Trend Micro Uncovers Yet Another X.Org Server Vulnerability: CVE-2023-1393

[Quackdoc]

Waypipe from what I have found is about equal with X11 forwarding.

interesting, I myself have found greater issues with it then x, guess I can keep trying and comparing

[neoe]

Are there vulnerabilities in software written with Rust?

---
The distance between us and vulnerabilities is just some digging. So if there is no security company, we will not get to vulnerabilities.
If there is a business model that hires security engineers and found all such vulnerabilities, if they can do bad hacking and get caught by the cops. the business dies and there are no vulnerabilities anymore.
Just like we got big hit by virus when the anti-virus company was rising, and anti-virus company make less money and we got less virus. also thanks to the "individual" virus maker caught by the police.

[Quackdoc]

Are there vulnerabilities in software written with Rust?

yes. rust doesnt make safe code, it makes it easier to make safer code

[Ironmask]

Are there vulnerabilities in software written with Rust?

While Rust does mitigate some race conditions, they can still happen and are still a major source of bugs, even if it's far less bad as it is in other languages.
Overflow also isn't checked in release builds (debug builds panic when an integer overflows), but I don't know if that's (yet) caused any vulnerabilities.

[piotrj3]

Are there vulnerabilities in software written with Rust?

---
The distance between us and vulnerabilities is just some digging. So if there is no security company, we will not get to vulnerabilities.
If there is a business model that hires security engineers and found all such vulnerabilities, if they can do bad hacking and get caught by the cops. the business dies and there are no vulnerabilities anymore.
Just like we got big hit by virus when the anti-virus company was rising, and anti-virus company make less money and we got less virus. also thanks to the "individual" virus maker caught by the police.

Rust doesn't prevent all types of bugs, but if you don't use unsafe it is supposed to be always memory safe and Rust has some tools that prevents other kind of bugs (every variable is initialized, you have great match statement that forces that needs to be coded for all cases. Generally safest language would be probably Spark (if you use all built-in validators) as that one enforces that every single possible execution is defined and every single possible execution has written tests so in to make unsafe Spark you would have to deliberately write a test that has same kind of logical error.

[Paradigm Shifter]

I realise it's probably an XQuartz issue, rather than X11 directly, but I've taken to running up a lightweight Linux VM on my work M1 when I need GUI access to our systems because I'm sick of X forwarding breaking at random times with XQuartz. It'll happily open windows, then suddenly, "nope, can't do that". No issues in the VM.

[mSparks]

There's a pretty fundamental question playing out here in ways that show what makes linux so damn awesome.

Is the solution to display server problems to just try and rewrite it all from the ground up.

Or fix up decades of R&D that covers pretty much every imaginable use case and more.

No one knows the answer, so lets all jump in camps and try both.

Now, I somewhat balk at the sweeping criticisms of X11/Xorg. It was highly engineered back in the days when computer engineering was infinately more than a two week javascript course, a lot of Wayland proponents seem to be willfully ignorant of the complexity and demands of making a viable display server, and blame shift problems rather than meet them head on.

Thats just me pointing out there is a diverse and growing audience here, all of which just want a display server that doesnt fall off the bus at the slightest sign of a host application behaving badly.

Wonder how many stumbling in here are even aware that X11 is just a network protocol like TCP/IP or UDP, and that Wayland isn't and can therefore never actually replace it any more than an HDMI cable can replace your network card.

[Ironmask]

There's a pretty fundamental question playing out here in ways that show what makes linux so damn awesome.

Is the solution to display server problems to just try and rewrite it all from the ground up.

Or fix up decades of R&D that covers pretty much every imaginable use case and more.

No one knows the answer, so lets all jump in camps and try both.

Now, I somewhat balk at the sweeping criticisms of X11/Xorg. It was highly engineered back in the days when computer engineering was infinately more than a two week javascript course, a lot of Wayland proponents seem to be willfully ignorant of the complexity and demands of making a viable display server, and blame shift problems rather than meet them head on.

Thats just me pointing out there is a diverse and growing audience here, all of which just want a display server that doesnt fall off the bus at the slightest sign of a host application behaving badly.

Wonder how many stumbling in here are even aware that X11 is just a network protocol like TCP/IP or UDP, and that Wayland isn't and can therefore never actually replace it any more than an HDMI cable can replace your network card.

X11 is the protocol, Xorg is the implementation.
Much like Wayland is the protocol, and GNOEM or KDE is the implementation.
Everyone knows this. It's a common criticism that the transition is basically turning GNOME into the next Xorg (which is mostly due to GNOME's custom Wayland extensions that Wayland itself hasn't implemented yet and a lot of software is forced to depend on).

