3 ms·

> Yes, X11 programs can maliciously keylog each other, but this just isn't a thing that actually happens. Are you really saying keyloggers do not exist in the

> Yes, X11 programs can maliciously keylog each other, but this just isn't a thing that actually happens. Are you really saying keyloggers do not exist in the wild??? > Wayland can be one part of that sandboxing but is useless without the rest Yes but that is the point, and if you turn it the other way around X11 usually makes the rest of the sandboxing useless.

lupusreal 2y ago
I am saying that X11 users getting hit with keyloggers is extremely rare if it happens at all. It's trivial to make such a keyloggers but that doesn't mean it's common for the programs users install to do it. And yes, X11 makes that sandboxing useless, but that sandboxing isn't in play anyway because we're talking about noobs from Windows.
- prmoustache 2y ago
  I think it is dangerous to feel yourself as superior. UNIX veterans can also be victim of supply chain attack, either from their distro package manager, a language module manager, a malicious flatpak with too much access, a trojaned appimage from a supposedly reputable vendor, etc.
  - lupusreal 2y ago
    Superior? All I'm doing is sticking to programs in my distro's repos. Such programs including malicious keyloggers is unheard of. And if a maintainer turns evil or let's something slip through by accident, the damage they could do is hardly mitigated by Wayland. Thankfully, this virtually never happens In principle I am also vulnerable to something like a RCE zero day in Firefox turning an otherwise trusty program into malware which exploits X11's open nature, but again, this sort of thing actually happening is unheard of. I'm not superior, I'm just trying to keep a realistic grip on the threats I face. Modern security culture is fixated on what is theoretically possible, I care more about what is actually likely.
    - talldayo 2y ago
      > the damage they could do is hardly mitigated by Wayland. I disagree. How do you hijack interprocess communication on a Wayland device? I can tell you in very certain steps how to manipulate an x11 client but outside hijacking /dev/ I can't imagine a similar attack on Wayland.
      - lupusreal 2y ago
        If you aren't sandboxes you can edit the user's environment to swap out their programs with backdoored copies.
immibis 2y ago
There's no rule that an X11 server has to send all keypresses to all processes.
- talldayo 2y ago
  But the core framework of every x11 server relies on a loop that does poll HID connected to your machine for events. You can have an x11 server running with no windows connected and your keypresses will still be broadcast to any program that knows where to look.
  - immibis 2y ago
    That's exactly the same as Wayland, isn't it? Every Wayland compositor also polls HIDs connected to your machine for events. And if your Wayland compositor has permission to open those HIDs when running as your user account, so does any other program you run, regardless of Wayland or X.

lupusreal 2y ago

I am saying that X11 users getting hit with keyloggers is extremely rare if it happens at all. It's trivial to make such a keyloggers but that doesn't mean it's common for the programs users install to do it. And yes, X11 makes that sandboxing useless, but that sandboxing isn't in play anyway because we're talking about noobs from Windows.

prmoustache 2y ago
I think it is dangerous to feel yourself as superior. UNIX veterans can also be victim of supply chain attack, either from their distro package manager, a language module manager, a malicious flatpak with too much access, a trojaned appimage from a supposedly reputable vendor, etc.
- lupusreal 2y ago
  Superior? All I'm doing is sticking to programs in my distro's repos. Such programs including malicious keyloggers is unheard of. And if a maintainer turns evil or let's something slip through by accident, the damage they could do is hardly mitigated by Wayland. Thankfully, this virtually never happens In principle I am also vulnerable to something like a RCE zero day in Firefox turning an otherwise trusty program into malware which exploits X11's open nature, but again, this sort of thing actually happening is unheard of. I'm not superior, I'm just trying to keep a realistic grip on the threats I face. Modern security culture is fixated on what is theoretically possible, I care more about what is actually likely.
  - talldayo 2y ago
    > the damage they could do is hardly mitigated by Wayland. I disagree. How do you hijack interprocess communication on a Wayland device? I can tell you in very certain steps how to manipulate an x11 client but outside hijacking /dev/ I can't imagine a similar attack on Wayland.
    - lupusreal 2y ago
      If you aren't sandboxes you can edit the user's environment to swap out their programs with backdoored copies.

immibis 2y ago

There's no rule that an X11 server has to send all keypresses to all processes.

talldayo 2y ago
But the core framework of every x11 server relies on a loop that does poll HID connected to your machine for events. You can have an x11 server running with no windows connected and your keypresses will still be broadcast to any program that knows where to look.
- immibis 2y ago
  That's exactly the same as Wayland, isn't it? Every Wayland compositor also polls HIDs connected to your machine for events. And if your Wayland compositor has permission to open those HIDs when running as your user account, so does any other program you run, regardless of Wayland or X.