4 ms·

I’m using a Dell UP2718Q (3840x2160, 144dpi, 60Hz) and a Fujitsu Siemens P17-2 (1024x1280, 96dpi, 75Hz) side by side, and without Wayland this setup isn’t even

I’m using a Dell UP2718Q (3840x2160, 144dpi, 60Hz) and a Fujitsu Siemens P17-2 (1024x1280, 96dpi, 75Hz) side by side, and without Wayland this setup isn’t even possible to get working properly. Sadly, KDE still doesn’t support it nicely under Wayland (so I moved to Ubuntu Budgie), but under X11 it’s entirely impossible to run it properly, as except for Qt nothing supports mixed DPI, or mixed refresh rates properly. Once proper wide color gamut and bitdepth support is added, it’ll be even better, as the monitors are 10-bit Rec.2020 and 8-bit sRGB. Which under X11 isn’t even possible to support, as again, Xorg only sees one single screen it’s drawing on, and it’s up to the lower levels of the stack to split that. EDIT: Answering the most common question which is asked all the time as my comment is getting some visibility here: Now why does wayland break screenshot and keyboard tools? Because "every program is a keylogger by default and can see any event, look at the contents of any window" is a major security issue, especially as it means the entire security model of screen lockers or containerized applications is useless. Under X11, basically every application you run can trivially escalate itself to root. As even your Zoom client can just listen to your key events when you unlock your screen or use sudo in your terminal, save your password, and tada it can elevate itself. Under X11, there is no security whatsoever, and no separation of privileges. EDIT2: Why is sandboxing applications important? (a) more and more proprietary software is also released for linux, which you probably shouldn’t trust. And (b) if e.g. your XMPP client is compromised, you don’t want the attacker to gain root. EDIT3: Yes, screenshot tools and screensharing still works. I can use KDE Spectacle under Budgie or Chrome, and Slack, Teams, Discord, Jitsi all work just fine. OBS requires a patch, but also works nicely. It’s not impossible, it just requires software using it to be updated.

