> You can’t even isolate X applications without running other X.org because there is no permission control once the application has access into socket, and with

> You can’t even isolate X applications without running other X.org because there is no permission control once the application has access into socket, and with socket it can see everything. And you can’t really rework that. Sometimes you need to rewrite whole thing. Actually you can, the X server can run applications in an untrusted state where they cannot see other resources. It is not straightforward to setup though so running a nested X server is much simpler - at least until you realize that the same "untrusted" app has access to the rest of your system anyway. > It is X.org which provides access for keystrokes and windows. You can avoid that if you want but as others have mentioned you are way more likely to need that functionality for legitimate purposes.