X.Org Server Hit By New Local Privilege Escalation Vulnerability

[Sergey Podobry]

There are ways to bypass this in C++ https://www.fluentcpp.com/2019/01/22...in-modern-cpp/. Even with the new safety features that C++ has, there is no comparison to Rust.

There are ways to bypass it in Rust too. I'm just advocating against blaming C++ when a memory issue is found in C code. There is no C/C++.

[castlefox]

I would love to see a Phoronix poll showing how many people are using X.org Vs Wayland/Weston.

[justin_webb]

All this talk about Rust misses the point entirely, which is that the entire concept of "privilege escalation" is a leftist conspiracy to hand over the root of our systems to Lennart Poettering and his followers of hackers on estradiol through concepts like "rootless Xorg" and "seats". Just look at the growth of search interest for this buzzterm over the past 5 years, you can't convince me this is natural:

piq0yi.png

Back in my day we would simply run everything as administrator because we were the administrator, and things just worked. To this day, the very first thing I, and any serious Ubuntu user tries when something doesn't work, is to prefix it with "sudo". It's a basic system administration skill that is taught in most quality post-secondary Linux education institutions. I believe RedHat actually offers a certificate for it.

I think we should stop trying to separate privileges and start to accept responsibility for the software we choose to run.

[ryao]

Your stating that re-writing software makes it more buggy as an axiom when its an assumption. I have done entire codebase rewrites on non trivial software (10k+ LOC minimum) and the new software hasn't been noticeably buggier than the previous version. There may have been new bugs in the rewrite, but the rewrite itself may have also revealed bugs in the old version (then you have a discussion if the bug is a feature or not).

10,000 lines is rather small. It is common for such things written by a single developer to have a low bug count, since it is still small enough for a single developer to understand all of it. Get to 100,000 lines and things start to change.

And when specifically talking about Rust rewrites of equivalent code, there is actually opposite evidence (i.e. the rewrite has less bugs and less security issues), for example when Firefox rewrote their CSS render from C++ to Rust (which also did more than the C++ equivalent, i.e. Rust version was multicore) see https://hacks.mozilla.org/2019/02/re...onent-in-rust/. I am not saying that this is conclusive proof that a Rust rewrite will never have more bugs, but all of the current evidence does show that to a degree.

The Project Quantum code had been in development for 5 years as part of the Servo project. Mozilla started project quantum to port the parts that had already matured to Firefox. That means Mozilla was adopting already mature code, rather than putting in freshly rewritten code. A similar thing happened when Sun Microsystems adopted ZFS in Solaris. They put time into it to bring it to a certain level of maturity before subjecting end users to it. That is a very rare thing in the industry.

[MorrisS.]

There are ways to bypass it in Rust too. I'm just advocating against blaming C++ when a memory issue is found in C code. There is no C/C++.

Just the users adopting Fedora or Ubuntu excluding the Nvidia users. Since the other users are forced to Xorg because of hardware limitations or operating systems are not Wayland compliant.
I believe that Wayland will not be well integrated until Vulkan is not the default render of every graphical desktop environment in Linux oses, The coexistence of two graphical stack or even three ones has hugely increased the complexity and the development work to do. Currently linux operating systems involve Xorg, XWayland and Wayland together. In my opinion that's crazy.

Another matter: how many compositors deal with Wayland? I understand the benefit of flexibility but so many projects that increase the fragmentation.

https://www.slant.co/topics/11023/~wayland-compositors

[kiffmet]

Ahh, seems like I got some backporting to do. My current travel laptop still runs xorg 1.20.14, because I need to maintain compatibility with the Nvidia-340.108 driver. It rocks a Core2Duo @2.53 Ghz, 8GB RAM, a 120GB SSD, the "mighty" GeForce 9400M and a new battery. Since I'm using Gentoo, it's still suprisingly usable. Opening LibreOffice takes 2 seconds and Chromium lets me scroll through websites without lag most of the time, aswell as accelerate video playback.

It's enough for some typing, shitposting on Reddit and Phoronix, Zoom, aswell as other light office work. Don't tell anyone about this herecy, but I have many applications installed as a flatpak to keep updating times shorter and I use systemd. Last full system update with distcc (helper PC uses a 5900X) took 8 hours, as the laptop can't distribute enough concurrent jobs xD.

[Damnshock]

New code tends to be less secure than mature code, so replacing it is a recipe for more security issues.

Please show us data to back up that claim.

[You-]

I agree X.org should be replaced but not until it reaches feature parity with X.org. Last I recall color management was just introduced about 3-4 months ago with Weston 11.0 and still has a long way before it becomes stable for production use for content creators or researchers.

X11 does not have color management, so adding it to Wayland is not feature parity - it is going above and beyond what X11 can do. Once it is implemented and figures out in wayland someone might backport it to x11, but again its not about feature parity.

https://gitlab.freedesktop.org/wayland/wayland-protocols/-/merge_requests/103

Same here, this feature is not available in x11.

[WannaBeOCer]

X11 does not have color management, so adding it to Wayland is not feature parity - it is going above and beyond what X11 can do. Once it is implemented and figures out in wayland someone might backport it to x11, but again its not about feature parity.



Same here, this feature is not available in x11.

There are X11 extensions that work perfectly on X11 while Wayland currently doesn’t. When the protocols are implemented yes it will be better but not currently.

[cooperate]

It would be irresponsible not to fix something many people use. People aren't simply going to stop using X11 because it is insecure. Hardly anyone on the planet has time to care for software security. just look at how entire countries are using unpatched old copies of Windows 10.
People don't simply interrupt their workflows to adopt more secure technologies. If it weren't for older computers having obsolete hardware or simply getting damaged, half the planet would still be using Windows XP today.

Be responsible and fix it yourself then because most don’t care about X anymore.