And it's not like the answer "isn't known", Xorg is unmaintainable, it's all but dead save for what few patches they can still feasibly implement. Some people don't seem to understand the gravity of this situation, Xorg is stagnant in an ever-changing world, especially the graphics world which is especially volatile. Can governments and banks get away with using 70 year old software to move money around? Yeah, usually, as long as nobody wants to acknowledge UTF-8. Can a display server stick around unchanged for the next couple decades? That's a laughable concept, don't even pretend that's going to be feasible.
I find it depressing there are people who try to please both sides of this issue. Are there insane people who want to use Xorg forever? Yeah, and they're insane, and that's fine. But if you're trying to say both sides are right, you're down-right misinformed. Xorg is deprecated, officially. We have to move to Wayland, because nobody is even capable of maintaining Xorg anymore. It's literally no longer possible to keep using it, even if the alternative is lacking. We're on a sinking ship and have no choice but to use the lifeboats.

[mSparks]

X11 is the protocol, Xorg is the implementation.
Much like Wayland is the protocol, and GNOEM or KDE is the implementation.
Everyone knows this. It's a common criticism that the transition is basically turning GNOME into the next Xorg (which is mostly due to GNOME's custom Wayland extensions that Wayland itself hasn't implemented yet and a lot of software is forced to depend on).

And it's not like the answer "isn't known", Xorg is unmaintainable, it's all but dead save for what few patches they can still feasibly implement. Some people don't seem to understand the gravity of this situation, Xorg is stagnant in an ever-changing world, especially the graphics world which is especially volatile. Can governments and banks get away with using 70 year old software to move money around? Yeah, usually, as long as nobody wants to acknowledge UTF-8. Can a display server stick around unchanged for the next couple decades? That's a laughable concept, don't even pretend that's going to be feasible.
I find it depressing there are people who try to please both sides of this issue. Are there insane people who want to use Xorg forever? Yeah, and they're insane, and that's fine. But if you're trying to say both sides are right, you're down-right misinformed. Xorg is deprecated, officially. We have to move to Wayland, because nobody is even capable of maintaining Xorg anymore. It's literally no longer possible to keep using it, even if the alternative is lacking. We're on a sinking ship and have no choice but to use the lifeboats.

Meanwhile, in the real world

Wayland is a protocol for a compositor to talk to its clients as well as a C library implementation of that protocol. The compositor can be a standalone display server running on Linux kernel modesetting and evdev input devices, an X application, or a Wayland client itself. The clients can be traditional applications, X servers (rootless or fullscreen) or other display servers.

Source

https://wayland.freedesktop.org/docs/html/

X11 is a network protocol that hasnt needed to be changed since the 80s
Source

https://x.org/wiki/Documentation/

And no, X11 toolkits like GTK and Qt are most definately not unmaintianable, depreciated or dead, neither is the xorg x server.

[oiaohm]

Wonder how many stumbling in here are even aware that X11 is just a network protocol like TCP/IP or UDP, and that Wayland isn't and can therefore never actually replace it any more than an HDMI cable can replace your network card.

Except X11 is not just a network protocol. X11 protocol standard is a mix of local and network protocols to the point for a majority of X11 applications its no longer function over the TCP/IP network connection of X11 because they use some part of the X11 protocol that is local only.

The first version of the X11 protocol contained local and network parts and it progressively got worse.

Now, I somewhat balk at the sweeping criticisms of X11/Xorg. It was highly engineered back in the days when computer engineering was infinately more than a two week javascript course, a lot of Wayland proponents seem to be willfully ignorant of the complexity and demands of making a viable display server, and blame shift problems rather than meet them head on.

Try again. X11 protocol was developed fairly much by we design something we deploy it if it uses we keep it. From 1998-2000 over half of what made up the X11 protocol prior to that was deleted from the protocol standard. The X11 protocol implemented in x.org X11 today is in fact a very small subset of the X11 protocol over history.

X11 protocol had a print server, sound server(that was so bad it only was in one version of the X11 protocol).... I can go on and on with parts that X11 protocol use to have that basically no longer exist. The idea that X11 protocol was highly engineered back then is not true. X11 at one point had paid people do document what individuals had implemented and basically thrown against the wall.

Thats just me pointing out there is a diverse and growing audience here, all of which just want a display server that doesnt fall off the bus at the slightest sign of a host application behaving badly.

X11 x.org server does not give you that. kwin wayland is getting very close to providing that.

xpra is what you have to use with X11 so that X11 server can fail and application can reconnect.

Windows dwm restarts and applications don't notice and kde kwin wayland implementation is following the same route.

Wayland current day development model very much matches early X11 development.