I.e. spend more money to do things the TV can perfectly well do. We should make the spying illegal so we can use the devices we buy to their full potential without being sold to advertisers. "Give money to this other company that may or may not also be collecting data and may also sell you out in the future" is a suboptimal solution.
This probably includes little silly games like Candy Crush, and (maybe) others that seem more like "paper" games like Sudoku, Wordle, Connections, etc. Many play those, especially the second bucket.
My only beef with Jellyfind when I used it some time back was inability to resize subtitles, which were huge on a large TV. Could have been lack of knowledge on my part though.
You talk about it as if it's little cliques of students talking about each other in a cafeteria. It's not. It's a giant economy with a giant military that affects everyone's wellbeing.
The hope is in a few more years, we'll not have a cult hell bent on accelerating the apocalypse in charge of the largest economy in the world, or are you guys planning something different?
With a project as user/dev hostile as wayland, it's much better to be a 'last mover' than first.
For the life of me, I'll never understand how wayland got traction with the community.
'Hey guys, we decided to implement a display server from scratch! We broke a ton of existing functionality and made a ton of low level stuff that X used to handle the responsibility of WM/DE devs!'
You'll excuse me if I am not terribly enthusiastic about breaking all sorts of functionality to solve a security problem I've never experienced in my 25 years on linux.
Exactly. It's hard to be enthusiastic about something which breaks a lot of stuff I rely on daily, when the benefit is that it fixes problems I've never had.
My theory about the motivation behind the extra security is that it's largely driven by corporations wanting to make desktop Linux less free and less open, and normalize proprietary software instead of open-source. Because profit. Proprietary software is inherently not trustworthy, so the execution environment needs extra security and restrictions, and must be generally less powerful to reduce the damage it can do. Essentially, proprietary software needs the same precautions as malware. So the corps needed to "androidify" desktop Linux. Hence the change from curated distro package repositories to corporate app stores, and the reason why there's so much money pushing to replace X11 with Wayland.
In an open-source ecosystem, users and developers are one and the same, or at least on the same "side", cooperating with each other to make tools which work as well as possible for everyone. Each big program tends to be a collaborative effort where a lot of people contribute to make things better for everyone. Things mostly "just work" and people can typically trust their computers not to do anything weird or hostile.
Very different than a proprietary commercial ecosystem, where users and developers have more of an adversarial relationship. Each program tends to be created in a closed silo by one person or a relatively small team, and is designed primarily to extract money from users, with all other concerns being secondary. It is very common for profit-driven developers to engage in deceptive practices, or do things the user doesn't want, like showing advertisements, collecting and selling data, sabotaging products from competitors, using the device as a node in a botnet or secret compute farm, forcing unwanted updates, microtransactions or subscription fees, etc. So nothing can be trusted, and the entire system needs extensive protections against every type of misbehavior imaginable... even if that means reducing the power and features available to the user.
I've really enjoyed the past few decades of living entirely in the open-source world, where those problems pretty much just don't exist. But with corps pushing the androidification of desktop Linux, I fear those days may be coming to an end.
Wayland security is a side effect of how the core protocol works. In X, you have one giant buffer, while in Wayland, each application renders to its own buffer and pushes that buffer to the compositor when ready.
X has had compositing for ages as well. That didn't require preventing applications from moving the cursor or simulating keyboard input and even screen grabs still work fine.
It is, but my argument is that better security is not needed! There is only one user. All apps are his/hers.
Linux security inside a user's session is bad in general. It all started in the '90s from the principle that all installed software is FOSS, sources inspected, and compiled distro packages trusted.
- Permissions are per-user, not per-app. If I ever need permissions to something, every app I run gets the same permissions.
- No isolation for personal files. Any app running as me can read all of them. Bookmarks, firefox passwords, everything.
- No per-app firewall mechanisms. Any app can call home and send user's files, including those passwords.
- System events are broadcasted via dbus to any app wanting to listen to them.
So why make the GUI secure if everything else isn't? If anyone wants to have better security (or privacy) in Linux, would have to start with the basic permissions model.
More importantly, adding more security has a real cost because either you just can't do some things or need to punch a bunch of custom-built holes in your security. If you can avoid paying that cost by having only trusted software why wouldn't you.
It’s not about multi-user security. I would not like a compromised video player to be able to see my Signal chats just because both apps are in the same window system.
Does Signal save history? Or does it save your encryption keys in a file? If it does, then a compromized program can just read those files directly. No need for X, no need for a GUI, a simple console app can do it.
