2 ms·

> The problem is that with a shared X11, sandboxing is pointless. You're not hearing me. For most desktop users, there was never a need to sandbox application

> The problem is that with a shared X11, sandboxing is pointless. You're not hearing me. For most desktop users, there was never a need to sandbox applications. It's simply not a threat vector 99% of desktop linux users have ever dealt with. It's certainly not a big enough problem to break the screen / input recording and sharing of tons of applications. Again, if you need to do that, the correct way is to PROMPT the user, not invisibly disable it entirely.

acdha 3y ago
You’re saying Linux users never make mistakes like clicking on the wrong link or opening the wrong attachment? Unless that’s true, yes, we need sandboxing.
- deleted 3y ago
  [deleted]
- Dylan16807 3y ago
  Sandboxing would be nice, but very little gets sandboxed right now, so it's hard to classify it as a real need. And the sandboxes that do get used aren't very vulnerable to X11 attacks. If you're running firefox the web process sandbox doesn't have X11 access, and by the time the rendering process gets chain-exploited it can access your files directly without needing to go through X11.
  - acdha 3y ago
    Arguing that we shouldn’t deploy sandboxing because it’s not widely used seems counterproductive, and a recipe for not catching up with macOS or even Windows. Even if Firefox is perfect, that still leaves everything else which connects to the outside world or opens downloaded files. We know there’s a long history of those exploits and everyone serious in the desktop OS space has been trying to harden things so it’s not a single mistake away from an irrecoverable compromise.
    - Dylan16807 3y ago
      Nobody said we shouldn't, it's a matter of whether this particular attack vector is worth so much trouble to prevent. Security needs to allow usability or the whole system fails.
      - acdha 3y ago
        Preventing any compromise of an X11 app from being easily escalated seems useful, and there's no usability hit for users. Developers have to update code designed in the 1990s – which I should note most of us griped about even back then – but that's not especially onerous and has multiple other benefits.

acdha 3y ago

You’re saying Linux users never make mistakes like clicking on the wrong link or opening the wrong attachment? Unless that’s true, yes, we need sandboxing.

deleted 3y ago
[deleted]
Dylan16807 3y ago
Sandboxing would be nice, but very little gets sandboxed right now, so it's hard to classify it as a real need. And the sandboxes that do get used aren't very vulnerable to X11 attacks. If you're running firefox the web process sandbox doesn't have X11 access, and by the time the rendering process gets chain-exploited it can access your files directly without needing to go through X11.
- acdha 3y ago
  Arguing that we shouldn’t deploy sandboxing because it’s not widely used seems counterproductive, and a recipe for not catching up with macOS or even Windows. Even if Firefox is perfect, that still leaves everything else which connects to the outside world or opens downloaded files. We know there’s a long history of those exploits and everyone serious in the desktop OS space has been trying to harden things so it’s not a single mistake away from an irrecoverable compromise.
  - Dylan16807 3y ago
    Nobody said we shouldn't, it's a matter of whether this particular attack vector is worth so much trouble to prevent. Security needs to allow usability or the whole system fails.
    - acdha 3y ago
      Preventing any compromise of an X11 app from being easily escalated seems useful, and there's no usability hit for users. Developers have to update code designed in the 1990s – which I should note most of us griped about even back then – but that's not especially onerous and has multiple other benefits.