4 ms·

> It's not secure enough to recommend as a serious alternative to Mac and Windows users The security risk of X11 is theoretical, not practical. Yes, X11 progr

> It's not secure enough to recommend as a serious alternative to Mac and Windows users The security risk of X11 is theoretical, not practical. Yes, X11 programs can maliciously keylog each other, but this just isn't a thing that actually happens. And even if you do start installing random malware from the internet like a classic windows user, Wayland isn't going to prevent you from screwing yourself anyway. To actually be safe while installing and running malicious applications you need extensive sandboxing. Wayland can be one part of that sandboxing but is useless without the rest (to prevent the malware from stealing user files including credentials, using LD_PRELOAD hacks or similar to keylog other applications anyway, etc), and no distro suitable for recommending to Windows/MacOS newbs has the rest of the requisite sandboxing. The sandboxing touted by Wayland advocates is very esoteric and without all that sandboxing, a newb using Wayland has to exercise just as much caution when downloading software as if he were using X11.

orangeboats 2y ago
> Yes, X11 programs can maliciously keylog each other, but this just isn't a thing that actually happens. A simple search leads me to this: https://github.com/anko/xkbcat https://github.com/anko/xkbcat There isn't a real attack using it yet, only because attacking Desktop Linux is a really unprofitable endeavor (considering the marketshare, the ROI must be very low). > To actually be safe while installing and running malicious applications you need extensive sandboxing FWIW, X11 is unsandboxable unless you run a second X server on top of your current server [0]. Which is fine, but you need to consider that most, if not all sandboxing solutions on Linux that "newbs" use, like Flatpak, do not employ such technique when running sandboxed X11 applications. The "security by default" behavior of Wayland limits the possible attack surface a lot, without requiring the end user to understand all the nitty details involved. [0]: https://wiki.archlinux.org/title/Bubblewrap#Sandboxing_X11 https://wiki.archlinux.org/title/Bubblewrap#Sandboxing_X11
- lupusreal 2y ago
  You're not telling me anything I don't already know and haven't already explained. X11 keyloggers are trivial, and virtually never seen in the wild. X11 makes sandboxing impossible, but that doesn't matter because I'm not going to waste my time on something like Qubes anyway, and newbs from Windows aren't being directed to setups like that either. They're all installing Mint or Ubuntu where the security of Wayland is nullified by the absense of sandboxing.
  - orangeboats 2y ago
    >newbs from Windows aren't being directed to setups like that either. They're all installing Mint or Ubuntu where the security of Wayland is nullified by the absense of sandboxing. This cannot be more further from the truth. Amongst the newcomers, it is rather popular nowadays for them to use Flatpak-bundled apps, especially with the rise of SteamOS (the Deck essentially) lots of Linux newcomers are in fact first exposed to Flatpak and running untrusted executables in a sandbox. And the most prominent "untrusted executable" today to those newcomers has to be Bottles, which is a nice GUI wrapper for Wine and is sandboxed (if you enable wine-wayland, of course).
    - asveikau 2y ago
      I wouldn't trust flatpak enough to run a truly untrusted executable. I am sure flatpak's isolation is full of holes unrelated to windowing. But I don't think a game purchased through steam counts as untrusted.
      - orangeboats 2y ago
        >I wouldn't trust flatpak enough to run a truly untrusted executable. I am sure flatpak's isolation is full of holes unrelated to windowing. As compared to running untrusted programs completely naked? >But I don't think a game purchased through steam counts as untrusted. Bottles is there for people to run any Win32 program, not just Steam games. And I shouldn't have to tell you how many malicious Win32 programs there are.
        asveikau 2y ago
        Just google the criticisms of flatpak from a security perspective. They're out there. Containerization on Linux was never intended to be a security feature for totally untrusted, malicious code. It's isolation for trusted code. If your scenario relies on securely running untrusted executables in a Linux container you are doing stupid things.
        2y ago
- funcDropShadow 2y ago
  Why is X11 unsandboxable? A similar but reverse approach to Xwayland, something like waylandX could be used to be part of the overall sandbox approach to run untrusted applications. That would have the advantage that the severe restrictions and feature degradations of wayland are only applied to those untrusted sandboxed applications, not everything.
  - orangeboats 2y ago
    Ultimately, X11 opens up everything. What you suggest (WaylandX) is essentially allow-by-default. When this is the case and there is a supply chain attack, what you think is a trusted application (and therefore not running under "WaylandX") can very well keylog you or take screenshots of your desktop without your consent. In a deny-by-default model ala Wayland, applications will have to ask for permissions before they can do something considered to be privileged.
prmoustache 2y ago
> Yes, X11 programs can maliciously keylog each other, but this just isn't a thing that actually happens. Are you really saying keyloggers do not exist in the wild??? > Wayland can be one part of that sandboxing but is useless without the rest Yes but that is the point, and if you turn it the other way around X11 usually makes the rest of the sandboxing useless.
- lupusreal 2y ago
  I am saying that X11 users getting hit with keyloggers is extremely rare if it happens at all. It's trivial to make such a keyloggers but that doesn't mean it's common for the programs users install to do it. And yes, X11 makes that sandboxing useless, but that sandboxing isn't in play anyway because we're talking about noobs from Windows.
  - prmoustache 2y ago
    I think it is dangerous to feel yourself as superior. UNIX veterans can also be victim of supply chain attack, either from their distro package manager, a language module manager, a malicious flatpak with too much access, a trojaned appimage from a supposedly reputable vendor, etc.
    - lupusreal 2y ago
      Superior? All I'm doing is sticking to programs in my distro's repos. Such programs including malicious keyloggers is unheard of. And if a maintainer turns evil or let's something slip through by accident, the damage they could do is hardly mitigated by Wayland. Thankfully, this virtually never happens In principle I am also vulnerable to something like a RCE zero day in Firefox turning an otherwise trusty program into malware which exploits X11's open nature, but again, this sort of thing actually happening is unheard of. I'm not superior, I'm just trying to keep a realistic grip on the threats I face. Modern security culture is fixated on what is theoretically possible, I care more about what is actually likely.
      - 2y ago