More, a compromized app can execute Signal itself, attach a debugger to it, fake inputs, read outputs, read it's memory, etc. and impersonate you. Also without X.
> Does Signal save history? Or does it save your encryption keys in a file?
Even on Signal Desktop, retrieving things from an outside app is very-hard-to-impossible depending on configuration and what you're after.
There's a reason most Signal bots (even benign ones) hook up an event stream to a specially configured Signal daemon and build an external record of data from Signal by watching for events over time.
> More, a compromized app can execute Signal itself, attach a debugger to it, fake inputs, read outputs, read it's memory...
I think you're missing a lot of the attack surface here. "Local execution is game over" is a technically-true-but-incomplete thought-terminating statement; it's more useful to assess "if I grant local execution, what attackers are likely to be interested in that, and what attacks are they likely to perform?"
Like sure, if you install something containing a full userland rootkit designed to attack a given application, and that application isn't running in a container such that you have to pivot through root to access it, you're screwed.
Those do exist, but there are a ton of local attack vectors that aren't that. Many pieces of malicious code that install with local apps aren't that complex, since complexity begets size and suspicious-behavior detection. Less complex malware would prefer to e.g. read Firefox's sqlite database files rather than try to execute new instances of trusted programs like Signal to get data out of them. We know from analysis of a lot of malware that it overwhelmingly prefers low-hanging fruit that's easy to harvest quickly and without doing much that risks detection. Some malware's scarier, but like Mickens said, most people a) aren't gonna get Mossad'd on, and b) can't do much about it if they are: https://www.usenix.org/system/files/1401_08-12_mickens.pdf
There are also local attack vectors that don't involve installing malware directly. Local programs that run code (browsers) and plenty of other exploits in e.g. decoders are limited enough in what's possible within the exploit chain that they can't calc.exe you and instead rely on info harvesting from speculative execution
Flatpak/Snap/etc., also can assist with a layer of local-app security here.
Put all that together, and you end up at the conclusion that a large volume of data is only practically accessible to a lot of malware by accessing another running app's memory. Two significant ways to do that are 1) reading memory directly (significantly mitigated by hardware permissioning/segmentation/ASLR) and 2) reading data those apps publish to the display system. Wayland makes that second one a lot harder.
Yet Qubes OS demostrates it's possible to run X11 programs isolated from each other. They had the need and will to improve security, and found the way over a decade ago.
Making server side decorations an important part of it. Oh, the irony.
Qubes OS achieves isolation by separating apps into VMs. Wayland does this at the display protocol level. If Qubes OS is serious about security, they should consider Wayland with containerization. It would result in a similar level of isolation with significantly lower resource overhead.
I feel like the sheer volume of OS LPEs and escape CVEs in container runtimes indicates that, at least for now, the security boundary capabilities of containers are inferior to those of VMs.
Which is ironic, given that a lot of the tools that underly a container runtime were originally designed to facilitate security, not ease of deployment.
You're aware of the VM escape issues over the past decade? There's no perfect, and high overhead from running many guests can also create security risks. Wayland with all of its problems remains a logical step forward from the X model.
It's better than the security of pretty much anything physical in your home. Somehow you seem to be OK with your stove letting anyone turn it on and have other solutions to deal with misuse. The same solutions apply to your virtual desktop.
IMO the issue is that the same group stewarding Wayland was also xorg, and intentionally stifled improvement on xorg even when the work just a matter of merging the PR.
Merging a PR by drive-by contributors is far from trivial. As the maintainer, you become responsible for the other person's code for all eternity; it's on you to read it, understand it, update it when stuff around it changes, and fix it when it breaks.
Not a problem for obviously-correct changes of a couple of lines, but most PRs aren't like that.
I understand and that's a fair point. I should have phrased that differently, in that the PRs for features were waiting to be merged. I'm sure merging into a codebase as... storied? as xorg is no small task.
Open source developers are not required to spend their time prioritizing your priorities. You just have to look to Xlibre to see that a lot of contributions are quite bad quality, and in a C codebase of Xorg's complexity and security profile it's not a small job to review things.
Nothing I said in any way implied that freedesktop should be required to do anything. I can't speak to the quality of xlibre merges, only that if whatever is going on over there led to improvements in xorg after a drought, that's a good thing.
If wayland had been sold as a hardened display for those who needed that level of security, I would not have a problem with it.
As it is, the community got constantly browbeat with 'this is the future' and 'it's so much faster!' when recent benchmarks have proven that to be false.
