7 ms·
Why do people keep persisting this myth? X11 has authentication. You can either rely on filesystem permissions, or a shared secret. The same way thousands of ot
by 0xbadcafebee 1y ago
Why do people keep persisting this myth? X11 has authentication. You can either rely on filesystem permissions, or a shared secret. The same way thousands of other network servers work.
Any program you run on a computer (especially a Linux computer, which lacks modern OS security measures and has constant privesc kernel holes) exposes you to security flaws. There has yet to be any computer system designed that a hacker can't break out of. If you intentionally download and execute a program, you are rolling the dice, regardless of what the software is.
What's insane about all these discussions is that NOBODY IS HACKING X SERVERS. There's a thousand other kinds of software on Linux that there is real malware for. But nobody is trying to hijack your X11 session. This imagined threat is a red herring designed to bolster the argument for Wayland's horrible designs.
- tapoxi 1y agoI think the issue isn't that you downloaded random hostile software, but that other software you do use has some sort of vulnerability (recent Unity vulnerability, browser sandbox escape, etc) and an issue like this would allow for privilege escalation. Wayland doesn't need X11's vulnerability as its only argument, Wayland is a much simpler design that is easier to iterate on because it doesn't assume the client and server are on different machines. The fact that it moves privileged APIs like screen capture behind portals is a bonus.
- kelnos 1y agoSo simple and easy to iterate on that Wayland compositors are still not as full-featured as X11 desktop environments after more then a decade, and can't be due to protocols no one is able to agree to implement.
- phkahler 1y ago>> Wayland compositors are still not as full-featured as X11 desktop environments It depends what features you care about. X11 doesn't have tear-free video playback, HDR, or as good a security model as Wayland.
- mikkupikku 1y agoUsing a compositor fixes screen tearing, no need to use Wayland for that.
- marmight 1y agoEven a compositor is unnecessary to fix screen tearing these days: https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1006 https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests...
- phkahler 1y ago>> Using a compositor fixes screen tearing, no need to use Wayland for that. Right, and that abandons the whole X drawing API in favor of passing around client drawn bitmaps. That was one of the big points of Wayland too - X has a whole bunch of stuff that no modern apps use anyway so lets throw it out and build up a better version of the capabilities we need. If we abandon the X drawing API and half an OS included (memory management) and use KMS, all that's left is the features that are security holes.
- toast0 1y agoX11 has options for tear free video playback; it's not in the base protocol, and not all drivers offer it, etc, but it's acheivable. Fundamentally, you need to send the next frame to the server and ask it to switch frames during vblank (+/- notification), on today's systems, this is more of a coordination problem than a technical one; there's plenty of video ram to go around to double/tripple buffer. HDR would fit in the X11 model of many bit depths, however the specifics don't really; afaik, X11 has a maximum bitdepth of 32 for pixel values, which means either limiting to 2-bits of alpha channel or using palettes (I think I saw that indexed colors can be defined with 16-bits per channel). An extension might be possible (with everything that brings), but I think the ship has sailed. I agree that Wayland's security model prevents some undesirable interactions that X11 allows, but it also prevents or makes difficult some desirable interactions, so it's a mixed bag.
- Imustaskforhelp 1y ago
- imtringued 1y agoAren't you just doubling down on Wayland being simple? X11 is the kitchen sink here.
- jonway 1y agoWhat missing features? Xforward?
- uyzstvqs 1y agoWayland is the way to go. The same applies to Flatpak, Pipewire, systemD, etc. I'd say that this is obvious, and doesn't even need to be argued, to 99%+ of those who actually use the Linux desktop. The only opposition to this is a small group of decelerationists with a major, irrational aversion to change.
- mx7zysuj4xew 1y agoEverything you listed is bloated, slow, incompatible, unfinished or unstable. My system worked fine 20 years ago on far less capable hardware. Now even with high end workstations systems lag, crash or have strange behavior
- gf000 1y ago[flagged]
- okanat 1y agoWe are running systemd with all bells and whistles on Raspberry Pi based 1 GB RAM systems. systemd-networkd, iwd, timers etc. The base usage barely touches 350 MiBs. Our actual application is containerized with systemd thanks to broad set of options increasing system security quite a bit. It works great. You know what's bloated? Replacing all those functions with custom bash scripts or worse system services.
- deleted 1y ago[deleted]
- mx7zysuj4xew 1y ago[flagged]
- tomhow 1y agoWTF? You can't address people like this on HN, and comments like this are completely unacceptable. You might not owe containers better, but you owe the community better if you want to participate here. Please take a moment to read the guidelines and make an effort to observe them if you want to keep participating here. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- zdragnar 1y ago> What's insane about all these discussions is that NOBODY IS HACKING X SERVERS I knew someone who worked for a small loan type company. Passwords were stored in plain text, but even worse, the login form didn't actually check the password at all, it created valid sessions as long as you provided a valid user name. When he informed his boss that was very bad, his boss simply said that nobody has abused it, and nobody would, don't waste time changing it. The point, of course, is why would you wait until people are getting hacked to address a known vulnerability? Sure, there are others, and they should be closed too, and they are when they are found. It makes no sense whatsoever to leave one open just because.
