4 ms·

To be fair they just make applications go through an API now, known as a desktop portal. This is done to allow the user to control which applications can captur

by tapoxi 3y ago

To be fair they just make applications go through an API now, known as a desktop portal. This is done to allow the user to control which applications can capture or control their screen or input, like Windows and MacOS. https://wiki.archlinux.org/title/XDG_Desktop_Portal https://wiki.archlinux.org/title/XDG_Desktop_Portal Allowing any application to do that without the user knowing, the X11 model, is a recipe for disaster. With the right exploit chain you could theoretically deploy a keylogger from a website. Now sure, Wayland didn't have all of this from the start, but it wasn't the default for most distros until all of these things were in place. You opted to use Wayland before it was ready for general consumption.

wing-_-nuts 3y ago
>Allowing any application to do that without the user knowing, the X11 model, is a recipe for disaster. I don't know a single person that has ever fallen victim to a virus or malware on linux, and I've been using it almost exclusively for the past 20 years. If it was a threat vector, it clearly wasn't a very big issue. If they wanted to not break existing apps, simply intercept attempts to share screens or inputs, and pop up a dialog box asking the user for consent? That would have been fine. That should have been a part of their default implementation. What they actually wound up doing was infinitely more user hostile. I tried using it summer of '22. The wayland hype train was well underway and major linux distributions were already pushing it. I'd be much more forgiving if the wayland devs said 'hey guys, we're working on a new display server but it's very experimental and no one should use it unless they want to help us work out the kinks'. Instead, it was 'this is the future, x11 is abandonware'
- okasaki 3y ago
  > I don't know a single person that has ever fallen victim to a virus or malware on linux, and I've been using it almost exclusively for the past 20 years. If it was a threat vector, it clearly wasn't a very big issue. Yes, well, the ground is being prepared to turn desktop Linux into a Android/Windows like app system (/ wasteland) where users mostly download third party proprietary apps and devs push updates directly to users with minimal oversight. In this brave new world, you will definitely appreciate app isolation.
- bonzini 3y ago
  > I don't know a single person that has ever fallen victim to a virus or malware on linux, and I've been using it almost exclusively for the past 20 years. If it was a threat vector, it clearly wasn't a very big issue. Do you think the same would have applied to Android, had it used X11 instead of SurfaceFlinger (which in turn isn't very different from Wayland)? Even if no virus cares about the Linux desktop, that doesn't mean that security issues should be ignored.
- vetinari 3y ago
  > If it was a threat vector, it clearly wasn't a very big issue. By the same token, patching the apps to use the new API is not a very big issue either. Or is it? Why? If you have the sources, neither is a problem. If you do not have sources, both are problem. A matter of fact is, that users are going to use apps that they do not have sources for, and can neither audit, nor update the apps. > If they wanted to not break existing apps, simply intercept attempts to share screens or inputs, and pop up a dialog box asking the user for consent? Because there was no API before; there were hacks. Some of them worked only due to circumstances of how the given functionality was implemented, but spec-wise, it wasn't guaranteed at all. Now there are APIs. Just like there is a virtual memory or filesystem permissions. These weren't given years ago either. They also "broke" apps. > major linux distributions were already pushing it. RHEL8 is Wayland-default on non-Nvidia GPUs. Old relase of a freaking RHEL, which itself moves as molases. > I'd be much more forgiving if the wayland devs said 'hey guys, we're working on a new display server but it's very experimental and no one should use it unless they want to help us work out the kinks'. You missed that phase by some 10 years or so. > Instead, it was 'this is the future, x11 is abandonware' That's how it is. If linux wants to stay relevant and not became another Amiga, that's how it is going to be.
