5 ms·

What drives me up the wall is the number of apps they broke in the name of 'security' when the threat is not something most users will ever face. Even if they

What drives me up the wall is the number of apps they broke in the name of 'security' when the threat is not something most users will ever face. Even if they wanted to do that, they should have had a popup display asking the user for permission, and not simply breaking it. Also, say what you will about Xorg, but it's very much 'batteries included', the idea of wayland foisting so much of what used to be X's responsibilities off to the wm just reeks of 'ivory tower'ness.

coppsilgold 3y ago
The problem is that with a shared X11, sandboxing is pointless. Any application with access to the X11 socket has easy privilege escalation available to it. By for example, injecting into a sudo enabled terminal or keylogging the user. Admittedly, with Wayland the security situation wasn't ideal until recently with the adoption of security contexts that can finally allow you to deny screen capture access among other Wayland protocols to sandboxed applications[1]. [1] <https://git.sr.ht/~whynothugo/way-secure https://git.sr.ht/~whynothugo/way-secure>
- nolist_policy 3y ago
  AFAIK Wayland does not provide screen capture though. It is provided outside of it via xdg-desktop-portal[1]. [1] https://flatpak.github.io/xdg-desktop-portal/docs/portal-interfaces.html https://flatpak.github.io/xdg-desktop-portal/docs/portal-int...
  - coppsilgold 3y ago
    wlroots-based compositors had screen capture for a long time. I'm not sure about Gnome. <https://wayland.app/protocols/wlr-screencopy-unstable-v1 https://wayland.app/protocols/wlr-screencopy-unstable-v1> <https://sr.ht/~emersion/grim/ https://sr.ht/~emersion/grim/> <https://github.com/ammen99/wf-recorder https://github.com/ammen99/wf-recorder>
- denton-scratch 3y ago
  So like nearly every other X11 user, my X11 server is not exposed to the network at all. Not the internet, and not my LAN. It's the default; you have to do work to make it insecure. I don't hot-desk, and I use SSH to talk to the machines on my network that don't need a GUI. Wayland solves a problem that I've never had. I don't believe I'm an outlier. I believe most Linux users are like me: they are conscious of security issues, and they don't need a nanny to look after them. I don't think that the majority of Linux users are hot-desking corporate users, with multiple user sessions on the same machine, or trying to run a GUI over a network connection. Those are eccentric use-cases. Red Hat/Gnome are trying to make a version of Linux that can be used by a child. I think that's a fine objective; but it's not even on the horizon. An operating system that just gets out of your way would be lovely, but for now it's a dream (and Windows isn't that system, of course; I think managing a Linux system is miles easier than trying to manage Windows). As far as Gnome is concerned, it's experienced at least two violent changes of direction in its history. One of the things you need from a child-friendly OS is no violent changes of direction. If a GUI in particular changes dramatically from one version to the next, that's a big fail.
  - nolist_policy 3y ago
    And then a website triggers an exploit in your firefox process and gains remote code execution. Okay, firefox uses sandboxing so even with code execution the attacker won't gain much. Except that sandboxed process has a unix-socket connection open to a certain other process...
    - denton-scratch 3y ago
      Yeah, I get it. You make a good point. A website might target a Linux desktop user in the way you describe, and that is a serious weakness in X11. But this is a rather exotic scenario: the attacker uses an exploit that works on the Linux version of a browser, and uses that to attack some other application running under X11. That's a complicated chain of dependencies; it might be worth it if I was operating a bank of Uranium centrifuges, but not just to violate my privacy (e.g. steal passwords from my password manager). I think Wayland is a fine project, and when it's mature I'll jump. I'd prefer a local-only GUI. But I don't think it's mature yet. And the way it's pushed reminds me of Poetteringware; I need to be sure I'm not being shafted.
- wing-_-nuts 3y ago
  > The problem is that with a shared X11, sandboxing is pointless. You're not hearing me. For most desktop users, there was never a need to sandbox applications. It's simply not a threat vector 99% of desktop linux users have ever dealt with. It's certainly not a big enough problem to break the screen / input recording and sharing of tons of applications. Again, if you need to do that, the correct way is to PROMPT the user, not invisibly disable it entirely.
