contribute to existing projects and will clone the project and setup the build environment for you.
      - 7y ago
uasm 7y ago
It's 2020 and locking your screen on Linux is unreliable. It's difficult to promote Linux as a worthy consumer desktop OS alternative.
- BiteCode_dev 7y ago
  Yes, it's imperfect and irritating in many ways. Many other actually (BT, Wifi, battery life, they all have their problems). But your alternative is one totally locked on ecosystem and one provided with embedded spywares. It's good enough, and since we are not giving millions of dollars to the editors like we do with products disrespecting us, I understand we can't ask for perfection.
  - AnIdiotOnTheNet 7y ago
    > It's good enough I've been hearing that for between 15 and 20 years now. I believe this mentality is part of the reason it never seems to get any better.
    - hpkuarg 7y ago
      Funnily enough, my 3-year-old Macbook Pro just died, and times being what they are with your usual build-to-order options being severely backordered, I stepped into a local store and bought a laptop off the shelf -- an LG Gram 17. It's not even a brand that's well-known for Linux compatibility (like Thinkpads), but all I've had to do to get Lubuntu 18.04 running more or less flawlessly was disable Secure Boot in the BIOS. Wifi, sound, and webcam all worked without needing tinkering. Bluetooth appears to work based on it being detected, but I haven't tried pairing anything yet. The only thing I hear doesn't work is the fingerprint sensor, but I wasn't going to use it, anyway. Suspend on lid down and wake on lid up hasn't been an issue at all. I'm actually very pleasantly surprised at how well this LTS version from 2018 runs on a 2020 model laptop.
    - catblast 7y ago
      > I believe this mentality is part of the reason it never seems to get any better. Or maybe it’s that authoring and supporting drivers for actual hardware is tremendous effort that is mostly thankless. Even Microsoft can’t get something much better and they literally have billions they need to throw at it.
deleted 7y ago
[deleted]
jjoonathan 7y ago
* The lock screen pops up, requests a password, and disappears after you enter it, but you find that your password and enter key also made their way into the foreground text field. I love linux, but it's not wart-free.
- stabbles 7y ago
  Did that really happen to you or are you confusing it with this issue on MacOS? https://twitter.com/BenoitLetondor/status/939127296266588160 https://twitter.com/BenoitLetondor/status/939127296266588160
  - jjoonathan 7y ago
    It really happened, just last week. Although I use MacOS regularly, this was the first time I had ever seen it happen, and it startled me.
speedgoose 7y ago
Yes, sadly I think the best GNU/Linux for laptops is Windows 10 with WSL (Windows Subsystem for Linux). By far.
- gbrown 7y ago
  Or a distribution with Wayland instead of X11...
- catblast 7y ago
  I think you may have had something, and then oversold it. The only thing “by far” about Windows 10 is the distance it should be defenestrated. In other news... look up Surface Pro “hot bag”. The chucklefucks at Microsoft couldn’t get reliable suspend working on their own hardware for years.
- tryauuum 7y ago
  I can't stop hating Microsoft for WSL. Yes, it is a way forward for the company but I still have a feeling they have found a perfect way to make younger generation ignore Linux completely.
  - brokensegue 7y ago
    Ignore Linux by using Linux?
    - JdeBP 7y ago
      In the first Windows Subsystem for Linux, Linux was the thing that was actually missing, with Windows NT taking its place.
- darkwater 7y ago
  I don't want ads in my application menu, sorry. Good for you if you like them.
  - speedgoose 7y ago
BiteCode_dev 7y ago
+1. I'll add: * The screen locks, unlock, but the network card cannot wake up anymore and requires a reboot. * The screen locks, let you enter things, but doesn't seem to react, then suddenly, replay all the things for 20 seconds in 1 seconds, and displays an error message * the screen locks, but you can see the unlock screen for a few seconds when you wake the laptop up
- catblast 7y ago
  The first 2 sound more related to suspend rather than screen locking.
  - BiteCode_dev 7y ago
    It is, but the whole experience go together. Just like booting flickers is caused by many problems, but it is about one experience.
  - JdeBP 7y ago
    I've had the second, and it wasn't related to suspend. For some reason, the GUI decides to do a software bit-blit of the entire screen, which takes tens of seconds, before it lets xscreensaver put up its dialogue box. So don't assume that this is always suspend-related. There are several quite varied possibilities.
    - catblast 7y ago
      Most modern computers can software/CPU blit to a 4K screen at multiple frames per second. So this explanation doesn’t make much sense as is.
      - JdeBP 7y ago
        Indeed. But since it's so slow that I can see the blit happening, scanline by scanline, it's definitely what is happening, even if it's not apparent why. (I do know that the particular window manager in use decides to move windows back and forth by 2 pixels to work around some sort of bug.) Not being able to explain why the software does this does not negate the fact that it is doing this, and that it is a quite different possible reason for lengthy pauses in the user interface, one of several, that is nothing to do with suspending the machine; indicating that, as I said, one should not assume that these things are always suspend-related.
