X.Org Server & XWayland Updated Due To Two Decade-Old Security Vulnerabilities

[ssokolow]

yes this is a sane solution.

but flatpak can not replace appimage because flatpak has no shell script support... the sandbox modell cripple the shell script funtionality.

Container, not sandbox. Flatpak uses a Steam Runtime-esque solution to ensure "tested on the dev's machine means will work on whatever distro you're on". It's the mandatory mounting of the chosen Flatpak runtime at /usr which complicates CLI use.

...and you can still use it for CLI stuff. They mainly don't want to be responsible for solving the naming collision problem well enough to make it official. Take a look at this utility I wrote: https://gist.github.com/ssokolow/db5...ada946adb81f68

...and OSTree can do the CLI stuff. That's what things like Fedora Silverblue use. Flatpak is a wrapper to implement distro-agnostic, containerized GUI applications on top of OSTree.

[spicfoo]

Fine. If you want to sound like an idiot, I won't stop you. Carry on.

If you want to continue sounding a failed miserable middle school English teacher, nobody can stop you. Carry on you obnoxious fella

[qarium]

Actually, to be honest, I tend to see the bug as being "Oops. I forgot to toggle compositing back off after restarting the system."
I generally run with compositing disabled because it improves system stability and helps me to achieve the multi-month desktop sessions I prioritize.

its sad to hear this. in 2023 disable compositing should not result in a more stable system.

if this is the case we of course really do something wrong.

can you tell me what kind of harfware you use ?

all the people in this X11 security Topic should be aware that right now there is a bigger threat:

LogoFail:

maximum credible accident of closed source BIOS/UEFI

https://youtu.be/HgF--i8x9go?si=72wOstKrvsRVXIQl

https://arstechnica.com/security/2023/12/just-about-every-windows-and-linux-device-vulnerable-to-new-logofail-firmware-attack/

https://youtu.be/EufeOPe6eqk?si=pUpZ3zX3nncB1G84

https://9443417.fs1.hubspotusercontent-na1.net/hubfs/9443417/Security%20Advisories/AMI-SA-2023009.pdf

https://www.ami.com/security-center/

https://www.supermicro.com/en/support/security_BIOS_Dec_2023/

https://binarly.io/posts/The_Far_Reaching_Consequences_of_LogoFAIL/index.html

https://binarly.io/posts/finding_logofail_the_dangers_of_image_parsing_duri ng_system_boot/

https://i.blackhat.com/EU-23/Presentations/EU-23-Pagani-LogoFAIL-Security-Implications-of-Image_REV2.pdf

it looks like the people who attacked me over a link places in the phoronix.com forum used the LogoFail: UEFI SecureBoot hack to even survive delete and formating my SSD by infect the Boot logo of my mainboard.

https://nvd.nist.gov/vuln/detail/CVE-2023-39538

https://nvd.nist.gov/vuln/detail/CVE-2023-39539

\EFI\OEM\Logo.jpg

people should demand BIOS/UEFI security update what makes sure the logo of the uefi boot can nolonger be changed by the operating system in the \EFI\OEM\ directory and \EFI\OEM\Logo.jpg file.

[Panix]

If you want to continue sounding a failed miserable middle school English teacher, nobody can stop you. Carry on you obnoxious fella

Nice try. You're the only one here who appeared to fail English, though.

[spicfoo]

Nice try. You're the only one here who appeared to fail English, though.

Nobody failed here except you in not being miserable.

[ssokolow]

its sad to hear this. in 2023 disable compositing should not result in a more stable system.

My system is pretty stable with compositing enabled... historically, for the first week or two at least. These days, maybe the first month.

This sort of stuff just isn't tested with having a desktop session left logged in for months on end and KWin eventually starts to either glitch out or crash when compositing is enabled, but I've never seen a compositing window manager that didn't start to do that eventually, so I don't know whether the bug is in the compositor, the drivers, both, or something else they interact with.

Hell, I've reported bugs in various projects (eg. Firefox) because they'd never tested that their support for things like copy-paste and drag-and-drop would handle "at millisecond precision, 32-bits is only 50 days in X11 message timestamps" wrap-around correctly.

can you tell me what kind of harfware you use ?

