3 ms·

So like nearly every other X11 user, my X11 server is not exposed to the network at all. Not the internet, and not my LAN. It's the default; you have to do work

So like nearly every other X11 user, my X11 server is not exposed to the network at all. Not the internet, and not my LAN. It's the default; you have to do work to make it insecure. I don't hot-desk, and I use SSH to talk to the machines on my network that don't need a GUI. Wayland solves a problem that I've never had. I don't believe I'm an outlier. I believe most Linux users are like me: they are conscious of security issues, and they don't need a nanny to look after them. I don't think that the majority of Linux users are hot-desking corporate users, with multiple user sessions on the same machine, or trying to run a GUI over a network connection. Those are eccentric use-cases. Red Hat/Gnome are trying to make a version of Linux that can be used by a child. I think that's a fine objective; but it's not even on the horizon. An operating system that just gets out of your way would be lovely, but for now it's a dream (and Windows isn't that system, of course; I think managing a Linux system is miles easier than trying to manage Windows). As far as Gnome is concerned, it's experienced at least two violent changes of direction in its history. One of the things you need from a child-friendly OS is no violent changes of direction. If a GUI in particular changes dramatically from one version to the next, that's a big fail.

nolist_policy 3y ago
And then a website triggers an exploit in your firefox process and gains remote code execution. Okay, firefox uses sandboxing so even with code execution the attacker won't gain much. Except that sandboxed process has a unix-socket connection open to a certain other process...
- denton-scratch 3y ago
  Yeah, I get it. You make a good point. A website might target a Linux desktop user in the way you describe, and that is a serious weakness in X11. But this is a rather exotic scenario: the attacker uses an exploit that works on the Linux version of a browser, and uses that to attack some other application running under X11. That's a complicated chain of dependencies; it might be worth it if I was operating a bank of Uranium centrifuges, but not just to violate my privacy (e.g. steal passwords from my password manager). I think Wayland is a fine project, and when it's mature I'll jump. I'd prefer a local-only GUI. But I don't think it's mature yet. And the way it's pushed reminds me of Poetteringware; I need to be sure I'm not being shafted.
coldpie 3y ago
> So like nearly every other X11 user, my X11 server is not exposed to the network at all. Are you misunderstanding what the OP meant by "socket"? It doesn't have to literally be a network socket, but your X11 apps all connect to the server via some IPC mechanism, could be a network socket or a local named pipe (I think it lives out in /var/, but I'm not on a Linux system atm). Their point was there is no client authentication or separation via this IPC mechanism: one X11 application can send messages directly to another X11 application. That's where their example of a malicious app inserting text into a sudo terminal comes from. You can see this for yourself using a virtual keyboard program. It's just an X11 app like any other, it's just injecting messages for the server to dispatch to another client. > I believe most Linux users are like me: they are conscious of security issues, and they don't need a nanny to look after them. I feel under this argument, you can also describe memory segmentation as a "nanny" =/ I don't think many would argue we should go back to shared memory systems.
- denton-scratch 3y ago
  > one X11 application can send messages directly to another X11 application. Sure. I get that. But I don't run malicious applications on X; and I don't pipe the output of curl into bash. > I don't think many would argue we should go back to shared memory systems. Me neither. But from my perspective, memory segmentation is necessary to protect me against incompetent programmers, not malicious applications. Breaking X11 security isn't something that happens by accident, it requires actual malice.
  - soerxpso 3y ago
    > But I don't run malicious applications on X The thing about malicious applications is that they usually don't do a lot to inform the user that they are a malicious application. "I don't run malicious applications" is a claim shared by nearly everyone who's ever run a malicious application.
    - denton-scratch 3y ago
      I've never been mugged, probably because I don't hang out around shady characters at night. Back in the 80s, I got viruses and trojans, because (a) I was promiscuous with floppy disks, and (b) I worked with students. And I installed software from shady places that came with unwanted stuff like browser toolbars. Nowadays, I use Linux, and I find I can rely on the distro's package repository. So I only install software from the repository; if I need to try something that isn't packaged by the distro, I proceed with extreme caution. I'm sure it's different if you're running a corporate Linux desktop fleet; but this is a home network, with one laptop that runs any GUI at all. The laptop exposes no network ports. In fact the entire home network exposes no internet ports. I think Red Hat would be fine, if they'd stick to serving corporate requirements. I just wish they'd stop shoving stuff down the throats of non-corporate users. I'm particularly annoyed by systemd; Poettering is a specialist in throat-shoving. Unfortunately, I don't seem to be able to get Bluetooth Audio to work on Linux without pulseaudio. I have a pair of nice Bose cans that I can't use, because I don't want to run pulse. I need a bluetooth audio stack that depends only on ALSA. (I think it's possible, but every time I try I run into a brick wall, and I've got tired)

