4 ms·

> So like nearly every other X11 user, my X11 server is not exposed to the network at all. Are you misunderstanding what the OP meant by "socket"? It doesn't h

> So like nearly every other X11 user, my X11 server is not exposed to the network at all. Are you misunderstanding what the OP meant by "socket"? It doesn't have to literally be a network socket, but your X11 apps all connect to the server via some IPC mechanism, could be a network socket or a local named pipe (I think it lives out in /var/, but I'm not on a Linux system atm). Their point was there is no client authentication or separation via this IPC mechanism: one X11 application can send messages directly to another X11 application. That's where their example of a malicious app inserting text into a sudo terminal comes from. You can see this for yourself using a virtual keyboard program. It's just an X11 app like any other, it's just injecting messages for the server to dispatch to another client. > I believe most Linux users are like me: they are conscious of security issues, and they don't need a nanny to look after them. I feel under this argument, you can also describe memory segmentation as a "nanny" =/ I don't think many would argue we should go back to shared memory systems.

denton-scratch 3y ago
> one X11 application can send messages directly to another X11 application. Sure. I get that. But I don't run malicious applications on X; and I don't pipe the output of curl into bash. > I don't think many would argue we should go back to shared memory systems. Me neither. But from my perspective, memory segmentation is necessary to protect me against incompetent programmers, not malicious applications. Breaking X11 security isn't something that happens by accident, it requires actual malice.
- soerxpso 3y ago
  > But I don't run malicious applications on X The thing about malicious applications is that they usually don't do a lot to inform the user that they are a malicious application. "I don't run malicious applications" is a claim shared by nearly everyone who's ever run a malicious application.
  - denton-scratch 3y ago
    I've never been mugged, probably because I don't hang out around shady characters at night. Back in the 80s, I got viruses and trojans, because (a) I was promiscuous with floppy disks, and (b) I worked with students. And I installed software from shady places that came with unwanted stuff like browser toolbars. Nowadays, I use Linux, and I find I can rely on the distro's package repository. So I only install software from the repository; if I need to try something that isn't packaged by the distro, I proceed with extreme caution. I'm sure it's different if you're running a corporate Linux desktop fleet; but this is a home network, with one laptop that runs any GUI at all. The laptop exposes no network ports. In fact the entire home network exposes no internet ports. I think Red Hat would be fine, if they'd stick to serving corporate requirements. I just wish they'd stop shoving stuff down the throats of non-corporate users. I'm particularly annoyed by systemd; Poettering is a specialist in throat-shoving. Unfortunately, I don't seem to be able to get Bluetooth Audio to work on Linux without pulseaudio. I have a pair of nice Bose cans that I can't use, because I don't want to run pulse. I need a bluetooth audio stack that depends only on ALSA. (I think it's possible, but every time I try I run into a brick wall, and I've got tired)
    - PrimeMcFly 3y ago
      > I've never been mugged, probably because I don't hang out around shady characters at night. People frequently get mugged in broad daylight in 'safe' areas. Malicious applications can come in trustworthy looking packages. Just look at the amount of malicious applications that have been found in python libraries recently, none of which you would have installed or used directly. X is insecure and your habits maybe have been enough to protect you so far, but banking on them always doing so in the future is kind of silly.
    - orangeboats 3y ago
      This is such an elitist take of the situation. One person may not be gullible enough to unintentionally run a malicious application, but once you extend it to a group of people, the claim will likely no longer be true. What if your coworker(s) accidentally ran a rogue X11 application, their passwords got keylogged, and now your company systems are compromised? And the above paragraph only operates under the assumption that you, the one person, is perfect, who never makes mistakes, never runs malicious applications, and runs on a distro that is never compromised, providing programs developed by people who are security-minded. You might have been compromised never knowing it. On the other hand, the other day when I shared my screen on Firefox, my Wayland compositor (indirectly through xdg-desktop-portal) asked me to confirm that it was my intention to let the browser see my desktop. I felt that was pretty nifty.
Dylan16807 3y ago
> one X11 application can send messages directly to another X11 application. That's where their example of a malicious app inserting text into a sudo terminal comes from. If I'm running a malicious application, I have much bigger worries than a an injected sudo. It has access to all my files! > I feel under this argument, you can also describe memory segmentation as a "nanny" =/ I don't think many would argue we should go back to shared memory systems. On my desktop I use memory segmentation to protect against programming errors, not for security.
- coppsilgold 3y ago
  > If I'm running a malicious application, I have much bigger worries than a an injected sudo. It has access to all my files! If you practice sandbox hygiene on linux (eg. bubblewrap) the only files it will have access to are the ones absolutely necessary for its functioning such as a private /home/user per application. However if you use X11, all such measures will be useless. You could of course run nested X11 (eg. Xephyr). But the inconvenience is of such magnitude why not use Wayland?