Then go use X. Nobody's stopping you, you can just ignore any brow beating. /ignore is a useful IRC command.
You'll probably find it to be a not great experience, since almost all the people who spend their time actually working on graphics and GUIs in the Linux world prefer to work on Wayland. So X doesn't get much love these days (and you're not entitled to their efforts after all). But it's not like they erased all the old X code from existence.
You may notice issues with some GPU drivers if you have hardware with new drivers, because older GPU drivers contain X-specific workarounds which new drivers may lack (I know this is an issue with the Apple M1 GPU, I suspect it might be an issue with Panthor as well). But that's not really relevant with typical consumer hardware.
Desktop environments have varying levels of X support these days. GNOME hasn't been adding new features to X for a while, and GNOME 50 completely drops X. So if you're a GNOME fan you may not like that. KDE ends X11 support in 6.8. But it's always possible to stay on GNOME 49 or KDE Plasma 6.7 forever, or use an X11 window manager.
The X11 back-end is deprecated in GTK 4, so don't expect a ton of improvements to it, but it'll remain supported for all of GTK 4's life so you probably won't notice anything there immediately. But it means GTK 5 will drop the X11 back-end entirely, so at some point in the coming decade, GTK applications will gradually stop working.
Regardless of GUI toolkit, applications are slowly moving towards the XDG Portal way of doing things instead of the X11 way; which is fine, there's no reason why X systems can't support the portal dbus APIs, but I suspect that there will be more issues there once applications start dropping their X11 implementations of things. This is an area under active development and I would expect X11 to not see much of that development. I have no idea if anyone has implemented a portal for X11. Maybe you'd have to do that yourself eventually to keep new versions of certain programs running, I don't know how the state of portals is on X.
There are other things too that software can do to break X11 support even when their toolkit supports X, and expect that this has started happening to some degree and will slowly continue.
It is for netflix, or the cloud image storage provider that wants to secure against the consumer easily extracting data and going to someone else. The user being able to easily take a program made by a third party and have it completely rearrange the guts of any other program is the basis of consumer security in a world without a unified government keeping commercial interests at bay.
It is, but nothing can be done about it. That's how Linux permissions work. Any app running as me can execute any other app I have permissions to run. It can pipe stdin/out/err, trace it, etc. Why should the desktop apps be different?
My desktop apps can’t trace other apps because they don’t have my sudo password. Some of my desktop apps run in containers/snaps or whatnot and other user processes can’t get to their internals without pivoting to root. Apps can’t read each other’s memory because of segmentation.
There is a lot more to desktop inter-app security than “if an app had a root shell then it could compromise things”. A great many attack vectors that we see constantly have a much narrower ingress than that.
Do you also loose sleep over the fact that everyone you let into your home could decide to rearrange your furniture and smash your TV and go trawling through a bunch of private stuff?
Wayland is not a "display server", it's a display protocol.
A lot of the "existing functionality" that it broke has nothing to do with displays, it's stuff that got crammed into Xorg at some point whether it made sense or not.
I find it quite funny that many of the same people that rag on systemd and say it does too many things, are big fans of Xorg doing a bunch of things that "display server" probably should not be handling.
Even if Wayland was a "display server", it would still "remove existing functionality" if it meant that in any principled sense, because "display server" is only half of what Xorg does.
But sure, the transition was difficult and took a long time.
>Wayland is not a "display server", it's a display protocol.
I, as an end user, do NOT care.
>A lot of the "existing functionality" that it broke has nothing to do with displays, it's stuff that got crammed into Xorg at some point whether it made sense or not.
I also don't care about ivory tower ideals of what is within the dominion of 'display' and what is not. The fact of the matter is their changes broke a ton of functionality, and instead of even trying to provide feature parity, they basically dumped all that responsibility onto the WM/DE devs.
I have no idea why the community didn't take one look at their proposal and flatly ignore them.
> instead of even trying to provide feature parity, they basically dumped all that responsibility onto the WM/DE devs.
In other words, the Wayland people should perhaps have defined official protocol extensions early on to cover most of what X did, thus preventing all the initial interop issues when Gnome and KDE and Sway tried to reinvent them independently.
In hindsight, it's my opinion that wayland, if it had to exist at all, should have been implemented like this:
1. Add GBM to graphics drivers and start working it up the stack from the bottom, stopping at Xorg. That is, make rootful XWayland the standard Xorg before standalone even is a thing. This reduces maintenance work up front rather than belatedly.
