5 ms·

Wayland works completely fine. The issues come from legacy applications and hardware vendors who refuse to work with it. Android solves these problems by tellin

Wayland works completely fine. The issues come from legacy applications and hardware vendors who refuse to work with it. Android solves these problems by telling software and firmware makers that they either get with the program or not have access to half the mobile phone market. As well as just saying no to all the absurd requirements like being able to stream the protocol over the internet or track exact XY inputs absolute to the screen outside of the apps own window. Desktop linux doesn't have this sway.

phkahler 3y ago
>> As well as just saying no to all the absurd requirements like being able to stream the protocol over the internet or track exact XY inputs absolute to the screen outside of the apps own window. Which is a security hole along with being able to read keystrokes meant for any app, grabbing pixels that aren't yours, etc... the features people complained were missing from Wayland for the longest time were often security issues that X could never solve by design. But hey, fuck security I want to run Xeyes!
- beanjuiceII 3y ago
  Times my system was hacked via x or xeyes since I started using Linux in 95... zero
  - charcircuit 3y ago
    It is not just about hacking your system. It's also about programs being able to hack into your accounts by keylogging you or stealing passwords from your clipboard. If you use cryptocurrencies malware can replace addresses on your clipboard with similar looking addresses while it's completely hidden in the background. Desktop Linux's security is usually like swiss cheese, so if you haven't been hacked it has more to do with you not encountering malware than your system protecting against it.
    - michaelmrose 3y ago
      General purpose Linux distributions whether using Wayland or X don't meaningfully protect you from compromised software running on your system. Traditionally on all systems 99.9% of the game has always been and remains not installing malware or compromising your data or credentials. This means 99.9% of actual threats to your security remain the same. If you want actual isolation you need to run something like qubes which ironically actuality uses X
      - Gigachad 3y ago
        Wayland is simply one piece in the puzzle. Flatpak, PipeWire, etc are the fixing the other parts. Things are very slowly moving in the right direction though. Unfortunately most linux distros and users do not take security seriously unless it's in a server environment. Desktop linux is awfully far behind systems like MacOS.
      - charcircuit 3y ago
        >Traditionally on all systems 99.9% of the game has always been and remains not installing malware or compromising your data or credentials. This is a doomer mindset that ignores the advances the rest of the industry has been making. There is a big difference from malware having to find a 0day in order to cause harm to the user and malware developers being able to do exactly what they want without even a permission dialog box showing up.
        michaelmrose 3y ago
        It's a practical mindset concerned with actual not hypothetical risks and actual not hypothetical costs and benefits.
      - Someone 3y ago
        > Traditionally on all systems 99.9% of the game has always been and remains not installing malware or compromising your data or credentials I won’t debate whether that’s true (it probably is, given that “not compromising your data or credentials” is close to a tautology “if you don’t let your stuff get stolen, it won’t get stolen”), but focus on > This means 99.9% of actual threats to your security remain the same. I don’t see how that follows because we’re not living in “traditionally” anymore. IMHO, if iOS and Android had run “traditional X Windows”, the number of successful over the air attacks would be way higher or nobody would use smartphones out of fear of getting hacked.
  - pjmlp 3y ago
    Apparently you weren't on our university, being a victim on unwanted content when the teacher would be going to look at your screen.
  - phkahler 3y ago