  - acdha 3y ago
    You’re saying Linux users never make mistakes like clicking on the wrong link or opening the wrong attachment? Unless that’s true, yes, we need sandboxing.
    - deleted 3y ago
      [deleted]
    - Dylan16807 3y ago
      Sandboxing would be nice, but very little gets sandboxed right now, so it's hard to classify it as a real need. And the sandboxes that do get used aren't very vulnerable to X11 attacks. If you're running firefox the web process sandbox doesn't have X11 access, and by the time the rendering process gets chain-exploited it can access your files directly without needing to go through X11.
      - acdha 3y ago
        Arguing that we shouldn’t deploy sandboxing because it’s not widely used seems counterproductive, and a recipe for not catching up with macOS or even Windows. Even if Firefox is perfect, that still leaves everything else which connects to the outside world or opens downloaded files. We know there’s a long history of those exploits and everyone serious in the desktop OS space has been trying to harden things so it’s not a single mistake away from an irrecoverable compromise.
        Dylan16807 3y ago
- tedunangst 3y ago
  The X11 Security extension is nearly 30 years old at this point, but Wayland users still haven't heard of it. One wonders what else they're missing out on.
  - nolist_policy 3y ago
    Yes and then HN'lers will shame any distro enabling it by default to death.
  - yjftsjthsd-h 3y ago
    I've wondered about this for a while - why didn't XACE get wide adoption?
    - tedunangst 3y ago
      Because nobody actually cares about keyloggers. They just like how it feels to say "Wayland is secure". Anybody who cared about key loggers or screen scrapers or any of that solved their problem two decades ago.
    - arp242 3y ago
      From what I can find XACE doesn't actually work all that well. e.g. [1] mentions "X Applications expect full access to X server and die when denied any access". It's rather vague and kind of hard to find more detailed information. I also agree with the sibling comment from tedunangst that most people just don't worry all that much about keyloggers, nor should they IMHO because it's not really a common attack vector. [1]: https://fedorapeople.org/~dwalsh/SELinux/Presentations/sandbox.pdf https://fedorapeople.org/~dwalsh/SELinux/Presentations/sandb...
ho_schi 3y ago
Popup asking? Sounds exactly like what Flatpak/Portals are doing. Batteries included? That is the reason why X11 is/was shipped alongside Wayland for some time. It will be dropped and XWayland remains for compatibility reasons. And Wayland has already some batteries X11 doesn’t, better scaling support. Security through Portals/Flatpak. We’re in 2023, screensharing works for some time now ;) We don’t get stuck in legacy hell like Windows. And we don’t cut off compatibility like Apple. Bumpy ride but prospects are good. Next thing? A new virtual console for userspace? Something like KMSCON? https://en.wikipedia.org/wiki/Kmscon https://en.wikipedia.org/wiki/Kmscon I don’t want delete the good old thing. I want see them alive and improving :). Without the usual “it must become worse before it becomes better”.
- wing-_-nuts 3y ago
  IIRC any time I've used a flatpak app, it's downloaded tons of dependencies along with it because everything is sandboxed. I know disk space is cheap but it's kind of silly to me that the flatpak version of an app is 500mb while the deb version is ~ 5mb.
  - tristan957 3y ago
    That 500MB almost entirely the runtime, which is shared across apps.
    - ho_schi 3y ago
      Yep. It settles down as soon as you have more Flatpaks installed. But yes. Flatpaks require more memory and disk space and fixes in private libraries are not fixed by a friendly package maintainer for all packages. I use native packages from Arch for most stuff and for new hot or weird stuff Flatpak. Especially for Closed-Source weird stuff. I prefer most - if not all - handle by native packages because that is a core feature of Linux. But there will be always others for reasons. For example plugins, Vim relies here mostly on Vimplug. Steam is thing I need to accept but itself a candidate for Flatpak (currently I prefer the native package). And to be precisely, Meson is also a package-manager for C/C++ developers. PS: I also use Flatpaks when otherwise many unusual dependencies are involved. That one application using Qt? Flatpak. And vice versa some applications which doing well move from Flatpak to native package (Marker did that). PPS: GNOME-Software does a good job in handling native packages, Flatpak and LVFS at the same time. I use mostly pacman, flatpak and fwupd. But sometimes I need the captains approach “Linux. Make it so.”.

