4 ms·

It's worth reading this article as well, "Why screen lockers on X11 cannot be secure". I'm not sure how xsecurelock bypasses all of these issues. https://blog.

It's worth reading this article as well, "Why screen lockers on X11 cannot be secure". I'm not sure how xsecurelock bypasses all of these issues. https://blog.martin-graesslin.com/blog/2015/01/why-screen-lockers-on-x11-cannot-be-secure/ https://blog.martin-graesslin.com/blog/2015/01/why-screen-lo...

asveikau 7y ago
This mentions writing the screen lock UI in QT. jwz, maintainer of xscreensaver, had a rant about why he avoids the use of a big toolkit. The short version is he wants minimal code size because the consequence of a crash is to unlock the screen. The rant was prompted because of a real life gtk+ bug which made another screen locker crash. I would find a link and include it but jwz is hostile to links with HN as a referrer.
- deleted 7y ago
  [deleted]
- cycloptic 7y ago
  The author mentions what they did to mitigate this in the previous post in the series, see the part about XScreenSaver: https://blog.martin-graesslin.com/blog/2014/05/screenlocker-architecture-in-plasma-next/ https://blog.martin-graesslin.com/blog/2014/05/screenlocker-...
  - asveikau 7y ago
    > the screen content can be exposed. Consider for example the linked screenshot. That's funny, because the effect there is obviously intended, because, uh, it looks cool. > For a screen saver of the last millennium this was a suitable solution It's true that this particular effect was much more impressive in the 90s. Personally I use the 'blank' demo in xscreenaver. Which I guess I could replace with the script in TFA without noticing much. > Today users also expect the current time, battery state and many more information on the lock screen. We need to provide accessibility features which is not possible in XScreenSaver. I don't see why this is not possible with Xlib. Yes I have written Xlib code. Seems to be just an "omg xlib is so old" argument, and things being old does not by itself make them incorrect. > We need DBus integration > and logind integration Says who? I certainly don't need these.
    - cycloptic 7y ago
      I don't have any opinion on those. Regardless of how you or I feel about any extra features, the author does seem to have an answer to the security concern.
      - deleted 7y ago
        [deleted]

asveikau 7y ago

This mentions writing the screen lock UI in QT. jwz, maintainer of xscreensaver, had a rant about why he avoids the use of a big toolkit. The short version is he wants minimal code size because the consequence of a crash is to unlock the screen. The rant was prompted because of a real life gtk+ bug which made another screen locker crash. I would find a link and include it but jwz is hostile to links with HN as a referrer.

deleted 7y ago
[deleted]
cycloptic 7y ago
The author mentions what they did to mitigate this in the previous post in the series, see the part about XScreenSaver: https://blog.martin-graesslin.com/blog/2014/05/screenlocker-architecture-in-plasma-next/ https://blog.martin-graesslin.com/blog/2014/05/screenlocker-...
- asveikau 7y ago
  > the screen content can be exposed. Consider for example the linked screenshot. That's funny, because the effect there is obviously intended, because, uh, it looks cool. > For a screen saver of the last millennium this was a suitable solution It's true that this particular effect was much more impressive in the 90s. Personally I use the 'blank' demo in xscreenaver. Which I guess I could replace with the script in TFA without noticing much. > Today users also expect the current time, battery state and many more information on the lock screen. We need to provide accessibility features which is not possible in XScreenSaver. I don't see why this is not possible with Xlib. Yes I have written Xlib code. Seems to be just an "omg xlib is so old" argument, and things being old does not by itself make them incorrect. > We need DBus integration > and logind integration Says who? I certainly don't need these.
  - cycloptic 7y ago
    I don't have any opinion on those. Regardless of how you or I feel about any extra features, the author does seem to have an answer to the security concern.
    - deleted 7y ago
      [deleted]