3 ms·

No it won't Wayland protocol doesn't support it, besides Wayland has been here for such a long time. Pretending like Wayland is ready to replace X is like prete

No it won't Wayland protocol doesn't support it, besides Wayland has been here for such a long time. Pretending like Wayland is ready to replace X is like pretending like we can ban cars tomorrow and bikes will be good enough. It's completely delusional.

walteweiss 3y ago
But if Wayland is a new step of development for X, then these features could be implemented differently, I believe. Maybe for security reasons or simplicity or others. As if someone misses X so much, they could still use it or even maintain it if they can. I never used X much, as I completely switched to Linux just a few years ago. So I don’t miss a thing.
play_ac 3y ago
Keyboard/mouse sharing is completely unrelated to the Wayland protocol. Wayland is only concerned with sending input events to client windows. Generating and capturing global events is out-of-scope and it's an entirely different API. The way this works in X11 is a giant hack that requires multiple extensions and the end result is it compromises all security of those devices. It's even more delusional to pretend this was ever production-ready or that Wayland needs to be ready for anything here. The X11 implementation just shouldn't have been shipped at all.
- superkuh 3y ago
  You keep saying X11 is insecure but I've never had a problem with that in the last 20 years. I've never known anyone with an X11 security problem in the last 20 years. I've never heard of anyone having an X11 security problem in the last 20 years. Perhaps you can point me to an incident? The idea that it's "insecure" to let applications on your computer access the inputs of other programs comes from smartphone space where you don't actually control your computer or the software on it and that becomes a problem. But for actual computers you control it just isn't (a problem). Wayland for "security" is cargo culting smartphone user problems. It's not actually a real issue. I use the keyboard/mouse sharing in X11 (via synergy) and I have for 20 years. It is vitally important to my workflow. It works on dozens of different OSes including linux. But not the waylands linuxes. Any graphical environment that can't do this is useless to me. Might as well not even release the waylands at all (see how silly applying my personal preferences globally seems?).
  - play_ac 3y ago
    >I've never heard of anyone having an X11 security problem in the last 20 years. Here's 6 CVEs just from last month. Check the mailing lists and you'll see many of these going back for years and years. https://lists.x.org/archives/xorg/2023-October/061506.html https://lists.x.org/archives/xorg/2023-October/061506.html https://lists.x.org/archives/xorg/2023-October/061514.html https://lists.x.org/archives/xorg/2023-October/061514.html And before you say this is not what you meant, the X server and X client libraries do very little anymore besides parsing untrusted input and passing it somewhere else. That's its main purpose and it's completely bad at it. And because it's X, this input can also come from over the network too so every normal memory bug can also be an RCE. This is probably the single biggest attack vector on a desktop system aside from the toolkit. It's the exact wrong thing for anyone to grant access to every input on the system. This is not just my personal opinion or me giving anecdotes either, this is paraphrasing what I've heard X developers say after many years of patching these bugs. But that's not even the whole problem as I'll explain shortly. >But for actual computers you control it just isn't (a problem). Wayland for "security" is cargo culting smartphone user problems. It's not actually a real issue. Yes it is a problem and no it's not cargo culting. Practically speaking the X11 security model means every X client gets access to everything including all your passwords (and the root password) as you type them, and subsequently lets every X client spawn arbitrary root processes and get access to your whole filesystem including your private keys and insert kernel modules or do whatever. If you actually think this "isn't a real issue" then you should just stop using passwords, stop protecting your private keys, run every program as root, and disable memory protection: because that's what this actually means in practice. No I'm not exaggerating. The security model of X11 has no idea about client boundaries at all. This is completely unacceptable on any other OS but for some reason it's become a meme to say that only smartphones need to care about this. Really? Come on. >I use the keyboard/mouse sharing in X11 (via synergy) and I have for 20 years. It is vitally important to my workflow. It works on dozens of different OSes including linux. But not the waylands linuxes. Any graphical environment that can't do this is useless to me. X11 can't do it securely so I would say that's as useless as not implementing the feature, if you have to compromise your security in order to get it. The feature will be implemented in Wayland eventually when the design for a secure API is finished. There are people working on it now. In comparison, X11 is probably never going to gain a secure way to do that.