rvz 7y ago
Seriously, If these distros still can't come together and get something as simple as screen locking right and consistent on X11, Wayland with a DE like GNOME or KDE, etc then it is difficult to recommend / market any Linux desktop distro to a typical consumer. It really is one of the smallest issues that would turn off a user moving to Linux, just to get work done. I wouldn't blame them if I see any of them ending up staying on Windows or moving to macOS or outright iPadOS.
- spease 7y ago
  Yeah, I tried to get xsecurelock working with LXQt and systemd. What a mess. Eventually I had to just give up on it and switch back to xscreensaver-lock. I posted a thread asking for advice and did get responses, but I haven't worked up the resolve to go back and try to get it working again. Last I checked, people were just suggesting I try something else, which kind of misses the point of the activity to uses the most secure lock screen that seemed to be available. I appreciated the help, it just seems like the whole issue should be something provided by a systemd utility that you specify your lock screen for in a config file. I know people hate on it, but systemd really does tend to make it easier if you just kind of want your system fundamentals to stay in the background and just work rather than having to constantly meddle with them. It's a point of pride to me that I've kept my Linux system going for so long (it's outlived one Windows and two Mac laptops) but it does feel like there's often a very myopic design to a lot of applications. That is, the author often expects you to be willing to context switch out of whatever you were doing for a few hours to learn their software to use it, and doesn't feel like there's any usability problem with the state of affairs. In the case of a lock screen, this was turning into multiple days. I can only imagine that if things were simpler, it would make it easier to involve more people, bring them on board, and/or just to get stuff done. Anyway - enough soapboxing. https://github.com/google/xsecurelock https://github.com/google/xsecurelock
rauhl 7y ago
Oddly enough, I don’t have any of those issues anymore. Screen locking tends to just work these days. What doesn’t work well anymore is user switching: when I switch virtual consoles to either another user or the gdm screen the keyboard stops registering and the mouse gets slower and slower until it stops completely. Then some time later it starts responding again. The length of time it is unresponsive seems to be proportional to the length of time the virtual console has been suspended. The system continues to be available via SSH. I suspect that the issue has something to do with a huge backlog of invalid events being delivered, but I don’t know for sure. It may also somehow have something to do with the NVIDIA proprietary drivers. I kinda blame dbus/systemd, because it first started happening at the same time as I started using systemd, but I don’t actually know that. It’s annoying because I’ve grown to rely on fast user switching over the past decade or more.
- jcelerier 7y ago
  I use VT switching all the time, on a desktop with an nvidia card and a laptop with intel / nvidia, and I don't have any of your issues. I'm on arch linux so with recent kernels, systemd, etc... if that can help but I don't remember ever having them.. I don't use GDM however.
beeforpork 7y ago
I have encountered another one, a lot of fun: * The screen turns on when the lid is opened, the login prompt appears, but the backlight is still off so you cannot see anything (except by using a super strong flashlight).
fanatic2pope 7y ago
My own experience using various laptops (mostly thinkpads, but also a couple of asus and one dell) over the last 10 or so years under Fedora has been pretty consistently good. There was a period between Fedora 28 and 30 when it took 10 seconds to un-suspend (instead of it being instant) but that is fixed again in Fedora 31.
asveikau 7y ago
I haven't had any of these issues with freebsd and xscreensaver on my thinkpad. It seems like mostly power management issues rather than the screen lock. If you removed the screen lock program entirely (remember that it is possible to run without one) this would still be a set of bug reports, eg. not suspending when you expect, not coming back from suspend..
paulie_a 7y ago
Screen lock is all around useless. It's a security threat more than anything.
globuous 7y ago
I'm lucky not to experience such problems on my arch with my current machine, but I've run into these issues on my past machines. However, my graphic designer friend working on Windows (he needs Adobe cs and blender and therefore needs a good gpu in an affordable machine ruling out Macs) keeps on having this problem. Drives him nuts because he'll close the lid, pack the laptop in his backpack to go somewhere only to realise when taking it out that the laptop is close to being to hot to touch. On a 3k msi that's a few months old, it scares him to death ever time it happens, which is quite often. So I guess this is a harder problem than it seems !! I don't remember ever having this problem on my Mac.
Lammy 7y ago
* The screen locks, the machine suspends when the lid is closed, but then at some point the machine wakes itself up and overheats in your bag.