lmm 6y ago
> Sadly, KDE still doesn’t support it nicely under Wayland (so I moved to Ubuntu Budgie), but under X11 it’s entirely impossible to run it properly, as except for Qt nothing supports mixed DPI, or mixed refresh rates properly. Sounds like a roughly equivalent situation either way? Personally I'd sooner use only Qt applications than have to use Gnome.
- kuschku 6y ago
  I’m using (except for firefox) 100% Qt applications under Ubuntu Budgie (which is a bit like elementary but with Wayland support). The result is good enough for my use case, I don’t have to deal with toy applications and I can use the full crisp resolution. And thanks to standard protocols, I can use KDE software like KDE Spectacle as screenshot tool or screensharing with Slack, Teams, Jitsi under Budgie just fine.
  - lmm 6y ago
    > I’m using (except for firefox) 100% Qt applications under Ubuntu Budgie (which is a bit like elementary but with Wayland support). If your only non-Qt application was Firefox, what was your problem under X11? Certainly for me having to switch to Gnome's WM/panels/etc. much would be more disruptive than switching browsers. (You might find Firefox valuable enough to be worth switching your whole DE for, in which case fair enough, but I don't think it's an objective advantage for Wayland). (IMO Konqueror is a much better browser, but I'm sure everyone has their own preferences)
    - kuschku 6y ago
      I’m a dev, and as it turns out, as firefox is more standards-compliant than chrome, if something runs in firefox, it’ll pretty much run in every browser (the opposite is not true, as blink has lots of custom extensions to the standard you might use accidentally). Plus I use firefox lockwise as password manager.
mindcrime 6y ago
Now why does wayland break screenshot and keyboard tools? Because "every program is a keylogger by default and can see any event, look at the contents of any window" is a major security issue, especially as it means the entire security model of screen lockers or containerized applications is useless. OK, so what's the solution here? Give up on screen-shotting tools forever? Or is there a plan to fix this somehow?
- kuschku 6y ago
  There’s an API for that. e.g. KDE Spectacle uses it, which is why it can be used as screenshot tool under wayland no matter your DE. But by making it an explicit API, you can also apply an include/exclude list to the programs allowed to call this API, and e.g. exclude sandboxed applications from taking screenshots. Or e.g. add a permissions prompt (as on android or iOS) for an application to request to be on that include list.
- mzi 6y ago
  I use grim[0] under Wayland, and it can grab things off my screen. [0] https://github.com/emersion/grim https://github.com/emersion/grim
- PurpleFoxy 6y ago
  The solution is to make it a permission. On macOS you can’t just record the screen, you can open the OS settings page and tell the user to allow screen recording and now your program gains access to this feature.
spijdar 6y ago
Professional pentester here - Wayland alone doesn't really do much for you, security wise. It is still very possible for an application simply running under a wayland compositor to do lots of nasty things. The Wayland protocol provides the building blocks for someone to create an Android-like sandboxed environment, but doing so would break every application. Snaps and Flatpak come closer, but still generally miss the mark, since many applications require your entire home directory to be bind mounted in their container. Running wayland alone gets you very little in terms of sandboxing. It locks the front door, but leaves the backdoor and all your windows open, because that's what every application under the sun expects. > Under X11, you are basically running every application with root, always. This is ... not true, either broadly or generally. You're saying this because Xorg runs as root, which means that any security flaw in Xorg yields root access. I think saying that "you are running every application with root" is stretching it a bit, but I'll accept it. But Xorg doesn't have to run as root. OpenBSD started it years ago with Xenocara, but AFAIK Fedora also does not run Xorg as root. I'm not sure what other OSes are doing, but it's at least not a flaw of X11 in general, just a flaw of Xorg.
- kuschku 6y ago
  > This is ... not true, either broadly or generally I’m saying that because if you ever type in your password, e.g. into a screenlocker, into a terminal with sudo, or an apt-get gui, every application can listen to those input events. Every application has the ability to be a keylogger by default. And with that captured password, it then can either inject input events into your terminal, or run sudo itself. > The Wayland protocol provides the building blocks for someone to create an Android-like sandboxed environment, but doing so would break every application. Snaps and Flatpak come closer, but still generally miss the mark, since many applications require your entire home directory to be bind mounted in their container. That’s true, but also not. With X11, even a flatpak without any special permissions or bind mounts can still basically control your system. Just listen for input events until you see the keys "s u d o", then listen until you see something that looks like a password, then wait until the user is not paying attention, and inject virtual input events to start a terminal and inject input events to run "sudo rm -rf /*" with the password you captured earlier. By making the ability to intercept, record, or inject input events a special API, wayland at least allows flatpaks to be sandboxed at all.
sushisource 6y ago
This is definitely not entirely true of x11. I have mixed DPI (which, admittedly, does work for shit, but can be hacked around by using a wrapper script to launch things with different DPIs) and mixed refresh rates. The mixed refresh rates work perfectly, zero issues (as configured via nvidia drivers, admittedly annoying for other reasons). That said I would use wayland if nvidia wasn't busy fucking everything up.
- kuschku 6y ago
  > but can be hacked around by using a wrapper script to launch things with different DPIs I have firefox windows on both monitors, and like to drag tabs over from one to the other. Under X11, doing so is either impossible, or requires restarting firefox, which really isn’t something I’d wanna do. There was an old XUL extension for firefox to parse QT_SCREEN_SCALE_FACTORS and apply it instead, but that’s long gone. And normal Gtk apps never worked properly.
tleb_ 6y ago
The question is then: is this isolation even useful? There are a lot of attacks that still exist when a program runs in userspace and that are not inherent to GUI programs. Example: creating an executable named sudo somewhere in a directory that is in your ~ and PATH.
- kuschku 6y ago
  Sure, but if you’re under X11, then a flatpak or any other jailed application can still trivially elevate itself to root. Jailing applications only has a meaningful benefit whatsoever under wayland, as a flatpak without bind-home under wayland is actually properly sandboxed. Still a rare case, but at least it’s possible and getting even somewhat common.
- PurpleFoxy 6y ago
  Wayland is only one piece in the security puzzle. Flatpak and SELinux are the other pieces. Under X there is no point sandboxing a GUI app since X provides an escape.
ebiester 6y ago
I get the frustration, but fundamentally, screen sharing and screenshots are so integral to my daily use that I couldn't even consider wayland. For nearly any remote worker at this point, at least the ones I work with, this is fundamentally true. In 2021, screen sharing and screenshots are table stakes.
- kuschku 6y ago
  I use KDE spectacle under Gnome/Budgie for screenshots (works fine) and screen sharing works fine with Slack, Teams, Discord and Jitsi.
- PurpleFoxy 6y ago
  Screen sharing and screenshots do work on wayland as long as the application is updated to support it. Electron only recently gained this capability so not all electron apps have updated yet. No one will fault you for using X because zoom hasn’t supported wayland yet. The problem is people sharing blatant falsehoods like “wayland doesn’t support screen sharing” when there are plenty of programs that can do just that on wayland.
roel_v 6y ago
And yet on every other OS, users can take screenshots and use virtual keyboards... It's not because X's security model is broken that the solution is 'we'll just remove that functionality'.
- kuschku 6y ago
  And yet instead of looking at sibling comments you asked the same question again, so I’ll have to answer it for at least the fifth time in this thread. Wayland allows the same as well. It’s just an include/exclude list for such APIs, so you can actually limit which programs can access what. Under X11, jailing GUI apps is entirely useless as there is no actual security boundary. Under wayland, you as user are in control and can define whether spectacle should be able to take screenshots (sure) and whether myflashlight-flatpak should be able to access all input events and take screenshots (probably not).
renewiltord 6y ago
It's probably the mixed dpi because I've been using a Qnix overclocked to 96 Hz and a Vizio at 144 Hz, both 27" 1440p for a while and I get different refresh rates and everything works normally.

