3 ms·
I think it is dangerous to feel yourself as superior. UNIX veterans can also be victim of supply chain attack, either from their distro package manager, a langu
by prmoustache 2y ago
I think it is dangerous to feel yourself as superior. UNIX veterans can also be victim of supply chain attack, either from their distro package manager, a language module manager, a malicious flatpak with too much access, a trojaned appimage from a supposedly reputable vendor, etc.
- lupusreal 2y agoSuperior? All I'm doing is sticking to programs in my distro's repos. Such programs including malicious keyloggers is unheard of. And if a maintainer turns evil or let's something slip through by accident, the damage they could do is hardly mitigated by Wayland. Thankfully, this virtually never happens In principle I am also vulnerable to something like a RCE zero day in Firefox turning an otherwise trusty program into malware which exploits X11's open nature, but again, this sort of thing actually happening is unheard of. I'm not superior, I'm just trying to keep a realistic grip on the threats I face. Modern security culture is fixated on what is theoretically possible, I care more about what is actually likely.
- talldayo 2y ago> the damage they could do is hardly mitigated by Wayland. I disagree. How do you hijack interprocess communication on a Wayland device? I can tell you in very certain steps how to manipulate an x11 client but outside hijacking /dev/ I can't imagine a similar attack on Wayland.
- lupusreal 2y agoIf you aren't sandboxes you can edit the user's environment to swap out their programs with backdoored copies.