4 ms·

It's not a sane security model if the product doesn't do what the users need it to do as a result.

vetinari 4y ago
It does. Just not with gates wide open. For example, screenshots. It is still possible to make screenshots. It is not possible to make screenshots without the user knowing. What use case do you have to make screenshots without user knowledge, that benefits the user?
- hulitu 4y ago
  On my computer i know (except for the web browser) which program makes screenshots. I want all my programs to function properly but not send my data over the internet. So i really don't see the problem Wayland is trying to solve (web browser still executes remote untrusted code).
  - vetinari 4y ago
    Does your OS use protected memory? Why? If you knew all your programs, and that they are well-behaved, there is no need for that. But we do use protected memory. And IOMMU (you know all the peripherals that you connect to your computer as well, right?). And other facilities intended to separate programs and hardware from each other. So the same way as programs do not snoop on shared global heap, do not big-bang i/o ports, etc, programs are not supposed to snoop on shared display surfaces (really just a subset of 'global shared heap'). If you need something specific from them, you ask them via defined way (e.g. screenshot API), that might or might not have facilities to enforce access control. Because we are not relying on them to be well behaved. Instead, we will notice if they aren't.
    - btschaegg 4y ago
      "I was merely endeavoring to indicate that if we do not grab events by the collar they will have us by the throat." SCNR :)
      - vetinari 4y ago
        Yup, exactly :-D
    - michaelmrose 4y ago
      If protected memory was implemented somehow per desktop environment and relegated me to choosing between Gnome and KDEs respective browsers/office suites instead of installing Firefox and Emacs I would either eschew it and take the risk or give up on Linux entirely and get a Mac.
      - indolering 4y ago
        > If protected memory was implemented somehow per desktop environment I'm sure LOTS of people stopped using certain Unix programs that relied on a single address space whenever that was implemented. But to quote myself a few relies up, >> These are not compelling arguments for running the GUI as root or allowing different applications to spy on each other. > or give up on Linux entirely and get a Mac. You mean the Unix that originally decided against using X11 because it would have required a re-write to do what they wanted anyway [1]? You understand that Wayland was designed by core Xorg contributors to replace X11 because attempts to match OS X resulted in a glitchy nightmare ... right? [1]: https://news.slashdot.org/comments.pl?sid=75257&cid=6734612 https://news.slashdot.org/comments.pl?sid=75257&cid=6734612
- michaelmrose 4y ago
  Corporate computers frequently make screen shots or screen recordings of employee interactions. The benefit of being wide open is that no coordination is needed between desktop environment and developer leading to a wide open field of tools that work on every environment without exception, difference in feature set, no need to check if version foo works on version bar of $DESKTOP. You could of course get virtually the same benefits plus improved security at the cost of some complexity by standardizing the feature in common usage for nearly 30 years towards the beginning of the development cycle of Wayland instead of 13 years in. You point out the need for security and completely ignore the fact that such security could trivially have been obtained without reducing users to obtaining a pile of tools only from their desktop environment or waiting 20 years for things to standardize so they can again pick and choose the best tools for the particular task.
  - indolering 4y ago
    > Corporate computers frequently make screen shots or screen recordings of employee interactions. It's not like they haven't figured out how to do that with Windows or OS X. > The benefit of being wide open is that no coordination is needed between desktop environment and developer The same is true of virtual memory. > You point out the need for security and completely ignore the fact that such security could trivially have been obtained The Xorg developers who tried really hard for decades would disagree with you. That's why programmers that Red Hat used to pay to hack on Xorg now get paid to develop Wayland [0]. [0]: https://www.theregister.com/2020/10/30/x_server_lead_maintainer_declares/ https://www.theregister.com/2020/10/30/x_server_lead_maintai...
    - michaelmrose 4y ago
      > The Xorg developers who tried really hard for... You misunderstand. Wayland development started in 2008. Screenshots/recording should have been on the board from day one and they could have gotten to standardizing on how to handle them in oh 2013-2015? The sin is not the extra complexity to secure the system. It's having first zero then more than one way to go about it and 13 years later ending up in the situation where some utilities support only X and some only some Wayland implementations. It's the sin of forcing your users to rip out the walls and stare at the plumbing. What other OS makes you think about display servers? Red Hat doesn't believe in the Linux ecosystem and it shows they believe in their ecosystem with a singular official GUI and unfortunately an ecosystem in which one is required to use only their tools is a mostly mediocre one because they are best in class in nothing and worst in class in many.
- pmarreck 4y ago
  > What use case do you have to make screenshots without user knowledge, that benefits the user? Headless browser testing. Network admin at a corporate site. For starters.
  - vetinari 4y ago
    You can do headless browser testing with virtual screen, that doesn't need real one. For corporate uses, you can use something like vPro and it's remote access. It works independently of the OS (and by default expects user consent too).
  - indolering 4y ago
    There is a sane API for this use case on every major platform. The argument is that X11 made a mistake by allowing it by default.

