2 ms·
An excellent technology. But truthfully if you want to apply that level of filtering, X11 is a more constrained language with more conventional app behavior an
by ajross 4y ago
An excellent technology. But truthfully if you want to apply that level of filtering, X11 is a more constrained language with more conventional app behavior and it's easier to protect via stateful inspection than arbitrary syscall filtering.
- pcwalton 4y agoBut Wayland is far easier than that to secure, because it's reasonably secure today. Securing X11 would be a lot of work, which nobody has signed up to do. Far easier than fixing the relatively minor complaints about Wayland. Besides, seccomp-bpf and windowing protocol security are orthogonal. Desktop apps must make syscalls, and they must interact with the window server. You need security for both.