3 ms·
Does this mean that I will no longer be able to ssh -X myvm firefox ? This is my way of browsing and I feel much safer than running it raw.
by enriquto 4y ago
Does this mean that I will no longer be able to ssh -X myvm firefox ? This is my way of browsing and I feel much safer than running it raw.
- Hackbraten 4y agoThat should still work. They didn’t isolate all the Firefox processes from X11. Only the content processes are affected, i.e. the processes whose attack surface is rather massive. But the content processes are still going to deliver their finished work items to the GPU process for rendering. The GPU process retains all the rights it needs, including talking to X11.
- pcwalton 4y agoI don't see why you wouldn't still be able to do that. Firefox still uses X11; it's just that the content processes can't directly speak the protocol now, and must go over IPC to a more trusted process to do so.
- heavyset_go 4y agoAny reason you're using SSH X forwarding over something like Xpra? It also works over SSH, but lets apps persist even if the SSH connection is broken for whatever reason. You can even run Firefox via Wayland and forward a persistent XWayland session if that's your cup of tea.
- yjftsjthsd-h 4y agoThat sounds like more work than "ssh with one extra flag"
- heavyset_go 4y agoThe latter is, but that's only if you want to use Wayland. Xpra offers persistent sessions behind a single command, and uses SSH by default.
- kzrdude 4y agoSo it's like mosh for X forwarding?
- heavyset_go 4y agoYeah, I think the project describes itself as "screen for X" or something like that.