3 ms·

> But I don't run malicious applications on X The thing about malicious applications is that they usually don't do a lot to inform the user that they are a mal

> But I don't run malicious applications on X The thing about malicious applications is that they usually don't do a lot to inform the user that they are a malicious application. "I don't run malicious applications" is a claim shared by nearly everyone who's ever run a malicious application.

denton-scratch 3y ago
I've never been mugged, probably because I don't hang out around shady characters at night. Back in the 80s, I got viruses and trojans, because (a) I was promiscuous with floppy disks, and (b) I worked with students. And I installed software from shady places that came with unwanted stuff like browser toolbars. Nowadays, I use Linux, and I find I can rely on the distro's package repository. So I only install software from the repository; if I need to try something that isn't packaged by the distro, I proceed with extreme caution. I'm sure it's different if you're running a corporate Linux desktop fleet; but this is a home network, with one laptop that runs any GUI at all. The laptop exposes no network ports. In fact the entire home network exposes no internet ports. I think Red Hat would be fine, if they'd stick to serving corporate requirements. I just wish they'd stop shoving stuff down the throats of non-corporate users. I'm particularly annoyed by systemd; Poettering is a specialist in throat-shoving. Unfortunately, I don't seem to be able to get Bluetooth Audio to work on Linux without pulseaudio. I have a pair of nice Bose cans that I can't use, because I don't want to run pulse. I need a bluetooth audio stack that depends only on ALSA. (I think it's possible, but every time I try I run into a brick wall, and I've got tired)
- PrimeMcFly 3y ago
  > I've never been mugged, probably because I don't hang out around shady characters at night. People frequently get mugged in broad daylight in 'safe' areas. Malicious applications can come in trustworthy looking packages. Just look at the amount of malicious applications that have been found in python libraries recently, none of which you would have installed or used directly. X is insecure and your habits maybe have been enough to protect you so far, but banking on them always doing so in the future is kind of silly.
- orangeboats 3y ago
  This is such an elitist take of the situation. One person may not be gullible enough to unintentionally run a malicious application, but once you extend it to a group of people, the claim will likely no longer be true. What if your coworker(s) accidentally ran a rogue X11 application, their passwords got keylogged, and now your company systems are compromised? And the above paragraph only operates under the assumption that you, the one person, is perfect, who never makes mistakes, never runs malicious applications, and runs on a distro that is never compromised, providing programs developed by people who are security-minded. You might have been compromised never knowing it. On the other hand, the other day when I shared my screen on Firefox, my Wayland compositor (indirectly through xdg-desktop-portal) asked me to confirm that it was my intention to let the browser see my desktop. I felt that was pretty nifty.

denton-scratch 3y ago

I've never been mugged, probably because I don't hang out around shady characters at night. Back in the 80s, I got viruses and trojans, because (a) I was promiscuous with floppy disks, and (b) I worked with students. And I installed software from shady places that came with unwanted stuff like browser toolbars. Nowadays, I use Linux, and I find I can rely on the distro's package repository. So I only install software from the repository; if I need to try something that isn't packaged by the distro, I proceed with extreme caution. I'm sure it's different if you're running a corporate Linux desktop fleet; but this is a home network, with one laptop that runs any GUI at all. The laptop exposes no network ports. In fact the entire home network exposes no internet ports. I think Red Hat would be fine, if they'd stick to serving corporate requirements. I just wish they'd stop shoving stuff down the throats of non-corporate users. I'm particularly annoyed by systemd; Poettering is a specialist in throat-shoving. Unfortunately, I don't seem to be able to get Bluetooth Audio to work on Linux without pulseaudio. I have a pair of nice Bose cans that I can't use, because I don't want to run pulse. I need a bluetooth audio stack that depends only on ALSA. (I think it's possible, but every time I try I run into a brick wall, and I've got tired)

PrimeMcFly 3y ago
> I've never been mugged, probably because I don't hang out around shady characters at night. People frequently get mugged in broad daylight in 'safe' areas. Malicious applications can come in trustworthy looking packages. Just look at the amount of malicious applications that have been found in python libraries recently, none of which you would have installed or used directly. X is insecure and your habits maybe have been enough to protect you so far, but banking on them always doing so in the future is kind of silly.
orangeboats 3y ago
This is such an elitist take of the situation. One person may not be gullible enough to unintentionally run a malicious application, but once you extend it to a group of people, the claim will likely no longer be true. What if your coworker(s) accidentally ran a rogue X11 application, their passwords got keylogged, and now your company systems are compromised? And the above paragraph only operates under the assumption that you, the one person, is perfect, who never makes mistakes, never runs malicious applications, and runs on a distro that is never compromised, providing programs developed by people who are security-minded. You might have been compromised never knowing it. On the other hand, the other day when I shared my screen on Firefox, my Wayland compositor (indirectly through xdg-desktop-portal) asked me to confirm that it was my intention to let the browser see my desktop. I felt that was pretty nifty.