coppsilgold 3y ago

The problem is that with a shared X11, sandboxing is pointless. Any application with access to the X11 socket has easy privilege escalation available to it. By for example, injecting into a sudo enabled terminal or keylogging the user. Admittedly, with Wayland the security situation wasn't ideal until recently with the adoption of security contexts that can finally allow you to deny screen capture access among other Wayland protocols to sandboxed applications[1]. [1] <https://git.sr.ht/~whynothugo/way-secure https://git.sr.ht/~whynothugo/way-secure>

nolist_policy 3y ago
AFAIK Wayland does not provide screen capture though. It is provided outside of it via xdg-desktop-portal[1]. [1] https://flatpak.github.io/xdg-desktop-portal/docs/portal-interfaces.html https://flatpak.github.io/xdg-desktop-portal/docs/portal-int...
- coppsilgold 3y ago
  wlroots-based compositors had screen capture for a long time. I'm not sure about Gnome. <https://wayland.app/protocols/wlr-screencopy-unstable-v1 https://wayland.app/protocols/wlr-screencopy-unstable-v1> <https://sr.ht/~emersion/grim/ https://sr.ht/~emersion/grim/> <https://github.com/ammen99/wf-recorder https://github.com/ammen99/wf-recorder>
denton-scratch 3y ago
So like nearly every other X11 user, my X11 server is not exposed to the network at all. Not the internet, and not my LAN. It's the default; you have to do work to make it insecure. I don't hot-desk, and I use SSH to talk to the machines on my network that don't need a GUI. Wayland solves a problem that I've never had. I don't believe I'm an outlier. I believe most Linux users are like me: they are conscious of security issues, and they don't need a nanny to look after them. I don't think that the majority of Linux users are hot-desking corporate users, with multiple user sessions on the same machine, or trying to run a GUI over a network connection. Those are eccentric use-cases. Red Hat/Gnome are trying to make a version of Linux that can be used by a child. I think that's a fine objective; but it's not even on the horizon. An operating system that just gets out of your way would be lovely, but for now it's a dream (and Windows isn't that system, of course; I think managing a Linux system is miles easier than trying to manage Windows). As far as Gnome is concerned, it's experienced at least two violent changes of direction in its history. One of the things you need from a child-friendly OS is no violent changes of direction. If a GUI in particular changes dramatically from one version to the next, that's a big fail.
- nolist_policy 3y ago
  And then a website triggers an exploit in your firefox process and gains remote code execution. Okay, firefox uses sandboxing so even with code execution the attacker won't gain much. Except that sandboxed process has a unix-socket connection open to a certain other process...
  - denton-scratch 3y ago
    Yeah, I get it. You make a good point. A website might target a Linux desktop user in the way you describe, and that is a serious weakness in X11. But this is a rather exotic scenario: the attacker uses an exploit that works on the Linux version of a browser, and uses that to attack some other application running under X11. That's a complicated chain of dependencies; it might be worth it if I was operating a bank of Uranium centrifuges, but not just to violate my privacy (e.g. steal passwords from my password manager). I think Wayland is a fine project, and when it's mature I'll jump. I'd prefer a local-only GUI. But I don't think it's mature yet. And the way it's pushed reminds me of Poetteringware; I need to be sure I'm not being shafted.
wing-_-nuts 3y ago
> The problem is that with a shared X11, sandboxing is pointless. You're not hearing me. For most desktop users, there was never a need to sandbox applications. It's simply not a threat vector 99% of desktop linux users have ever dealt with. It's certainly not a big enough problem to break the screen / input recording and sharing of tons of applications. Again, if you need to do that, the correct way is to PROMPT the user, not invisibly disable it entirely.
- acdha 3y ago
  You’re saying Linux users never make mistakes like clicking on the wrong link or opening the wrong attachment? Unless that’s true, yes, we need sandboxing.
  - deleted 3y ago
    [deleted]
  - Dylan16807 3y ago
    Sandboxing would be nice, but very little gets sandboxed right now, so it's hard to classify it as a real need. And the sandboxes that do get used aren't very vulnerable to X11 attacks. If you're running firefox the web process sandbox doesn't have X11 access, and by the time the rendering process gets chain-exploited it can access your files directly without needing to go through X11.
    - acdha 3y ago
      Arguing that we shouldn’t deploy sandboxing because it’s not widely used seems counterproductive, and a recipe for not catching up with macOS or even Windows. Even if Firefox is perfect, that still leaves everything else which connects to the outside world or opens downloaded files. We know there’s a long history of those exploits and everyone serious in the desktop OS space has been trying to harden things so it’s not a single mistake away from an irrecoverable compromise.
      - Dylan16807 3y ago
tedunangst 3y ago
The X11 Security extension is nearly 30 years old at this point, but Wayland users still haven't heard of it. One wonders what else they're missing out on.
- nolist_policy 3y ago
  Yes and then HN'lers will shame any distro enabling it by default to death.
- yjftsjthsd-h 3y ago
  I've wondered about this for a while - why didn't XACE get wide adoption?
  - tedunangst 3y ago
    Because nobody actually cares about keyloggers. They just like how it feels to say "Wayland is secure". Anybody who cared about key loggers or screen scrapers or any of that solved their problem two decades ago.
  - arp242 3y ago
    From what I can find XACE doesn't actually work all that well. e.g. [1] mentions "X Applications expect full access to X server and die when denied any access". It's rather vague and kind of hard to find more detailed information. I also agree with the sibling comment from tedunangst that most people just don't worry all that much about keyloggers, nor should they IMHO because it's not really a common attack vector. [1]: https://fedorapeople.org/~dwalsh/SELinux/Presentations/sandbox.pdf https://fedorapeople.org/~dwalsh/SELinux/Presentations/sandb...