- orangeboats 3y ago
  >I don't know a single person that has ever fallen victim to a virus or malware on linux, and I've been using it almost exclusively for the past 20 years. If it was a threat vector, it clearly wasn't a very big issue. So: no true Linux user succumbs to malware and no true Scotsman puts sugar on his porridge. Putting that aside, it doesn't take much effort to find an example of X11 keylogger that requires zero superuser privilege and zero explicit permission granting by the user. Here, the first result from DDGing "x11 keylogger": https://github.com/anko/xkbcat https://github.com/anko/xkbcat It is hard to believe this has not occurred in the wild. If such attack really hasn't occurred before in the Linux world, I would rather use the unpopularity of Linux desktop as my justification.
franga2000 3y ago
xdg-desktop-portal is a workaround for the chaos Wayland caused. It puts the implementation burden on all of the individual "compositors" (read desktop environments) individually, resulting in many times the work, many incomplete and many incompatible implementations. The Wayland devs hyped their project up like it's going to be the thing to replace X11, but ended up delivering barely 10% of what X11 is. One of the beautiful things about Linux was that you had thing huge variety of desktop environments and the reason for it was that X11 gave you all the infrastructure, you only had to do the user-facing parts. Now, a DE needs to implement all of X11 and then some to be feature-complete. And no, I'm not accidentally mixing up DEs and compositors - the reality is that we don't have a good "base compositor" that DEs could build on top of. The big players built their own compositors and the small players either died or used wlroots, which again doesn't implement most of the essential things (and the ones it does are incompatible with KDE and GNOME).
- orangeboats 3y ago
  >One of the beautiful things about Linux was that you had thing huge variety of desktop environments and the reason for it was that X11 gave you all the infrastructure, you only had to do the user-facing parts. Why do people like to emphasize this point so much? You still get shared infrastructure in the Wayland ecosystem by utilizing libraries such as wlroots or Smithay. In fact, GNOME and KDE are practically the _outliers_ of the ecosystem as they do their own thing, but other compositors such as Hyprland or Sway do share the same core. If you want even higher level of abstraction so that you can make your own window manager in one hundred lines of code, you can opt to write a Wayfire plugin. It's as close to having a "base compositor" as possible.
  - franga2000 3y ago
    GNOME and KDE definitely are the outliers, but they are the biggest players and they didn't do this out of sheer evil or whatever. They did this because when everyone was pushing for Wayland adoption, wlroots didn't exist or wasn't usable. And when it came out, everyone called it a "reference implementation" and it was expected of DEs to implement their own compositors. And the main problem wasn't even that DEs didn't have a shared codebase for compositors, it was that there weren't any standards for critical features of any modern system. It was all "up to the compositors", meaning it wasn't just a matter of implementing some APIs, they had to be designed first. We now have different protocol extensions for KDE and wlroots alongside external DBus-based APIs for GNOME that have now also been partially implemented by KDE, yet there are still basic X11 features that can't be done on all of these compositors.

