this post was submitted on 24 Jul 2024
15 points (85.7% liked)
Linux Gaming
15911 readers
29 users here now
Gaming on the GNU/Linux operating system.
Recommended news sources:
Related chat:
Related Communities:
Please be nice to other members. Anyone not being nice will be banned. Keep it fun, respectful and just be awesome to each other.
founded 4 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
My point was that X11 is insecure. Security through obscurity is not security. Wayland does not send every keypress to every application, which protects against this attack vector. Wayland is both significantly smaller and more secure than X11. X11 was designed in a time when software was built to simply trust anything that runs on the computer. We need to move past just putting our trust in the software we run. At the very least raise the barrier to perform such an attack.
Do you sandbox each and every process? Do you whitelist everything each process can do? Every file it can access, every which way it can use the network, every bit of CPU and RAM and hardware resource it can use?
If you don't do that, why do you want to impose upon me a complete block of inter-window communication, which I use for desktop automation, and which has basically zero security impact in the wild?
I don't mind Wayland having security features, but why are they so heavy-handed and non-optional? Things like firewalls, AppArmor, cgroups, they're all customizable. Why is Wayland all or nothing?
The reason I mentioned keyloggers is because it allows an attacker to perform privilege escalation by recording your sudo/root password and automating an attack. I searched it up and I do see automation tools for Wayland, maybe they aren't as developed as those for X11. For you, your usecase makes sense, though i (personally) wouldnt take that risk. The majority of users do not use such tools and should probably use Wayland.
So does putting a script called
sudo
in your PATH.Keylogging is one of the lamest, most inefficient methods of attack. If you can run code on someone's machine there are so many other things you can do.
The fact Wayland has wasted so much time and complicated things so much focusing on a non-issue is mind-blowing.
Don't worry, this is not the only thing holding back Wayland adoption.