- portaouflop 1y agoIt does make sense if the vuln doesn’t fit in your threat model. There are always an uncountable number of vulnerabilities and you can never fix all that are found. No idea of course if the threat model that said boss had in mind made sense. But I always recommend to come up with a reasonable threat model first and then think you can harden against it.
- nurettin 1y agoI don't dispute your anecdote but I think the point was: x11 has been around for decades, and these things just don't happen. And the reason is that there are much simpler and more effective ways to pwn a box than trying to screenshot an x session or trying to hook for key presses. So the vulnerability surface just isn't large enough.
- jchw 1y ago> Why do people keep persisting this myth? X11 has authentication. You can either rely on filesystem permissions, or a shared secret. The same way thousands of other network servers work. Any program you incidentally run within a typical graphical user session will have access to the X socket and a cookie, they will be able to connect. And after they connect... They basically just can do anything they want with zero real restrictions, including most likely some fairly trivial paths to root escalation. Even if they're running inside of a sandbox or container, with only an X11 socket poking through. This problem was realized a very long time ago with the security extension but most of it never really caught on. > Any program you run on a computer (especially a Linux computer, which lacks modern OS security measures and has constant privesc kernel holes) exposes you to security flaws. There has yet to be any computer system designed that a hacker can't break out of. If you intentionally download and execute a program, you are rolling the dice, regardless of what the software is. If you believe this is true, then what exactly is the point of any security measure? Why bother using isolation and sandboxing, or passwords? Why does Windows bother patching flaws if they know there are certainly more of them and they will never fix them? Do you by chance also smoke because you're going to die anyways? > What's insane about all these discussions is that NOBODY IS HACKING X SERVERS. There's a thousand other kinds of software on Linux that there is real malware for. But nobody is trying to hijack your X11 session. This imagined threat is a red herring designed to bolster the argument for Wayland's horrible designs. Lol. That's primarily because the Linux desktop is utterly irrelevant, not because nobody would care to do it. Is it really surprising that attacks against desktop computers would focus almost entirely on the OS that has 90+% of the market share? We don't get free software OS desktop malware for the same reason we don't get free software OS software ports. Watching and waiting with security was a totally acceptable position in the 90s, but we get the general gist these days. We need security-by-design. On the server side of Linux where Linux is relevant, the situation is much more impressive; auditing using eBPF, sandboxing with gVisor, microVMs with Firecracker and cloud-hypervisor, isolation using namespaces and seccomp-bpf and more. On the desktop side, people are still arguing over whether or not it's a problem that any X client can by default silently keylog the entire system trivially. Okay, but a lot of us actually see that as a problem, and we're not interested much in "hearing you out". Most of us recognize that the Wayland protocol has warts (and too many damn protocols), but X11 has many more warts. I didn't care what was the successor to X11 specifically, I just cared that we eventually made some progress. Most people have nothing to offer here and just suggest we should've stuck with X11. Okay dude, but nobody wants to. The X.org devs would like to move on. The desktop environments really would like to move on. There was basically one serious guy that actually wanted to work on improving X11 and he turned out to be kind of crazy and couldn't stop breaking shit anyways.
- jeroenhd 1y agoOf course X has authentication, but once you're in, you're in. There are no elevated windows, screen recording permissions, or any sort of keylogger prevention. That was normal a few decades ago, but the world has moved on since. There's no real reason it can't do any of that, it just doesn't and there are no real plans to add these features. I'm not convinced by the "if you run a program you should assume you've already been hit by a CIA 0day". Obviously nobody is dialing into your X11 server from the internet, but this is a relatively easy nobody:nobody -> root/wm-session/whatever elevation of privilege.
- josephcsible 1y agoIf malware is in your X server, doesn't that mean it's running under your user account? And if that's the case, then couldn't it just steal your data right off the filesystem without needing to get it from X?
- lmz 1y agoIt could be a remote X client on another machine.
- zahlman 1y agoThe valuable data on your machine might not be something permanently stored in the filesystem, but ephemerally recorded in a process. Say, a memorized password.
- josephcsible 1y agoCouldn't the malware still get it without having to deal with X? E.g., by attaching to your process as a debugger?
- int_19h 1y agoTry doing that on a regular Linux install, you might be surprised.
- zahlman 1y agoPeople keep talking about X11 security in the context of servers and networking, but I'm more concerned about exposing more attack surface to local malware (i.e. keylogging other processes, capturing program state).
- deleted 1y ago[deleted]