X.Org Server & XWayland Updated Due To Two Decade-Old Security Vulnerabilities

[spicfoo]

Not being an academic paper doesn't stop anyone from writing in proper English. It's a basic form of respect for the reader and for the language (and I'm saying that as someone for whom English isn't even a native language).

Sure, if someone wants to stick to the actual topic and point out a language issue along the way politely, go for it but if all you are doing is mocking someone for say not being a native speaker, you are just an obnoxious person. There is a difference.

[jacob]

Sure, if someone wants to stick to the actual topic and point out a language issue along the way politely, go for it but if all you are doing is mocking someone for say not being a native speaker, you are just an obnoxious person. There is a difference.

Like I said: I'm not a native speaker but I try to make an effort. If I can, so can others.

[indepe]

Xwayland is indeed a sort of the Xorg server only it has Wayland underneath when the real Xorg uses KMS/libinput.

Most, if not all, Wayland compositors use both KMS and libinput (also for the native side). These two are not the point of discussion. KMS is part of the Linux kernel.

[kylew77]

Unfortunately it does allow remote code execution if there is another way to escalate privileges on your system you are just as vulnerable.

Huh! That is not the way I read the article but good to know. Will run syspatch on my laptop asap!

[kylew77]

I believe that gdm can run Xorg rootless on Gnome, and I know from experience that by removing the rest of the display managers (lightdm, sddm, slim, etc) that Xorg can run rootless if starting the graphical session with startx or with a terminal session manager. I'm no expert on display managers, other than how to remove them, but it seems to me that distros should be working toward all desktop and window manager logins running Xorg rootless.

I 100% agree! Yeah I think it is the login manager / display manager that is keeping some from running in rootless mode. I personally don't feel like Wayland is there across all distros and especially not unix-like OSes so fixing up Xorg for now is a good idea.

[spicfoo]

Like I said: I'm not a native speaker but I try to make an effort. If I can, so can others.

I am willing to make the effort but not if anyone is mocking me for it like OP was. They can go take a hike.

[andyprough]

However, for Xorg, unlike other projects of comparable complexity, like the kernel, GCC etc., there isn't an army of people who are both capable of, and willing to do it. You could probably count the number of people worldwide who really understand the Xorg internals, and the actual design and performance requirements of modern graphics hardware, on your fingers. And those precious few are saying it has become too much of a burden.

And yet, they don't have a choice. No distro is going to push Wayland on its users unless Xwayland is also working because of the massive amount of software that hasn't been ported to run natively on Wayland. Xwayland is not going to work unless someone ensures Xorg is working. And any maintenance of Xwayland is going to benefit Xorg. Whoever wants to push Wayland is going to have the unenviable task of ensuring Xorg is maintained to some degree for many many years into the future.

Unless we all want to get off our collective asses and push one unified Wayland compositor that can work globally. But clearly that's not happening

[indepe]

Any security updates to the Xwayland subset of Xorg would, by their very nature, have to also be security updates for the larger Xorg. Correct? So for as long as Xwayland is needed Xorg will have to be receiving security updates. And it's not just us desktop GNU/Linux users that are the blockade for dropping support for Xorg - big business and governments will probably be running legacy software for who knows how long? The next 30 years? 50 years? More?

However on the other side many applications will be Wayland only. New ones from the start and old ones that get converted, for example because they us toolkits like QT and GTK or Java). So the way to support both will be Wayland with Xwayland, With Xwayland soon going into a backwards-compatibility support mode.

[spicfoo]

And yet, they don't have a choice. No distro is going to push Wayland on its users unless Xwayland is also working because of the massive amount of software that hasn't been ported to run natively on Wayland. Xwayland is not going to work unless someone ensures Xorg is working

XWayland reuses some code from Xorg for compatibility with legacy applications but when people refer to Xorg they are typically talking about Xorg server. You certainly don't need to maintain Xorg server and all the related pieces to continue working on XWayland, especially since it's divergent over time as Xorg server releases have stopped. What one can do if they really care about Xorg server is take a look at LTS releases including RHEL 9 and backport security fixes from their work on Xorg versions they continue to support which should last for quite a few years still. Noone so far has stepped up to even do that however.

[jacob]

And yet, they don't have a choice. No distro is going to push Wayland on its users unless Xwayland is also working because of the massive amount of software that hasn't been ported to run natively on Wayland. Xwayland is not going to work unless someone ensures Xorg is working. And any maintenance of Xwayland is going to benefit Xorg. Whoever wants to push Wayland is going to have the unenviable task of ensuring Xorg is maintained to some degree for many many years into the future.

Unless we all want to get off our collective asses and push one unified Wayland compositor that can work globally. But clearly that's not happening

That they "don't have a choice" sounds like an extreme form of entitlement. They are the only ones who have a choice as to what they want to fund or do. Fedora and Ubuntu have been "pushing Wayland on their users" for some time now and RHEL10 will be Wayland only. In fact, 75% of all Xorg development in recent years has been done and funded by RedHat. But RedHat is pulling out, so unless someone else is willing to do the hard work and put money on the table, then it's the end of the road for Xorg. Because the truth is that RedHat nor basically anyone else has any reason or duty to keep Xorg alive purely to make dwm users happy.