X.Org's Latest Security Woes Are Bugs In LibX11, Xserver

[Alexmitter]

Unfortunately, until Cinnamon converts, I'm sticking with X.

As Cinnamon is just a Gnome Shell with some baked in extensions and a few tweaks, it would be enough to rebase to a more modern Gnome Shell version or just use Gnome with extensions that provide exactly the same.

[Vistaus]

I agree. The architecture of the Xserver is extremely difficult to secure. Move to a modern design -- Wayland.

Xserver is a great piece of work and I have used it for decades. But it comes from a period in time when we didn't have hostile actors continuously trying to locate the tiniest security flaws and exploit them. Wayland greatly reduces the size of the attack surface making it far easier to secure.

You're absolutely right. Modern designs are 100% immune to security woes... oh wait.

[Vistaus]

X11/Xorg are products of an ended era. As much as I love them, time has come to let them go and move to Wayland.

And if security woes were found in Wayland, would you say the exact same?

[skeevy420]

I think all the shells in the world. Past and present contain less lines of code than a single Wayland compositor.

PLUS: The audit would be trivial because, we already know that all but ${THE_ONE_I_USE} are full of errors </troll>

Well you would have passed the audit but you picked Oh My Zsh instead of Antigen

[kpedersen]

Zsh, bash, fish, csh, tcsh, ksh? That fragmentation will make it very hard to audit

I think all the shells in the world. Past and present contain less lines of code than a single Wayland compositor.

PLUS: The audit would be trivial because, we already know that all but ${THE_ONE_I_USE} are full of errors </troll>

[skeevy420]

That doesn't help me at all

And yes, you can tell KDE is not exactly in good shape when you see on the login screen: "Plasma Desktop (Wayland) (Wayland)" (sic!) Doesn't leave much hope for what comes after.

You using Ubuntu? Because with Neon installed on Ubuntu 20.04 my entries include "Plasma (Wayland) (Wayland)" and "Ubuntu on Wayland (Wayland)". It's making me wonder if either SLIM or Ubuntu tacks on (Wayland) to Wayland sessions.

[bug77]

Wayland is just a protocol so it is beyond the scope of it to have "security issues".

A protocol can have security issues, no problem. SSL rings a bell? WEP?

[skeevy420]

Wayland is just a protocol so it is beyond the scope of it to have "security issues". However all the many compositors containing independent implementations of a number of underlying systems that were traditionally provided by a single entity (Xserver) will likely contain issues. This fragmentation will also make it very hard to audit.

In summary, educate people and move back to the command line!

Zsh, bash, fish, csh, tcsh, ksh? That fragmentation will make it very hard to audit

[bug77]

KDE is quite behind, but Gnome works fine with Wayland.

That doesn't help me at all

And yes, you can tell KDE is not exactly in good shape when you see on the login screen: "Plasma Desktop (Wayland) (Wayland)" (sic!) Doesn't leave much hope for what comes after.

[skeevy420]

KDE is quite behind, but Gnome works fine with Wayland.

That resembles my experiences.