2.a. Implement weston as a standalone compositor.
2.b. Actually make weston fully functional. Figure out everything needed to provide an actual working desktop environment with the features that users expect out of the box. Standardize all the protocols needed for at least a basic XFCE-ish environment rather than hoping someone else will do it.
3. Then, only after these things are done and working, announce to the world that wayland, a quiet project that has until now explicitly suggested nobody use it, is now the future of linux graphical systems and everyone should plan to migrate.
This pretty much. Xorg got almost everything that I care about to have a functionning GUI. You only startx and the only thing you may need are utils programs like a wm, a compositor, a bar… now you have conflicting implementation from gnome, kde, wlroots,… each with its own set of features.
Yeah, instead of the wayland folks leading the effort to fix issues, it's often some individual DE / WM going off, fixing it the way they prefer, and wayland grudgingly adopting it as official because they know the ecosystem is fragmenting bad enough as it is.
The community doesn't really have a say because Xorg is effectively on life support and the Xorg devs are now working on Wayland. There aren't many people in this world who could keep Xorg going. Some distros are sticking to Xorg, but it will become more and more difficult in the coming years.
Not in the short-term, for sure, and probably not even in the mid-term. But hardware keeps changing, and at some point nobody will care enough (or be able) to implement proper support for it in X (or proper support of X in that hardware). Hopefully we still have at least a decade of X though.
And this transition is nowhere near done. Just look at Kicad and pretty much any DAW that loads audio plugins (to name two major usecases where Wayland simply doesn't cut it).
Sure Xwayland exists and mostly (not entirely) works, but that's a band-aid for what is essentially a "we broke it and don't care" approach.
The daw problem is really really bad too. We've got a de facto standard forming right now where you link libwayland.so and hope the structs never ever ever change in the next 30 years.
It may be reasonable when you emulate a completely different platform but not when your are providing a compatibility feature in a supposed successor platform that can be designed to support that use case.
I can't find the benchmarks now, but the ones I recently saw on hacker news, xwayland was notably worse than either wayland native or xorg native. Bad enough to be noticeable by the average user.
It does not matter, X11 is also not a display server it is a protocol. That distinction changes nothing.
For what it's worth Xorg is the display server, before that it was XFree86, there was also Xsgi and Xsun and for mac Xquartz, I even saw a neat project once where the Xserver was in javascript, I am trying to find it again but our modern search engines are a bit shit. The point being all of these can interoperate with one another.
Around computers it is difficult to find the correct unit of time to
measure progress. Some cathedrals took a century to complete. Can you
imagine the grandeur and scope of a program that would take as long?
-- Epigrams in Programming, ACM SIGPLAN Sept. 1982
We have our cathedrals, only we are such barbarians as to call them worthless garbage and unfit for purpose and do our best to tear our legacy down.
> Wayland is not a "display server", it's a display protocol.
This is a huge part of what "user/dev hostile" means in my book; with Wayland, getting a working desktop always someone else's responsibility, all features have to be reimplemented across DEs endlessly (with often-incompatible variations, of course), and they all blame each other and program authors for bugs while the Wayland project refuses to even acknowledge basic features like desktop automation or screen recording.
> But sure, the transition was difficult and took a long time.
And this irks me too, people are convinced they're done but I still don't have xmacro. And flameshot is broken, while the alternatives suck. And support for everything depends on the DE now. And java.awt.Robot is broken with no replacement. And the clipboard randomly misses copies. And OBS screen recording is broken for me. And there's no support for display resolution scaling. And ssh -X is gone, while waypipe doesn't work all programs.
But hey, at least there's HDR now or something! It was definitely worth replacing a functioning stack for this. I'm so glad that Plasma 6.8 removes X support!
People aren't lamenting over Wayland not doing font rendering or audio but they care about display system features like screen recording and input automation that Wayland intentionally hobbles.
Wayland didn't start as a corporate project, and even if it had, you might be shocked to learn that the majority of contributions to projects like the Linux kernel and Mesa actually come from corporations, not individuals, right?
> I'll never understand how wayland got traction with the community
There were only a few people willing to work on an alternative, and they didn't have to take a vote, so they just did what they wanted. Corporations and projects adopted it because they wanted something different, and it was the only other option.
Now that we have AI, it will be much easier for genuine community alternatives to emerge, even if we have to battle over the legal ramifications. I for one am willing to go without "official support" to have software that doesn't suck.
reply