It does. Just not with gates wide open. For example, screenshots. It is still possible to make screenshots. It is not possible to make screenshots without the user knowing. What use case do you have to make screenshots without user knowledge, that benefits the user?

hulitu 4y ago
On my computer i know (except for the web browser) which program makes screenshots. I want all my programs to function properly but not send my data over the internet. So i really don't see the problem Wayland is trying to solve (web browser still executes remote untrusted code).
- vetinari 4y ago
  Does your OS use protected memory? Why? If you knew all your programs, and that they are well-behaved, there is no need for that. But we do use protected memory. And IOMMU (you know all the peripherals that you connect to your computer as well, right?). And other facilities intended to separate programs and hardware from each other. So the same way as programs do not snoop on shared global heap, do not big-bang i/o ports, etc, programs are not supposed to snoop on shared display surfaces (really just a subset of 'global shared heap'). If you need something specific from them, you ask them via defined way (e.g. screenshot API), that might or might not have facilities to enforce access control. Because we are not relying on them to be well behaved. Instead, we will notice if they aren't.
  - btschaegg 4y ago
    "I was merely endeavoring to indicate that if we do not grab events by the collar they will have us by the throat." SCNR :)
    - vetinari 4y ago
      Yup, exactly :-D
  - michaelmrose 4y ago
    If protected memory was implemented somehow per desktop environment and relegated me to choosing between Gnome and KDEs respective browsers/office suites instead of installing Firefox and Emacs I would either eschew it and take the risk or give up on Linux entirely and get a Mac.
    - indolering 4y ago
      > If protected memory was implemented somehow per desktop environment I'm sure LOTS of people stopped using certain Unix programs that relied on a single address space whenever that was implemented. But to quote myself a few relies up, >> These are not compelling arguments for running the GUI as root or allowing different applications to spy on each other. > or give up on Linux entirely and get a Mac. You mean the Unix that originally decided against using X11 because it would have required a re-write to do what they wanted anyway [1]? You understand that Wayland was designed by core Xorg contributors to replace X11 because attempts to match OS X resulted in a glitchy nightmare ... right? [1]: https://news.slashdot.org/comments.pl?sid=75257&cid=6734612 https://news.slashdot.org/comments.pl?sid=75257&cid=6734612
michaelmrose 4y ago
Corporate computers frequently make screen shots or screen recordings of employee interactions. The benefit of being wide open is that no coordination is needed between desktop environment and developer leading to a wide open field of tools that work on every environment without exception, difference in feature set, no need to check if version foo works on version bar of $DESKTOP. You could of course get virtually the same benefits plus improved security at the cost of some complexity by standardizing the feature in common usage for nearly 30 years towards the beginning of the development cycle of Wayland instead of 13 years in. You point out the need for security and completely ignore the fact that such security could trivially have been obtained without reducing users to obtaining a pile of tools only from their desktop environment or waiting 20 years for things to standardize so they can again pick and choose the best tools for the particular task.
- indolering 4y ago
  > Corporate computers frequently make screen shots or screen recordings of employee interactions. It's not like they haven't figured out how to do that with Windows or OS X. > The benefit of being wide open is that no coordination is needed between desktop environment and developer The same is true of virtual memory. > You point out the need for security and completely ignore the fact that such security could trivially have been obtained The Xorg developers who tried really hard for decades would disagree with you. That's why programmers that Red Hat used to pay to hack on Xorg now get paid to develop Wayland [0]. [0]: https://www.theregister.com/2020/10/30/x_server_lead_maintainer_declares/ https://www.theregister.com/2020/10/30/x_server_lead_maintai...
  - michaelmrose 4y ago
    > The Xorg developers who tried really hard for... You misunderstand. Wayland development started in 2008. Screenshots/recording should have been on the board from day one and they could have gotten to standardizing on how to handle them in oh 2013-2015? The sin is not the extra complexity to secure the system. It's having first zero then more than one way to go about it and 13 years later ending up in the situation where some utilities support only X and some only some Wayland implementations. It's the sin of forcing your users to rip out the walls and stare at the plumbing. What other OS makes you think about display servers? Red Hat doesn't believe in the Linux ecosystem and it shows they believe in their ecosystem with a singular official GUI and unfortunately an ecosystem in which one is required to use only their tools is a mostly mediocre one because they are best in class in nothing and worst in class in many.
pmarreck 4y ago
> What use case do you have to make screenshots without user knowledge, that benefits the user? Headless browser testing. Network admin at a corporate site. For starters.
- vetinari 4y ago
  You can do headless browser testing with virtual screen, that doesn't need real one. For corporate uses, you can use something like vPro and it's remote access. It works independently of the OS (and by default expects user consent too).
- indolering 4y ago
  There is a sane API for this use case on every major platform. The argument is that X11 made a mistake by allowing it by default.