ho_schi 3y ago

Popup asking? Sounds exactly like what Flatpak/Portals are doing. Batteries included? That is the reason why X11 is/was shipped alongside Wayland for some time. It will be dropped and XWayland remains for compatibility reasons. And Wayland has already some batteries X11 doesn’t, better scaling support. Security through Portals/Flatpak. We’re in 2023, screensharing works for some time now ;) We don’t get stuck in legacy hell like Windows. And we don’t cut off compatibility like Apple. Bumpy ride but prospects are good. Next thing? A new virtual console for userspace? Something like KMSCON? https://en.wikipedia.org/wiki/Kmscon https://en.wikipedia.org/wiki/Kmscon I don’t want delete the good old thing. I want see them alive and improving :). Without the usual “it must become worse before it becomes better”.

wing-_-nuts 3y ago
IIRC any time I've used a flatpak app, it's downloaded tons of dependencies along with it because everything is sandboxed. I know disk space is cheap but it's kind of silly to me that the flatpak version of an app is 500mb while the deb version is ~ 5mb.
- tristan957 3y ago
  That 500MB almost entirely the runtime, which is shared across apps.
  - ho_schi 3y ago
    Yep. It settles down as soon as you have more Flatpaks installed. But yes. Flatpaks require more memory and disk space and fixes in private libraries are not fixed by a friendly package maintainer for all packages. I use native packages from Arch for most stuff and for new hot or weird stuff Flatpak. Especially for Closed-Source weird stuff. I prefer most - if not all - handle by native packages because that is a core feature of Linux. But there will be always others for reasons. For example plugins, Vim relies here mostly on Vimplug. Steam is thing I need to accept but itself a candidate for Flatpak (currently I prefer the native package). And to be precisely, Meson is also a package-manager for C/C++ developers. PS: I also use Flatpaks when otherwise many unusual dependencies are involved. That one application using Qt? Flatpak. And vice versa some applications which doing well move from Flatpak to native package (Marker did that). PPS: GNOME-Software does a good job in handling native packages, Flatpak and LVFS at the same time. I use mostly pacman, flatpak and fwupd. But sometimes I need the captains approach “Linux. Make it so.”.