5 ms·

So, all the fuzz about Wayland security and how it is good security to kill window managers at will... comes out totally void.

Kaze404 6y ago
Isn't one of the most popular Wayland clients a window manager? I'm confused.
- sprash 6y ago
  There is no such thing as a window manager on Wayland. Everything is baked into one centralized "compositor". AFAIK some compositors like Weston offer a non-standardized plug-in interface that allows a 3rd party to implement a window manager as a shared object. But so far I haven't seen anybody use it.
znpy 6y ago
yes but you're getting downvoted because HN doesn't like people actually realizing stuff.
- canofbars 6y ago
  No one who understands wayland was under the delusion that wayland would protect against an application which has full access to your user directory. Wayland becomes secure when combined with an application sandbox using SELinux/flatpak. Previously you could sandbox the app and X would provide an escape.
  - znpy 6y ago
    Yes, I am aware about this. Yet the most common way to denigrate Xorg is to assert that Xorg is basically a keylogger. Which might be true, but as this post shows just switching to Wayland doesn't offer any additional protection under the key-logging point of view. You might combine a sandboxing technique with Xorg too, by the way.
    - kaba0 6y ago
      I can’t understand what is so hard to understand... under Xorg a program even with a traditional sandbox in which it can’t do anything, but display a window IS basically capable of keylogging everything, getting a root password etc. On wayland with the same sandbox you are safe from said attack — this exploit works by tampering with dynamic libs, but that is not available inside a sandbox and it is simply pedantic. It’s like saying a car failed a crash test when they throw it off a building and it arrived on its top..

5 ms·

So, all the fuzz about Wayland security and how it is good security to kill window managers at will... comes out totally void.

by sam_lowry_ 6y ago

Kaze404 6y ago
Isn't one of the most popular Wayland clients a window manager? I'm confused.
- sprash 6y ago
  There is no such thing as a window manager on Wayland. Everything is baked into one centralized "compositor". AFAIK some compositors like Weston offer a non-standardized plug-in interface that allows a 3rd party to implement a window manager as a shared object. But so far I haven't seen anybody use it.
znpy 6y ago
yes but you're getting downvoted because HN doesn't like people actually realizing stuff.
- canofbars 6y ago
  No one who understands wayland was under the delusion that wayland would protect against an application which has full access to your user directory. Wayland becomes secure when combined with an application sandbox using SELinux/flatpak. Previously you could sandbox the app and X would provide an escape.
  - znpy 6y ago
    Yes, I am aware about this. Yet the most common way to denigrate Xorg is to assert that Xorg is basically a keylogger. Which might be true, but as this post shows just switching to Wayland doesn't offer any additional protection under the key-logging point of view. You might combine a sandboxing technique with Xorg too, by the way.
    - kaba0 6y ago
      I can’t understand what is so hard to understand... under Xorg a program even with a traditional sandbox in which it can’t do anything, but display a window IS basically capable of keylogging everything, getting a root password etc. On wayland with the same sandbox you are safe from said attack — this exploit works by tampering with dynamic libs, but that is not available inside a sandbox and it is simply pedantic. It’s like saying a car failed a crash test when they throw it off a building and it arrived on its top..