> The security paradigm is blacklisting [...]. Since the vast majority of Software on FOSS system is trusted X11 is the far superior solution here. This is abs

> The security paradigm is blacklisting [...]. Since the vast majority of Software on FOSS system is trusted X11 is the far superior solution here. This is absolutely not a good solution. Even if you audited all your software enough to consider it trusted (which is unlikely if you're not a purist - see IDEs, browsers, widevine, Docker ...), it does not guarantee anything is secure. Anything that receives input from the outside might be vulnerable to an RCE. If you're running it under a different user or in a jail, the impact is limited - unless it can access your X server, in which case it can simply log everything you type and escalate. Jailing an app is basically impossible under X. Yes, you can use Zephyr, but you're not going to be able to watch a video there and you're WM integration is going to be miserable as well. And realistically you'd really need to jail most apps. X11 might work for a lot of things, but blacklisting is absolutely not a superior approach.