nolist_policy 3y ago

And then a website triggers an exploit in your firefox process and gains remote code execution. Okay, firefox uses sandboxing so even with code execution the attacker won't gain much. Except that sandboxed process has a unix-socket connection open to a certain other process...

denton-scratch 3y ago
Yeah, I get it. You make a good point. A website might target a Linux desktop user in the way you describe, and that is a serious weakness in X11. But this is a rather exotic scenario: the attacker uses an exploit that works on the Linux version of a browser, and uses that to attack some other application running under X11. That's a complicated chain of dependencies; it might be worth it if I was operating a bank of Uranium centrifuges, but not just to violate my privacy (e.g. steal passwords from my password manager). I think Wayland is a fine project, and when it's mature I'll jump. I'd prefer a local-only GUI. But I don't think it's mature yet. And the way it's pushed reminds me of Poetteringware; I need to be sure I'm not being shafted.

coldpie 3y ago

> So like nearly every other X11 user, my X11 server is not exposed to the network at all. Are you misunderstanding what the OP meant by "socket"? It doesn't have to literally be a network socket, but your X11 apps all connect to the server via some IPC mechanism, could be a network socket or a local named pipe (I think it lives out in /var/, but I'm not on a Linux system atm). Their point was there is no client authentication or separation via this IPC mechanism: one X11 application can send messages directly to another X11 application. That's where their example of a malicious app inserting text into a sudo terminal comes from. You can see this for yourself using a virtual keyboard program. It's just an X11 app like any other, it's just injecting messages for the server to dispatch to another client. > I believe most Linux users are like me: they are conscious of security issues, and they don't need a nanny to look after them. I feel under this argument, you can also describe memory segmentation as a "nanny" =/ I don't think many would argue we should go back to shared memory systems.

denton-scratch 3y ago
> one X11 application can send messages directly to another X11 application. Sure. I get that. But I don't run malicious applications on X; and I don't pipe the output of curl into bash. > I don't think many would argue we should go back to shared memory systems. Me neither. But from my perspective, memory segmentation is necessary to protect me against incompetent programmers, not malicious applications. Breaking X11 security isn't something that happens by accident, it requires actual malice.
- soerxpso 3y ago
  > But I don't run malicious applications on X The thing about malicious applications is that they usually don't do a lot to inform the user that they are a malicious application. "I don't run malicious applications" is a claim shared by nearly everyone who's ever run a malicious application.
  - denton-scratch 3y ago
    I've never been mugged, probably because I don't hang out around shady characters at night. Back in the 80s, I got viruses and trojans, because (a) I was promiscuous with floppy disks, and (b) I worked with students. And I installed software from shady places that came with unwanted stuff like browser toolbars. Nowadays, I use Linux, and I find I can rely on the distro's package repository. So I only install software from the repository; if I need to try something that isn't packaged by the distro, I proceed with extreme caution. I'm sure it's different if you're running a corporate Linux desktop fleet; but this is a home network, with one laptop that runs any GUI at all. The laptop exposes no network ports. In fact the entire home network exposes no internet ports. I think Red Hat would be fine, if they'd stick to serving corporate requirements. I just wish they'd stop shoving stuff down the throats of non-corporate users. I'm particularly annoyed by systemd; Poettering is a specialist in throat-shoving. Unfortunately, I don't seem to be able to get Bluetooth Audio to work on Linux without pulseaudio. I have a pair of nice Bose cans that I can't use, because I don't want to run pulse. I need a bluetooth audio stack that depends only on ALSA. (I think it's possible, but every time I try I run into a brick wall, and I've got tired)