3 ms·
These are actually vulnerabilities in Xlib, which is already well known to be pretty crufty. X11 security has always been a joke anyway, since basically any cl
by dlitz 13y ago
These are actually vulnerabilities in Xlib, which is already well known to be pretty crufty. X11 security has always been a joke anyway, since basically any client can keylog the session at any point. There is some X security policy stuff, but it was never fully developed.
The interesting part here is that there's revived interest in fixing Xlib.
And for the people talking about Wayland being the future: Let's not forget that client-side window decorations are not exactly going to be a security improvement.
- VMG 13y ago> Let's not forget that client-side window decorations are not exactly going to be a security improvement. Why would it have anything to do with security?
- derleth 13y agoThe golden rule is that everything has something to do with security.
- dlitz 13y agoIf we care about giving applications restricted access to the display and input devices, then we need to prevent those applications from fooling the user. Otherwise, a rogue application can basically do phishing, clickjacking, etc. If we don't care about restricting access, then it doesn't make sense to call these bugs security vulnerabilities at all.