    >> Times my system was hacked via x or xeyes since I started using Linux in 95... zero Ummm right. The point wasn't that Xeyes is a security threat. It's that Xeyes is only possible because X is insecure by design, which is what allows the eyes to literally monitor what you're doing. Mouse, keystroke, screen grab. Hey go ahead and do your online banking with X. Just remember the real malware is headless, not literally displaying eyes to let you know it's watching.
- capableweb 3y ago
  Sure, but there are also legitimate uses for things like that, otherwise people wouldn't want them. How you build screen-recorders for example without "grabbing pixels that aren't yours"? Clearly, something is missing here. Why not a permission system like browsers do? A little popup that asks "X is requesting access to your full screen" rather than this "convenience VS security" black and white view most people seem to take a stance at?
  - Gigachad 3y ago
    The answer is that these need to be special privileges controlled by the OS. Which is exactly how wayland manages it. Discord capturing the screen is a valid use case, but it should be approved by the DE and it should be possible to block this request. Currently the mainstream DEs just approve the request by default but in the future I can see a permissions dialog asking the user if they want to allow access to screen recording, and maybe a small icon in the top bar to show when recordings are happening.
    - Bu9818 3y ago
      Yup, or with your own scripts managing bwrap and security-context if not using a DE/Flatpak.
    - roenxi 3y ago
      That answer sucks so much that after nearly 15 years of Wayland evangelism KDE e.V. Directors are writing blog posts with "Wait, that sounds like it sucks" as a heading and talking about how the issues have been resolved to the point where it is just "ready enough for Plasma and KDE apps", with some reasonable paraphrasing. That is not a history to be proud of, for all that even Wayland is a big step up from X and we're all grateful for the efforts these people go to. This idea that screenshots require special OS-level privileges has been tested and, in practice, does not work. Literally nobody wants compositor-specific screenshot applications. It should have been addressed in the Wayland standards in the early drafts. Fair enough unrestricted access to any pixel is a security problem. But banning all access to pixels other programs control was an unworkable position that, in hindsight, didn't work. Telling people that the process that merges all the pixels together needs special OS-level support for reporting on what the merged output look like is just not sane. Something went wrong in the design process.
deleted 3y ago
[deleted]
mattpallissard 3y ago
> Wayland works completely fine. Agreed. What's the missing feature? Screen sharing? Remote sessions? Overlapping displays (doesn't work in Android BTW)? We've had all of these for years. Even fractional scaling on hiDPI monitors has been good enough for me to not care for at least 5 years. It's like systemd; the people bitching either want to sound contrarian or actually know enough to roll their own down to the low level. At which point I must say; show me the code. Open a PR or give it a rest
- clhodapp 3y ago
  For me, personally, this was the year of Wayland... but that comes after years of checking every few months whether it was ready. My last-resolved reason not to switch: Popular compositors didn't support scaling for XWayland on par with how it works when X11 controls the screen right up until this year. This meant that you either had to opt out of scaling in Wayland (horrible on high dpi displays) or accept super blurry XWayland windows. Of course, it would be great if we didn't need XWayland but... That's not going to happen until more users have Wayland desktops and users like me weren't about to accept Wayland desktops while this type of problem existed.
- SAI_Peregrinus 3y ago
  Color management is an obvious one. There's a merge request, but still in progress.[1] Linux isn't particularly suitable to photo editing anyway, but it'd be nice to at least display colors properly! [1] https://gitlab.freedesktop.org/wayland/wayland-protocols/-/merge_requests/14 https://gitlab.freedesktop.org/wayland/wayland-protocols/-/m...

