4 ms·
A tangent but where could I find a good evaluation of Wayland stack (including Weston etc) security? I know the design is often brought up but most vulnerabilit
by fulafel 6y ago
A tangent but where could I find a good evaluation of Wayland stack (including Weston etc) security? I know the design is often brought up but most vulnerabilities are implementation errors and bugs, and there doesn't seem to be any mention of security (advisories, etc) on the Wayland web site nor does a web search bring up anything that woudl indicate there's any active security focus.
What I'd expect to find is some description of the security guarantees they provide, and some active work (such as fuzzing with hostile clients), and tracking of found & fixed vulnerabilities.
- MayeulC 6y agoWell, you can read the Wayland book, for instance: https://wayland-book.com/ https://wayland-book.com/ Of course, security is subject to implementation details. But as far as I know, the protocol is sound, and I can't recall vulnerabilities. How each implementation handles theirs is up to them. At least, we have multiple implementations of the protocol. With X, not so much.
- fulafel 6y agoI didn't find answers to my questions about implementation level security on the wayland-book.com site unfortunately. Having multiple young codebases implementing the spec doesn't really provide security assurance at this point, though it can have other benefits.