by tapoxi 3y ago

wing-_-nuts 3y ago

>Allowing any application to do that without the user knowing, the X11 model, is a recipe for disaster. I don't know a single person that has ever fallen victim to a virus or malware on linux, and I've been using it almost exclusively for the past 20 years. If it was a threat vector, it clearly wasn't a very big issue. If they wanted to not break existing apps, simply intercept attempts to share screens or inputs, and pop up a dialog box asking the user for consent? That would have been fine. That should have been a part of their default implementation. What they actually wound up doing was infinitely more user hostile. I tried using it summer of '22. The wayland hype train was well underway and major linux distributions were already pushing it. I'd be much more forgiving if the wayland devs said 'hey guys, we're working on a new display server but it's very experimental and no one should use it unless they want to help us work out the kinks'. Instead, it was 'this is the future, x11 is abandonware'

okasaki 3y ago
> I don't know a single person that has ever fallen victim to a virus or malware on linux, and I've been using it almost exclusively for the past 20 years. If it was a threat vector, it clearly wasn't a very big issue. Yes, well, the ground is being prepared to turn desktop Linux into a Android/Windows like app system (/ wasteland) where users mostly download third party proprietary apps and devs push updates directly to users with minimal oversight. In this brave new world, you will definitely appreciate app isolation.
bonzini 3y ago
> I don't know a single person that has ever fallen victim to a virus or malware on linux, and I've been using it almost exclusively for the past 20 years. If it was a threat vector, it clearly wasn't a very big issue. Do you think the same would have applied to Android, had it used X11 instead of SurfaceFlinger (which in turn isn't very different from Wayland)? Even if no virus cares about the Linux desktop, that doesn't mean that security issues should be ignored.
vetinari 3y ago
> If it was a threat vector, it clearly wasn't a very big issue. By the same token, patching the apps to use the new API is not a very big issue either. Or is it? Why? If you have the sources, neither is a problem. If you do not have sources, both are problem. A matter of fact is, that users are going to use apps that they do not have sources for, and can neither audit, nor update the apps. > If they wanted to not break existing apps, simply intercept attempts to share screens or inputs, and pop up a dialog box asking the user for consent? Because there was no API before; there were hacks. Some of them worked only due to circumstances of how the given functionality was implemented, but spec-wise, it wasn't guaranteed at all. Now there are APIs. Just like there is a virtual memory or filesystem permissions. These weren't given years ago either. They also "broke" apps. > major linux distributions were already pushing it. RHEL8 is Wayland-default on non-Nvidia GPUs. Old relase of a freaking RHEL, which itself moves as molases. > I'd be much more forgiving if the wayland devs said 'hey guys, we're working on a new display server but it's very experimental and no one should use it unless they want to help us work out the kinks'. You missed that phase by some 10 years or so. > Instead, it was 'this is the future, x11 is abandonware' That's how it is. If linux wants to stay relevant and not became another Amiga, that's how it is going to be.
orangeboats 3y ago
>I don't know a single person that has ever fallen victim to a virus or malware on linux, and I've been using it almost exclusively for the past 20 years. If it was a threat vector, it clearly wasn't a very big issue. So: no true Linux user succumbs to malware and no true Scotsman puts sugar on his porridge. Putting that aside, it doesn't take much effort to find an example of X11 keylogger that requires zero superuser privilege and zero explicit permission granting by the user. Here, the first result from DDGing "x11 keylogger": https://github.com/anko/xkbcat https://github.com/anko/xkbcat It is hard to believe this has not occurred in the wild. If such attack really hasn't occurred before in the Linux world, I would rather use the unpopularity of Linux desktop as my justification.

franga2000 3y ago

xdg-desktop-portal is a workaround for the chaos Wayland caused. It puts the implementation burden on all of the individual "compositors" (read desktop environments) individually, resulting in many times the work, many incomplete and many incompatible implementations. The Wayland devs hyped their project up like it's going to be the thing to replace X11, but ended up delivering barely 10% of what X11 is. One of the beautiful things about Linux was that you had thing huge variety of desktop environments and the reason for it was that X11 gave you all the infrastructure, you only had to do the user-facing parts. Now, a DE needs to implement all of X11 and then some to be feature-complete. And no, I'm not accidentally mixing up DEs and compositors - the reality is that we don't have a good "base compositor" that DEs could build on top of. The big players built their own compositors and the small players either died or used wlroots, which again doesn't implement most of the essential things (and the ones it does are incompatible with KDE and GNOME).

orangeboats 3y ago
>One of the beautiful things about Linux was that you had thing huge variety of desktop environments and the reason for it was that X11 gave you all the infrastructure, you only had to do the user-facing parts. Why do people like to emphasize this point so much? You still get shared infrastructure in the Wayland ecosystem by utilizing libraries such as wlroots or Smithay. In fact, GNOME and KDE are practically the _outliers_ of the ecosystem as they do their own thing, but other compositors such as Hyprland or Sway do share the same core. If you want even higher level of abstraction so that you can make your own window manager in one hundred lines of code, you can opt to write a Wayfire plugin. It's as close to having a "base compositor" as possible.
- franga2000 3y ago
  GNOME and KDE definitely are the outliers, but they are the biggest players and they didn't do this out of sheer evil or whatever. They did this because when everyone was pushing for Wayland adoption, wlroots didn't exist or wasn't usable. And when it came out, everyone called it a "reference implementation" and it was expected of DEs to implement their own compositors. And the main problem wasn't even that DEs didn't have a shared codebase for compositors, it was that there weren't any standards for critical features of any modern system. It was all "up to the compositors", meaning it wasn't just a matter of implementing some APIs, they had to be designed first. We now have different protocol extensions for KDE and wlroots alongside external DBus-based APIs for GNOME that have now also been partially implemented by KDE, yet there are still basic X11 features that can't be done on all of these compositors.