hendry 7y ago

I'm getting by mostly by `xss-lock -- /usr/bin/slock` https://github.com/kaihendry/dotfiles/blob/master/.xinitrc#L66 https://github.com/kaihendry/dotfiles/blob/master/.xinitrc#L... But yeah, one of those things that's surprisingly tricky to get right.

djsumdog 7y ago
I see you used xautolock at one time. I was using that too. I'm currently using xidlehook + i3lock and it's been working reliably.
rdslw 7y ago
That's what I'm also recommending and working more/less reliably in terms of locking. One thing which I'm also analysing recently is electron shit^H^H^Happs, triggering XSS (X screen saver) idle detection on some internal app events (not user actions!). Being: if you dont move mouse, nor touch keyboard, plus you're receiving slack messages, XSS considers youre NOT idle, in result not allowing lock to work if relying on xss-idle-detection. needing it as I'm expermineting with some cool X11 software from 199x. I added XSS support, as original detection engine(*) dont work reliably on modern X11. Anyone?

ubercow13 7y ago

I prefer https://github.com/muennich/physlock https://github.com/muennich/physlock It seems more secure as it bypasses X, and you can be sure (can you? I just assume this, I don't really know) your input is not even being passed to X when your screen is locked. In practice I've found it very reliable.

danharaj 7y ago
This is what I use as well, I have a hotkey to invoke it and lock my screen reflexively when I leave my computer.
eximius 7y ago
never been able to get it to work. I've been using i3lock on my machines, not sure how well it does on suspend, though.
- secure 7y ago
  I recommend to combine i3lock with xss-lock to get automatic screen locking on suspend: xss-lock --transfer-sleep-lock -- i3lock --nofork

tomcooks 7y ago

suckless' sloc works great and it's very customizable https://tools.suckless.org/slock/ https://tools.suckless.org/slock/

klibertp 7y ago
> it's very customizable Yeah, lots of features and options in this one. Worth a look! ;) I rewrote it in Nim some time ago to see how it works, and it was a good lesson in X11 and POSIX APIs. Short and to the point.

cycloptic 7y ago

These are good suggestions, but it seems that xsecurelock still can't provide a workaround for the bug where the screen doesn't lock if a popup menu happens to be open or the pointer is grabbed in any other way [0]. I couldn't find any good way to fix this and the only suggested workaround seems to be to switch to Wayland. I've switched on all of my machines (for this and for other reasons) but please make sure you know the details of this if you still use Xorg. [0] https://github.com/google/xsecurelock#known-security-issues https://github.com/google/xsecurelock#known-security-issues

Jasper_ 7y ago
There is no way to fix it. Also, X11 has several ways of writing keyloggers to get around input locks. I've written one here https://github.com/magcius/keylog https://github.com/magcius/keylog

anaphor 7y ago

It's worth reading this article as well, "Why screen lockers on X11 cannot be secure". I'm not sure how xsecurelock bypasses all of these issues. https://blog.martin-graesslin.com/blog/2015/01/why-screen-lockers-on-x11-cannot-be-secure/ https://blog.martin-graesslin.com/blog/2015/01/why-screen-lo...

asveikau 7y ago
This mentions writing the screen lock UI in QT. jwz, maintainer of xscreensaver, had a rant about why he avoids the use of a big toolkit. The short version is he wants minimal code size because the consequence of a crash is to unlock the screen. The rant was prompted because of a real life gtk+ bug which made another screen locker crash. I would find a link and include it but jwz is hostile to links with HN as a referrer.
- deleted 7y ago
  [deleted]
- cycloptic 7y ago
  The author mentions what they did to mitigate this in the previous post in the series, see the part about XScreenSaver: https://blog.martin-graesslin.com/blog/2014/05/screenlocker-architecture-in-plasma-next/ https://blog.martin-graesslin.com/blog/2014/05/screenlocker-...
  - asveikau 7y ago
    > the screen content can be exposed. Consider for example the linked screenshot. That's funny, because the effect there is obviously intended, because, uh, it looks cool. > For a screen saver of the last millennium this was a suitable solution It's true that this particular effect was much more impressive in the 90s. Personally I use the 'blank' demo in xscreenaver. Which I guess I could replace with the script in TFA without noticing much. > Today users also expect the current time, battery state and many more information on the lock screen. We need to provide accessibility features which is not possible in XScreenSaver. I don't see why this is not possible with Xlib. Yes I have written Xlib code. Seems to be just an "omg xlib is so old" argument, and things being old does not by itself make them incorrect. > We need DBus integration > and logind integration Says who? I certainly don't need these.

quotemstr 7y ago

I don't understand why we don't just lock screens by switching to a different virtual terminal running a different X server. If the lock screen doesn't share an X server with the user session, a lot less information can leak. This entirely-separate-session approach is what Windows uses, and it works great there.

JdeBP 7y ago
It's a separate desktop, but not a separate window-station, let alone a separate session. The clipboard and atom table are not separate, because they belong to the window station; and a session is something rather different on Windows NT. * http://jdebp.uk./FGA/windows-nt-session.html http://jdebp.uk./FGA/windows-nt-session.html
- quotemstr 7y ago
  Ah, right. I remembered incorrectly. My larger question stands though.

anthk 7y ago

openbsd, apmd, xidle, slock (base has xlock, but slock is much smaller (no fX), thus, maybe more reliable.

haecceity 7y ago

Linux kernel needs to support something like a secure attention sequence.