phkahler 3y ago

>> As well as just saying no to all the absurd requirements like being able to stream the protocol over the internet or track exact XY inputs absolute to the screen outside of the apps own window. Which is a security hole along with being able to read keystrokes meant for any app, grabbing pixels that aren't yours, etc... the features people complained were missing from Wayland for the longest time were often security issues that X could never solve by design. But hey, fuck security I want to run Xeyes!

beanjuiceII 3y ago
Times my system was hacked via x or xeyes since I started using Linux in 95... zero
- charcircuit 3y ago
  It is not just about hacking your system. It's also about programs being able to hack into your accounts by keylogging you or stealing passwords from your clipboard. If you use cryptocurrencies malware can replace addresses on your clipboard with similar looking addresses while it's completely hidden in the background. Desktop Linux's security is usually like swiss cheese, so if you haven't been hacked it has more to do with you not encountering malware than your system protecting against it.
  - michaelmrose 3y ago
    General purpose Linux distributions whether using Wayland or X don't meaningfully protect you from compromised software running on your system. Traditionally on all systems 99.9% of the game has always been and remains not installing malware or compromising your data or credentials. This means 99.9% of actual threats to your security remain the same. If you want actual isolation you need to run something like qubes which ironically actuality uses X
    - Gigachad 3y ago
      Wayland is simply one piece in the puzzle. Flatpak, PipeWire, etc are the fixing the other parts. Things are very slowly moving in the right direction though. Unfortunately most linux distros and users do not take security seriously unless it's in a server environment. Desktop linux is awfully far behind systems like MacOS.
    - charcircuit 3y ago
      >Traditionally on all systems 99.9% of the game has always been and remains not installing malware or compromising your data or credentials. This is a doomer mindset that ignores the advances the rest of the industry has been making. There is a big difference from malware having to find a 0day in order to cause harm to the user and malware developers being able to do exactly what they want without even a permission dialog box showing up.
      - michaelmrose 3y ago
        It's a practical mindset concerned with actual not hypothetical risks and actual not hypothetical costs and benefits.
    - Someone 3y ago
      > Traditionally on all systems 99.9% of the game has always been and remains not installing malware or compromising your data or credentials I won’t debate whether that’s true (it probably is, given that “not compromising your data or credentials” is close to a tautology “if you don’t let your stuff get stolen, it won’t get stolen”), but focus on > This means 99.9% of actual threats to your security remain the same. I don’t see how that follows because we’re not living in “traditionally” anymore. IMHO, if iOS and Android had run “traditional X Windows”, the number of successful over the air attacks would be way higher or nobody would use smartphones out of fear of getting hacked.
- pjmlp 3y ago
  Apparently you weren't on our university, being a victim on unwanted content when the teacher would be going to look at your screen.
- phkahler 3y ago
  >> Times my system was hacked via x or xeyes since I started using Linux in 95... zero Ummm right. The point wasn't that Xeyes is a security threat. It's that Xeyes is only possible because X is insecure by design, which is what allows the eyes to literally monitor what you're doing. Mouse, keystroke, screen grab. Hey go ahead and do your online banking with X. Just remember the real malware is headless, not literally displaying eyes to let you know it's watching.
capableweb 3y ago
Sure, but there are also legitimate uses for things like that, otherwise people wouldn't want them. How you build screen-recorders for example without "grabbing pixels that aren't yours"? Clearly, something is missing here. Why not a permission system like browsers do? A little popup that asks "X is requesting access to your full screen" rather than this "convenience VS security" black and white view most people seem to take a stance at?
- Gigachad 3y ago
  The answer is that these need to be special privileges controlled by the OS. Which is exactly how wayland manages it. Discord capturing the screen is a valid use case, but it should be approved by the DE and it should be possible to block this request. Currently the mainstream DEs just approve the request by default but in the future I can see a permissions dialog asking the user if they want to allow access to screen recording, and maybe a small icon in the top bar to show when recordings are happening.
  - Bu9818 3y ago
    Yup, or with your own scripts managing bwrap and security-context if not using a DE/Flatpak.
  - roenxi 3y ago
    That answer sucks so much that after nearly 15 years of Wayland evangelism KDE e.V. Directors are writing blog posts with "Wait, that sounds like it sucks" as a heading and talking about how the issues have been resolved to the point where it is just "ready enough for Plasma and KDE apps", with some reasonable paraphrasing. That is not a history to be proud of, for all that even Wayland is a big step up from X and we're all grateful for the efforts these people go to. This idea that screenshots require special OS-level privileges has been tested and, in practice, does not work. Literally nobody wants compositor-specific screenshot applications. It should have been addressed in the Wayland standards in the early drafts. Fair enough unrestricted access to any pixel is a security problem. But banning all access to pixels other programs control was an unworkable position that, in hindsight, didn't work. Telling people that the process that merges all the pixels together needs special OS-level support for reporting on what the merged output look like is just not sane. Something went wrong in the design process.

deleted 3y ago

[deleted]

mattpallissard 3y ago

> Wayland works completely fine. Agreed. What's the missing feature? Screen sharing? Remote sessions? Overlapping displays (doesn't work in Android BTW)? We've had all of these for years. Even fractional scaling on hiDPI monitors has been good enough for me to not care for at least 5 years. It's like systemd; the people bitching either want to sound contrarian or actually know enough to roll their own down to the low level. At which point I must say; show me the code. Open a PR or give it a rest

clhodapp 3y ago
For me, personally, this was the year of Wayland... but that comes after years of checking every few months whether it was ready. My last-resolved reason not to switch: Popular compositors didn't support scaling for XWayland on par with how it works when X11 controls the screen right up until this year. This meant that you either had to opt out of scaling in Wayland (horrible on high dpi displays) or accept super blurry XWayland windows. Of course, it would be great if we didn't need XWayland but... That's not going to happen until more users have Wayland desktops and users like me weren't about to accept Wayland desktops while this type of problem existed.
SAI_Peregrinus 3y ago
Color management is an obvious one. There's a merge request, but still in progress.[1] Linux isn't particularly suitable to photo editing anyway, but it'd be nice to at least display colors properly! [1] https://gitlab.freedesktop.org/wayland/wayland-protocols/-/merge_requests/14 https://gitlab.freedesktop.org/wayland/wayland-protocols/-/m...