denton-scratch 3y ago

> one X11 application can send messages directly to another X11 application. Sure. I get that. But I don't run malicious applications on X; and I don't pipe the output of curl into bash. > I don't think many would argue we should go back to shared memory systems. Me neither. But from my perspective, memory segmentation is necessary to protect me against incompetent programmers, not malicious applications. Breaking X11 security isn't something that happens by accident, it requires actual malice.

soerxpso 3y ago
> But I don't run malicious applications on X The thing about malicious applications is that they usually don't do a lot to inform the user that they are a malicious application. "I don't run malicious applications" is a claim shared by nearly everyone who's ever run a malicious application.
- denton-scratch 3y ago
  I've never been mugged, probably because I don't hang out around shady characters at night. Back in the 80s, I got viruses and trojans, because (a) I was promiscuous with floppy disks, and (b) I worked with students. And I installed software from shady places that came with unwanted stuff like browser toolbars. Nowadays, I use Linux, and I find I can rely on the distro's package repository. So I only install software from the repository; if I need to try something that isn't packaged by the distro, I proceed with extreme caution. I'm sure it's different if you're running a corporate Linux desktop fleet; but this is a home network, with one laptop that runs any GUI at all. The laptop exposes no network ports. In fact the entire home network exposes no internet ports. I think Red Hat would be fine, if they'd stick to serving corporate requirements. I just wish they'd stop shoving stuff down the throats of non-corporate users. I'm particularly annoyed by systemd; Poettering is a specialist in throat-shoving. Unfortunately, I don't seem to be able to get Bluetooth Audio to work on Linux without pulseaudio. I have a pair of nice Bose cans that I can't use, because I don't want to run pulse. I need a bluetooth audio stack that depends only on ALSA. (I think it's possible, but every time I try I run into a brick wall, and I've got tired)
  - PrimeMcFly 3y ago
    > I've never been mugged, probably because I don't hang out around shady characters at night. People frequently get mugged in broad daylight in 'safe' areas. Malicious applications can come in trustworthy looking packages. Just look at the amount of malicious applications that have been found in python libraries recently, none of which you would have installed or used directly. X is insecure and your habits maybe have been enough to protect you so far, but banking on them always doing so in the future is kind of silly.
  - orangeboats 3y ago
    This is such an elitist take of the situation. One person may not be gullible enough to unintentionally run a malicious application, but once you extend it to a group of people, the claim will likely no longer be true. What if your coworker(s) accidentally ran a rogue X11 application, their passwords got keylogged, and now your company systems are compromised? And the above paragraph only operates under the assumption that you, the one person, is perfect, who never makes mistakes, never runs malicious applications, and runs on a distro that is never compromised, providing programs developed by people who are security-minded. You might have been compromised never knowing it. On the other hand, the other day when I shared my screen on Firefox, my Wayland compositor (indirectly through xdg-desktop-portal) asked me to confirm that it was my intention to let the browser see my desktop. I felt that was pretty nifty.

Dylan16807 3y ago

> one X11 application can send messages directly to another X11 application. That's where their example of a malicious app inserting text into a sudo terminal comes from. If I'm running a malicious application, I have much bigger worries than a an injected sudo. It has access to all my files! > I feel under this argument, you can also describe memory segmentation as a "nanny" =/ I don't think many would argue we should go back to shared memory systems. On my desktop I use memory segmentation to protect against programming errors, not for security.

coppsilgold 3y ago
> If I'm running a malicious application, I have much bigger worries than a an injected sudo. It has access to all my files! If you practice sandbox hygiene on linux (eg. bubblewrap) the only files it will have access to are the ones absolutely necessary for its functioning such as a private /home/user per application. However if you use X11, all such measures will be useless. You could of course run nested X11 (eg. Xephyr). But the inconvenience is of such magnitude why not use Wayland?