2 ms·

> I'm not worried about running a keylogger or something that's going to surreptitiously capture my screen. It's not a major issue. It's not an issue at all. Ne

> I'm not worried about running a keylogger or something that's going to surreptitiously capture my screen. It's not a major issue. It's not an issue at all. Never comes up. Yeah, I don't get this argument. If a process can already run on my account then I'm screwed anyway. It's trivial to e.g. do some bash magic to transparently replace `sudo` to get access to root without me knowing, and then hook into e.g. evdev to keylog every keystroke regardless of whether it's on Wayland or X11. Unless you sandbox everything (and no one does that on a normal desktop) Wayland's extra "security" guarantees are completely useless in practice, because they're trivial to bypass.

hollerith 3y ago
You may be right that Linux is a security disaster even with X11 replaced by Wayland, but ChromeOS is pretty secure and uses Wayland whereas I can't imagine its ever choosing to use X11.
- enriquto 3y ago
  > You may be right that Linux is a security disaster How so? If you run a program that you trust, like "ls", "vim", "firefox", "cat" or "rm", then you absolutely want it to be able to access all your data. That's the whole point of running a program: to read/write your data. If, for some reason, you want to run a program that you don't trust, you can run it easily inside a container or a virtual machine. I fail to see how this is a "security disaster". It seems very sane to me. How could it be even better?
  - Defletter 3y ago
    It's a rather all or nothing approach. You either trust it to access everything, or you don't run it at all. There's no middle ground. This is something I rather appreciate about Deno versus Node. There was a demonstration where cowsay was asking a bunch of permissions to things you wouldn't expect cowsay to need. And apps could update to increase what it accesses, like telemetry, and you wouldn't know or have any means to stop it. And the all or nothing approach means you just have to stop using the app entirely.

hollerith 3y ago

You may be right that Linux is a security disaster even with X11 replaced by Wayland, but ChromeOS is pretty secure and uses Wayland whereas I can't imagine its ever choosing to use X11.

enriquto 3y ago
> You may be right that Linux is a security disaster How so? If you run a program that you trust, like "ls", "vim", "firefox", "cat" or "rm", then you absolutely want it to be able to access all your data. That's the whole point of running a program: to read/write your data. If, for some reason, you want to run a program that you don't trust, you can run it easily inside a container or a virtual machine. I fail to see how this is a "security disaster". It seems very sane to me. How could it be even better?
- Defletter 3y ago
  It's a rather all or nothing approach. You either trust it to access everything, or you don't run it at all. There's no middle ground. This is something I rather appreciate about Deno versus Node. There was a demonstration where cowsay was asking a bunch of permissions to things you wouldn't expect cowsay to need. And apps could update to increase what it accesses, like telemetry, and you wouldn't know or have any means to stop it. And the all or nothing approach means you just have to stop using the app entirely.