lmm 6y ago

> Sadly, KDE still doesn’t support it nicely under Wayland (so I moved to Ubuntu Budgie), but under X11 it’s entirely impossible to run it properly, as except for Qt nothing supports mixed DPI, or mixed refresh rates properly. Sounds like a roughly equivalent situation either way? Personally I'd sooner use only Qt applications than have to use Gnome.

kuschku 6y ago
I’m using (except for firefox) 100% Qt applications under Ubuntu Budgie (which is a bit like elementary but with Wayland support). The result is good enough for my use case, I don’t have to deal with toy applications and I can use the full crisp resolution. And thanks to standard protocols, I can use KDE software like KDE Spectacle as screenshot tool or screensharing with Slack, Teams, Jitsi under Budgie just fine.
- lmm 6y ago
  > I’m using (except for firefox) 100% Qt applications under Ubuntu Budgie (which is a bit like elementary but with Wayland support). If your only non-Qt application was Firefox, what was your problem under X11? Certainly for me having to switch to Gnome's WM/panels/etc. much would be more disruptive than switching browsers. (You might find Firefox valuable enough to be worth switching your whole DE for, in which case fair enough, but I don't think it's an objective advantage for Wayland). (IMO Konqueror is a much better browser, but I'm sure everyone has their own preferences)
  - kuschku 6y ago
    I’m a dev, and as it turns out, as firefox is more standards-compliant than chrome, if something runs in firefox, it’ll pretty much run in every browser (the opposite is not true, as blink has lots of custom extensions to the standard you might use accidentally). Plus I use firefox lockwise as password manager.

mindcrime 6y ago

Now why does wayland break screenshot and keyboard tools? Because "every program is a keylogger by default and can see any event, look at the contents of any window" is a major security issue, especially as it means the entire security model of screen lockers or containerized applications is useless. OK, so what's the solution here? Give up on screen-shotting tools forever? Or is there a plan to fix this somehow?

kuschku 6y ago
There’s an API for that. e.g. KDE Spectacle uses it, which is why it can be used as screenshot tool under wayland no matter your DE. But by making it an explicit API, you can also apply an include/exclude list to the programs allowed to call this API, and e.g. exclude sandboxed applications from taking screenshots. Or e.g. add a permissions prompt (as on android or iOS) for an application to request to be on that include list.
mzi 6y ago
I use grim[0] under Wayland, and it can grab things off my screen. [0] https://github.com/emersion/grim https://github.com/emersion/grim
PurpleFoxy 6y ago
The solution is to make it a permission. On macOS you can’t just record the screen, you can open the OS settings page and tell the user to allow screen recording and now your program gains access to this feature.

spijdar 6y ago

Professional pentester here - Wayland alone doesn't really do much for you, security wise. It is still very possible for an application simply running under a wayland compositor to do lots of nasty things. The Wayland protocol provides the building blocks for someone to create an Android-like sandboxed environment, but doing so would break every application. Snaps and Flatpak come closer, but still generally miss the mark, since many applications require your entire home directory to be bind mounted in their container. Running wayland alone gets you very little in terms of sandboxing. It locks the front door, but leaves the backdoor and all your windows open, because that's what every application under the sun expects. > Under X11, you are basically running every application with root, always. This is ... not true, either broadly or generally. You're saying this because Xorg runs as root, which means that any security flaw in Xorg yields root access. I think saying that "you are running every application with root" is stretching it a bit, but I'll accept it. But Xorg doesn't have to run as root. OpenBSD started it years ago with Xenocara, but AFAIK Fedora also does not run Xorg as root. I'm not sure what other OSes are doing, but it's at least not a flaw of X11 in general, just a flaw of Xorg.

