X.Org Could Use More Help Improving & Addressing Its Security

[phoronix]

Phoronix: X.Org Could Use More Help Improving & Addressing Its Security

Those reading Phoronix over the years likely know the X.Org Server has had an increasing number of vulnerabilities come to light in recent times and statements by security researchers like the security being even worse than it looks. Given the age of the X.Org/X11 codebase and many components being rather unmaintained these days, the security situation isn't that great combined with a lack of manpower. The security topic was under the spotlight today at the XDC2021 conference...

https://www.phoronix.com/scan.php?page=news_item&px=X.Org-Security-Help-2021

[tildearrow]

The solution would be to abandon X and fix Wayland (it still lacks several things like data query for hotkeys and Synergy).

[iskra32]

The solution would be to abandon X and fix Wayland (it still lacks several things like data query for hotkeys and Synergy).

I agree with the sentiment but keep in mind that X will probably be around forever in the form of XWayland(which is a modified but fully functional X.Org server running over a wayland compositor). And many applications will use it too as some will not be updated.

[szymon_g]

15 years too late

[jonsmirl]

I agree with the sentiment but keep in mind that X will probably be around forever in the form of XWayland(which is a modified but fully functional X.Org server running over a wayland compositor). And many applications will use it too as some will not be updated.

XServer is way more vulnerable than XWayland due to running as root. The largest barrier to Wayland conversion, NVidia, finally appears to be on board. So maybe we will start seeing faster conversion onto native Wayland.

[kpedersen]

XServer is way more vulnerable than XWayland

I assume this is a typo. XWayland is an XServer.

due to running as root.

Xorg doesn't need to run as root.

https://why-openbsd.rocks/fact/xorg/

Linux distros just seem to do that. Except for Hyperbola apparently: https://wiki.hyperbola.info/doku.php...rvers:xenocara)

[Monsterovich]

The solution would be to abandon X and fix Wayland.

Come on. No one asked for Wayland. The majority of distros stick to X because Xorg works even though Wayland exists for 13 years. Xorg may be dirty, but it works fine. Wayland looks like a launcher for GNOME, invented by GNOME fanatics who always go against Unix philosophy with their stupid decisions: CSD and such stuff. Perhaps, Xorg will be replaced eventually, but not by Wayland.

[You-]

... The majority of the distros stick to X ...

Do we have a score card anywhere?

All fedora and Red Hat based distros default to Wayland. Ubuntu has started to default to Wayland since 21.04. I dont know about Debian, OpenSuse, Manjaro, Arch etc.

[kpedersen]

Do we have a score card anywhere?

Hah, you know how scatty open-source is. No chance of a score card. The best I can find is:

https://linux-hardware.org/?view=os_display_server

X11 still has the overwhelming majority. However:

• Wayland on Fedora seems to be doing well: https://linux-hardware.org/?view=os_...erver&d=Fedora

• I would have thought Wayland proportion on Arch would have been higher than Fedora because the distro is more for the enthusiast / hobbyist who like to dabble with technologies that they perceive as new: https://linux-hardware.org/?view=os_..._server&d=Arch

• Finally, on RHEL8, X11 is the clear winner. Out of all 5 RHEL8 computers... 4 of them use X11 : https://linux-hardware.org/?view=os_...ver&rel=rhel-8

[Monsterovich]

All fedora and Red Hat based distros default to Wayland.

I can't believe that the source of all GNU/Linux evil is not using Wayland and GNOME by default.

Ubuntu has started to default to Wayland since 21.04.

Ubuntu is no longer a good distro, which it was years ago before they invented Unity.