5 ms·

The issues with xorg that i’m aware of are that it’s awful to maintain and that it has security issues like everything being able to access your clipboard. And

The issues with xorg that i’m aware of are that it’s awful to maintain and that it has security issues like everything being able to access your clipboard. And xwayland exists so porting isn’t much of an issue. But yeah, despite all that i’m on x11 still as well. I need to use proprietary nvidia drivers and I don’t want to run full gnome or whatever to make that run smoothly. I’ll probably be dead before dwm stops working on an updated system.

kaba0 4y ago
I don’t own nvidia, but from what I read they finally managed to have proper DRM support in their drivers which was the only limiting factor for Wayland (as opposed to nvidia patching your X server binary to run the proprietary driver, Wayland in itself only depends on proper linux kernel APIs which weren’t supported by nvidia for a long time)
- BaculumMeumEst 4y ago
  The technical capability does seem to be there, I was able to run Sway with the --unsupported-gpu flag for a little while, but it broke unfortunately, and my investment in Wayland isn't high enough to try to support it myself. I'm not sure if any other wlroots compositor based projects support nvidia.
woodruffw 4y ago
I don’t mean this in a flamey way, but I’ve always wondered what the importance of clipboard isolation is, given how bad of a user experience it results in. I’m a security engineer, and I can’t think of many threat models in which an attacker can snoop clipboard contents but can’t do much worse things, which I assume is why neither macOS nor Windows has ever bothered with clipboard isolation. (It’s entirely possible I’m under-thinking it!)
- kaba0 4y ago
  So you think it is okay for a single npm install to fork a process and continuously query the clipboard and without any sort of notice just upload it to some random server? Or, even just log every single keystroke you press? Hell, it can even take screenshots of everything. Afaik macOS doesn’t allow clipboard access in that naive way and you do get access in wayland, it is just not this “uncontrolled”.
  - woodruffw 4y ago
    > So you think it is okay for a single npm install to fork a process and continuously query the clipboard and without any sort of notice just upload it to some random server? Or, even just log every single keystroke you press? Hell, it can even take screenshots of everything. No, I don't think it's "okay." I just think it's indistinguishable from running arbitrary code, which is much worse anyways. Again, ask yourself: what is the specific threat model in which an attacker can run a process that continually polls the clipboard, but can't do anything else? > Afaik macOS doesn’t allow clipboard access in that naive way and you do get access in wayland, it is just not this “uncontrolled”. You can try this for yourself: the `pbcopy` and `pbpaste` utilities on macOS allow uncontrolled access to the clipboard without any entitlements. These are well-known utilities that are baked into macOS, and are widely used by tools like password managers to programmatically control the clipboard. More generally, you can look up the NSPasteboard and UIPasteboard APIs that Apple offers on macOS and iOS. There are no special entitlements required for either.

kaba0 4y ago

I don’t own nvidia, but from what I read they finally managed to have proper DRM support in their drivers which was the only limiting factor for Wayland (as opposed to nvidia patching your X server binary to run the proprietary driver, Wayland in itself only depends on proper linux kernel APIs which weren’t supported by nvidia for a long time)

BaculumMeumEst 4y ago
The technical capability does seem to be there, I was able to run Sway with the --unsupported-gpu flag for a little while, but it broke unfortunately, and my investment in Wayland isn't high enough to try to support it myself. I'm not sure if any other wlroots compositor based projects support nvidia.

woodruffw 4y ago

I don’t mean this in a flamey way, but I’ve always wondered what the importance of clipboard isolation is, given how bad of a user experience it results in. I’m a security engineer, and I can’t think of many threat models in which an attacker can snoop clipboard contents but can’t do much worse things, which I assume is why neither macOS nor Windows has ever bothered with clipboard isolation. (It’s entirely possible I’m under-thinking it!)

kaba0 4y ago
So you think it is okay for a single npm install to fork a process and continuously query the clipboard and without any sort of notice just upload it to some random server? Or, even just log every single keystroke you press? Hell, it can even take screenshots of everything. Afaik macOS doesn’t allow clipboard access in that naive way and you do get access in wayland, it is just not this “uncontrolled”.
- woodruffw 4y ago
  > So you think it is okay for a single npm install to fork a process and continuously query the clipboard and without any sort of notice just upload it to some random server? Or, even just log every single keystroke you press? Hell, it can even take screenshots of everything. No, I don't think it's "okay." I just think it's indistinguishable from running arbitrary code, which is much worse anyways. Again, ask yourself: what is the specific threat model in which an attacker can run a process that continually polls the clipboard, but can't do anything else? > Afaik macOS doesn’t allow clipboard access in that naive way and you do get access in wayland, it is just not this “uncontrolled”. You can try this for yourself: the `pbcopy` and `pbpaste` utilities on macOS allow uncontrolled access to the clipboard without any entitlements. These are well-known utilities that are baked into macOS, and are widely used by tools like password managers to programmatically control the clipboard. More generally, you can look up the NSPasteboard and UIPasteboard APIs that Apple offers on macOS and iOS. There are no special entitlements required for either.