kuschku 6y ago
> This is ... not true, either broadly or generally I’m saying that because if you ever type in your password, e.g. into a screenlocker, into a terminal with sudo, or an apt-get gui, every application can listen to those input events. Every application has the ability to be a keylogger by default. And with that captured password, it then can either inject input events into your terminal, or run sudo itself. > The Wayland protocol provides the building blocks for someone to create an Android-like sandboxed environment, but doing so would break every application. Snaps and Flatpak come closer, but still generally miss the mark, since many applications require your entire home directory to be bind mounted in their container. That’s true, but also not. With X11, even a flatpak without any special permissions or bind mounts can still basically control your system. Just listen for input events until you see the keys "s u d o", then listen until you see something that looks like a password, then wait until the user is not paying attention, and inject virtual input events to start a terminal and inject input events to run "sudo rm -rf /*" with the password you captured earlier. By making the ability to intercept, record, or inject input events a special API, wayland at least allows flatpaks to be sandboxed at all.

sushisource 6y ago

This is definitely not entirely true of x11. I have mixed DPI (which, admittedly, does work for shit, but can be hacked around by using a wrapper script to launch things with different DPIs) and mixed refresh rates. The mixed refresh rates work perfectly, zero issues (as configured via nvidia drivers, admittedly annoying for other reasons). That said I would use wayland if nvidia wasn't busy fucking everything up.

kuschku 6y ago
> but can be hacked around by using a wrapper script to launch things with different DPIs I have firefox windows on both monitors, and like to drag tabs over from one to the other. Under X11, doing so is either impossible, or requires restarting firefox, which really isn’t something I’d wanna do. There was an old XUL extension for firefox to parse QT_SCREEN_SCALE_FACTORS and apply it instead, but that’s long gone. And normal Gtk apps never worked properly.

tleb_ 6y ago

The question is then: is this isolation even useful? There are a lot of attacks that still exist when a program runs in userspace and that are not inherent to GUI programs. Example: creating an executable named sudo somewhere in a directory that is in your ~ and PATH.

kuschku 6y ago
Sure, but if you’re under X11, then a flatpak or any other jailed application can still trivially elevate itself to root. Jailing applications only has a meaningful benefit whatsoever under wayland, as a flatpak without bind-home under wayland is actually properly sandboxed. Still a rare case, but at least it’s possible and getting even somewhat common.
PurpleFoxy 6y ago
Wayland is only one piece in the security puzzle. Flatpak and SELinux are the other pieces. Under X there is no point sandboxing a GUI app since X provides an escape.

ebiester 6y ago

I get the frustration, but fundamentally, screen sharing and screenshots are so integral to my daily use that I couldn't even consider wayland. For nearly any remote worker at this point, at least the ones I work with, this is fundamentally true. In 2021, screen sharing and screenshots are table stakes.

kuschku 6y ago
I use KDE spectacle under Gnome/Budgie for screenshots (works fine) and screen sharing works fine with Slack, Teams, Discord and Jitsi.
PurpleFoxy 6y ago
Screen sharing and screenshots do work on wayland as long as the application is updated to support it. Electron only recently gained this capability so not all electron apps have updated yet. No one will fault you for using X because zoom hasn’t supported wayland yet. The problem is people sharing blatant falsehoods like “wayland doesn’t support screen sharing” when there are plenty of programs that can do just that on wayland.

roel_v 6y ago

And yet on every other OS, users can take screenshots and use virtual keyboards... It's not because X's security model is broken that the solution is 'we'll just remove that functionality'.

kuschku 6y ago
And yet instead of looking at sibling comments you asked the same question again, so I’ll have to answer it for at least the fifth time in this thread. Wayland allows the same as well. It’s just an include/exclude list for such APIs, so you can actually limit which programs can access what. Under X11, jailing GUI apps is entirely useless as there is no actual security boundary. Under wayland, you as user are in control and can define whether spectacle should be able to take screenshots (sure) and whether myflashlight-flatpak should be able to access all input events and take screenshots (probably not).

renewiltord 6y ago

It's probably the mixed dpi because I've been using a Qnix overclocked to 96 Hz and a Vizio at 144 Hz, both 27" 1440p for a while and I get different refresh rates and everything works normally.