3 ms·

This is the first time I hear that anyone hates D-Bus. I always saw it as a global API Bus that Apps can register to and which enables some sort of interoperabi

This is the first time I hear that anyone hates D-Bus. I always saw it as a global API Bus that Apps can register to and which enables some sort of interoperability and automation. After all it can even be used from Bash. What is bad about this? The security aspect seems also a bit funny to me. After all the average Desktop has most data in the home directory, so every application can read everything. That's not the fault of D-Bus. Also I'm puzzled that Polkit hasn't been mentioned even once.

vanviegen 10mo ago
> The security aspect seems also a bit funny to me. After all the average Desktop has most data in the home directory, so every application can read everything. The world is moving towards sandboxed applications (through flatpak and friends) more and more. As per the OP, this is one of the things holding sandboxing back.
- LtWorf 10mo ago
  There's sandbox escapes daily since decades. It doesn't work.
  - akimbostrawman 10mo ago
    >There's lock picking daily since centuries. It doesn't work
    - LtWorf 10mo ago
      It takes time to pick one lock and twice as much to pick two. It takes the same time to escape 1 or 10000000 sandboxes.
      - gf000 10mo ago
        That's only somewhat true if we are talking about the same sandbox nested (which would be quite dumb to do). Escaping two different sandboxes are multiple times as hard, and a sane sandbox is not trivially picked, see web browsers and that the fact that the world is not one giant botnet.
        LtWorf 10mo ago
        How many implementations of linux namespaces are there in the kernel? Is it more than one?
        gf000 10mo ago
        Is a wasm sandbox, or the browser not a sandbox, independent of the kernel?
        LtWorf 10mo ago
        Has one of them ever gone more than a month without a CVE?
throw_await 10mo ago
The architecture is fundamentally broken when you are using multiple window managers / desktop environments https://github.com/dunst-project/dunst/issues/363 https://github.com/dunst-project/dunst/issues/363
- deleted 10mo ago
  [deleted]
dolmen 10mo ago
Check varlink, an alternative to D-Bus defined in the SystemD world. https://media.ccc.de/v/all-systems-go-2024-276-varlink-now- https://media.ccc.de/v/all-systems-go-2024-276-varlink-now-
- ahartmetz 10mo ago
  Nah, fuck that one in particular. DBus was too type-unsafe? Why not use JSON then, right? Right?!
- goku12 10mo ago
  Varlink was created independently of systemd. SystemD just adopted it. It just wasn't that well known before that adoption.
craftkiller 10mo ago
> The security aspect seems also a bit funny to me. After all the average Desktop has most data in the home directory, so every application can read everything. That's not the fault of D-Bus. Those secret stores (gnome-keyring/kwallet) store the secrets encrypted on disk, so every application can read the encrypted secrets but only the secret store has the encryption key to decrypt them. This is held in memory, not on disk.
mx7zysuj4xew 10mo ago
The reason you do t hear much about it is because it's not an often discussed topic. Nonetheless the hate is there. Dbus is a godawful mess. Imagine the windows registry, except it can only be inspected at runtime, contains executable binaries and is exceptionally fragile

vanviegen 10mo ago

> The security aspect seems also a bit funny to me. After all the average Desktop has most data in the home directory, so every application can read everything. The world is moving towards sandboxed applications (through flatpak and friends) more and more. As per the OP, this is one of the things holding sandboxing back.

LtWorf 10mo ago
There's sandbox escapes daily since decades. It doesn't work.
- akimbostrawman 10mo ago
  >There's lock picking daily since centuries. It doesn't work
  - LtWorf 10mo ago
    It takes time to pick one lock and twice as much to pick two. It takes the same time to escape 1 or 10000000 sandboxes.
    - gf000 10mo ago
      That's only somewhat true if we are talking about the same sandbox nested (which would be quite dumb to do). Escaping two different sandboxes are multiple times as hard, and a sane sandbox is not trivially picked, see web browsers and that the fact that the world is not one giant botnet.
      - LtWorf 10mo ago
        How many implementations of linux namespaces are there in the kernel? Is it more than one?
        gf000 10mo ago
        Is a wasm sandbox, or the browser not a sandbox, independent of the kernel?
        LtWorf 10mo ago
        Has one of them ever gone more than a month without a CVE?

throw_await 10mo ago

The architecture is fundamentally broken when you are using multiple window managers / desktop environments https://github.com/dunst-project/dunst/issues/363 https://github.com/dunst-project/dunst/issues/363

deleted 10mo ago
[deleted]

dolmen 10mo ago

Check varlink, an alternative to D-Bus defined in the SystemD world. https://media.ccc.de/v/all-systems-go-2024-276-varlink-now- https://media.ccc.de/v/all-systems-go-2024-276-varlink-now-

ahartmetz 10mo ago
Nah, fuck that one in particular. DBus was too type-unsafe? Why not use JSON then, right? Right?!
goku12 10mo ago
Varlink was created independently of systemd. SystemD just adopted it. It just wasn't that well known before that adoption.

craftkiller 10mo ago

> The security aspect seems also a bit funny to me. After all the average Desktop has most data in the home directory, so every application can read everything. That's not the fault of D-Bus. Those secret stores (gnome-keyring/kwallet) store the secrets encrypted on disk, so every application can read the encrypted secrets but only the secret store has the encryption key to decrypt them. This is held in memory, not on disk.

mx7zysuj4xew 10mo ago

The reason you do t hear much about it is because it's not an often discussed topic. Nonetheless the hate is there. Dbus is a godawful mess. Imagine the windows registry, except it can only be inspected at runtime, contains executable binaries and is exceptionally fragile