orangeboats 2y ago

> Yes, X11 programs can maliciously keylog each other, but this just isn't a thing that actually happens. A simple search leads me to this: https://github.com/anko/xkbcat https://github.com/anko/xkbcat There isn't a real attack using it yet, only because attacking Desktop Linux is a really unprofitable endeavor (considering the marketshare, the ROI must be very low). > To actually be safe while installing and running malicious applications you need extensive sandboxing FWIW, X11 is unsandboxable unless you run a second X server on top of your current server [0]. Which is fine, but you need to consider that most, if not all sandboxing solutions on Linux that "newbs" use, like Flatpak, do not employ such technique when running sandboxed X11 applications. The "security by default" behavior of Wayland limits the possible attack surface a lot, without requiring the end user to understand all the nitty details involved. [0]: https://wiki.archlinux.org/title/Bubblewrap#Sandboxing_X11 https://wiki.archlinux.org/title/Bubblewrap#Sandboxing_X11

lupusreal 2y ago
You're not telling me anything I don't already know and haven't already explained. X11 keyloggers are trivial, and virtually never seen in the wild. X11 makes sandboxing impossible, but that doesn't matter because I'm not going to waste my time on something like Qubes anyway, and newbs from Windows aren't being directed to setups like that either. They're all installing Mint or Ubuntu where the security of Wayland is nullified by the absense of sandboxing.
- orangeboats 2y ago
  >newbs from Windows aren't being directed to setups like that either. They're all installing Mint or Ubuntu where the security of Wayland is nullified by the absense of sandboxing. This cannot be more further from the truth. Amongst the newcomers, it is rather popular nowadays for them to use Flatpak-bundled apps, especially with the rise of SteamOS (the Deck essentially) lots of Linux newcomers are in fact first exposed to Flatpak and running untrusted executables in a sandbox. And the most prominent "untrusted executable" today to those newcomers has to be Bottles, which is a nice GUI wrapper for Wine and is sandboxed (if you enable wine-wayland, of course).
  - asveikau 2y ago
    I wouldn't trust flatpak enough to run a truly untrusted executable. I am sure flatpak's isolation is full of holes unrelated to windowing. But I don't think a game purchased through steam counts as untrusted.
    - orangeboats 2y ago
      >I wouldn't trust flatpak enough to run a truly untrusted executable. I am sure flatpak's isolation is full of holes unrelated to windowing. As compared to running untrusted programs completely naked? >But I don't think a game purchased through steam counts as untrusted. Bottles is there for people to run any Win32 program, not just Steam games. And I shouldn't have to tell you how many malicious Win32 programs there are.
      - asveikau 2y ago
        Just google the criticisms of flatpak from a security perspective. They're out there. Containerization on Linux was never intended to be a security feature for totally untrusted, malicious code. It's isolation for trusted code. If your scenario relies on securely running untrusted executables in a Linux container you are doing stupid things.
        2y ago
funcDropShadow 2y ago
Why is X11 unsandboxable? A similar but reverse approach to Xwayland, something like waylandX could be used to be part of the overall sandbox approach to run untrusted applications. That would have the advantage that the severe restrictions and feature degradations of wayland are only applied to those untrusted sandboxed applications, not everything.
- orangeboats 2y ago
  Ultimately, X11 opens up everything. What you suggest (WaylandX) is essentially allow-by-default. When this is the case and there is a supply chain attack, what you think is a trusted application (and therefore not running under "WaylandX") can very well keylog you or take screenshots of your desktop without your consent. In a deny-by-default model ala Wayland, applications will have to ask for permissions before they can do something considered to be privileged.

prmoustache 2y ago

> Yes, X11 programs can maliciously keylog each other, but this just isn't a thing that actually happens. Are you really saying keyloggers do not exist in the wild??? > Wayland can be one part of that sandboxing but is useless without the rest Yes but that is the point, and if you turn it the other way around X11 usually makes the rest of the sandboxing useless.

lupusreal 2y ago
I am saying that X11 users getting hit with keyloggers is extremely rare if it happens at all. It's trivial to make such a keyloggers but that doesn't mean it's common for the programs users install to do it. And yes, X11 makes that sandboxing useless, but that sandboxing isn't in play anyway because we're talking about noobs from Windows.
- prmoustache 2y ago
  I think it is dangerous to feel yourself as superior. UNIX veterans can also be victim of supply chain attack, either from their distro package manager, a language module manager, a malicious flatpak with too much access, a trojaned appimage from a supposedly reputable vendor, etc.
  - lupusreal 2y ago
    Superior? All I'm doing is sticking to programs in my distro's repos. Such programs including malicious keyloggers is unheard of. And if a maintainer turns evil or let's something slip through by accident, the damage they could do is hardly mitigated by Wayland. Thankfully, this virtually never happens In principle I am also vulnerable to something like a RCE zero day in Firefox turning an otherwise trusty program into malware which exploits X11's open nature, but again, this sort of thing actually happening is unheard of. I'm not superior, I'm just trying to keep a realistic grip on the threats I face. Modern security culture is fixated on what is theoretically possible, I care more about what is actually likely.
    - 2y ago