walteweiss 3y ago

But if Wayland is a new step of development for X, then these features could be implemented differently, I believe. Maybe for security reasons or simplicity or others. As if someone misses X so much, they could still use it or even maintain it if they can. I never used X much, as I completely switched to Linux just a few years ago. So I don’t miss a thing.

play_ac 3y ago

Keyboard/mouse sharing is completely unrelated to the Wayland protocol. Wayland is only concerned with sending input events to client windows. Generating and capturing global events is out-of-scope and it's an entirely different API. The way this works in X11 is a giant hack that requires multiple extensions and the end result is it compromises all security of those devices. It's even more delusional to pretend this was ever production-ready or that Wayland needs to be ready for anything here. The X11 implementation just shouldn't have been shipped at all.

superkuh 3y ago
You keep saying X11 is insecure but I've never had a problem with that in the last 20 years. I've never known anyone with an X11 security problem in the last 20 years. I've never heard of anyone having an X11 security problem in the last 20 years. Perhaps you can point me to an incident? The idea that it's "insecure" to let applications on your computer access the inputs of other programs comes from smartphone space where you don't actually control your computer or the software on it and that becomes a problem. But for actual computers you control it just isn't (a problem). Wayland for "security" is cargo culting smartphone user problems. It's not actually a real issue. I use the keyboard/mouse sharing in X11 (via synergy) and I have for 20 years. It is vitally important to my workflow. It works on dozens of different OSes including linux. But not the waylands linuxes. Any graphical environment that can't do this is useless to me. Might as well not even release the waylands at all (see how silly applying my personal preferences globally seems?).
- play_ac 3y ago
  >I've never heard of anyone having an X11 security problem in the last 20 years. Here's 6 CVEs just from last month. Check the mailing lists and you'll see many of these going back for years and years. https://lists.x.org/archives/xorg/2023-October/061506.html https://lists.x.org/archives/xorg/2023-October/061506.html https://lists.x.org/archives/xorg/2023-October/061514.html https://lists.x.org/archives/xorg/2023-October/061514.html And before you say this is not what you meant, the X server and X client libraries do very little anymore besides parsing untrusted input and passing it somewhere else. That's its main purpose and it's completely bad at it. And because it's X, this input can also come from over the network too so every normal memory bug can also be an RCE. This is probably the single biggest attack vector on a desktop system aside from the toolkit. It's the exact wrong thing for anyone to grant access to every input on the system. This is not just my personal opinion or me giving anecdotes either, this is paraphrasing what I've heard X developers say after many years of patching these bugs. But that's not even the whole problem as I'll explain shortly. >But for actual computers you control it just isn't (a problem). Wayland for "security" is cargo culting smartphone user problems. It's not actually a real issue. Yes it is a problem and no it's not cargo culting. Practically speaking the X11 security model means every X client gets access to everything including all your passwords (and the root password) as you type them, and subsequently lets every X client spawn arbitrary root processes and get access to your whole filesystem including your private keys and insert kernel modules or do whatever. If you actually think this "isn't a real issue" then you should just stop using passwords, stop protecting your private keys, run every program as root, and disable memory protection: because that's what this actually means in practice. No I'm not exaggerating. The security model of X11 has no idea about client boundaries at all. This is completely unacceptable on any other OS but for some reason it's become a meme to say that only smartphones need to care about this. Really? Come on. >I use the keyboard/mouse sharing in X11 (via synergy) and I have for 20 years. It is vitally important to my workflow. It works on dozens of different OSes including linux. But not the waylands linuxes. Any graphical environment that can't do this is useless to me. X11 can't do it securely so I would say that's as useless as not implementing the feature, if you have to compromise your security in order to get it. The feature will be implemented in Wayland eventually when the design for a secure API is finished. There are people working on it now. In comparison, X11 is probably never going to gain a secure way to do that.