Until a few weeks ago? An nVidia GeForce GTX750 1GiB from 2014, running the binary drivers on top of an AMD Athlon II X2 270 from 2011.

Now? Same system, and same driver, but an nVidia GeForce RTX 3060 12GiB that I bought during cyber monday deals to do CUDA things better.

(Yeah. I'm running X11 and will probably ride Kubuntu LTS and then maybe Debian stable as long as possible to give KDE's crash recovery patches time to get merged into everything, then look into running a stack like "rootful XWayland on top of cage" or "rootful XWayland on top of weston kiosk-mode" to continue running X11 so my Barrier-based solution for software KVMing together my regular PC, my laptop, and my Windows 7 gaming rig (downgraded from the Win10 the previous owner had upgraded to) continues to work... it'll also give me time to find a Wayland compositor that supports running in rootless mode on an X11 backend so any Wayland-only applications will be usable under my X11 life-support stack. The only other way I can think of possibly keeping Win7-compatible Barrier-style KVMing working with Wayland's security model would be to go over the compositor's head and write a version of Barrier that runs as some kind of Wayland compositor hypervisor... which still wouldn't keep the shared clipboard functionality working.)

[qarium]

My system is pretty stable with compositing enabled... historically, for the first week or two at least. These days, maybe the first month.
This sort of stuff just isn't tested with having a desktop session left logged in for months on end and KWin eventually starts to either glitch out or crash when compositing is enabled, but I've never seen a compositing window manager that didn't start to do that eventually, so I don't know whether the bug is in the compositor, the drivers, both, or something else they interact with.
Hell, I've reported bugs in various projects (eg. Firefox) because they'd never tested that their support for things like copy-paste and drag-and-drop would handle "at millisecond precision, 32-bits is only 50 days in X11 message timestamps" wrap-around correctly.
Until a few weeks ago? An nVidia GeForce GTX750 1GiB from 2014, running the binary drivers on top of an AMD Athlon II X2 270 from 2011.
Now? Same system, and same driver, but an nVidia GeForce RTX 3060 12GiB that I bought during cyber monday deals to do CUDA things better.
(Yeah. I'm running X11 and will probably ride Kubuntu LTS and then maybe Debian stable as long as possible to give KDE's crash recovery patches time to get merged into everything, then look into running a stack like "rootful XWayland on top of cage" or "rootful XWayland on top of weston kiosk-mode" to continue running X11 so my Barrier-based solution for software KVMing together my regular PC, my laptop, and my Windows 7 gaming rig (downgraded from the Win10 the previous owner had upgraded to) continues to work... it'll also give me time to find a Wayland compositor that supports running in rootless mode on an X11 backend so any Wayland-only applications will be usable under my X11 life-support stack. The only other way I can think of possibly keeping Win7-compatible Barrier-style KVMing working with Wayland's security model would be to go over the compositor's head and write a version of Barrier that runs as some kind of Wayland compositor hypervisor... which still wouldn't keep the shared clipboard functionality working.)

i don't get it why many people want to keep x11 as long as possible.

i think as you already say the XWayland's Rootful Mode

will make it possible to run entire X11 environment on top of Wayland.

thats way the Wayland-only apps could run on Wayland as intended.

about the crashes i can not see any possibility that these crashes EVER become better with x11,,, because X11 is end of life.

[SophTherapy]

Or 'bugs' introduced on the order of the Russian government .

Hello everybody,

I would like to apologize for my posts under nickname "sophisticles" and "hel88".

the thing is, I am very sick person. Schizophrenia with manic depression.
When I'm on my medication like now, I feel ashamed for the things that I do when not on medication.

For example, when I'm not using my therapy properly I get this crazy tendency to troll on linux forums. For that devious purpose I am using nicknames "sophisticles" and "hel88". under those nicknames I write crazy, insane things. when I am on regular therapy like now, I cannot believe the crap that I wrote under those 2 nicknames.

overall, I would like all of you to know that I don't really mean what I write under those 2 nicknames and also, I love linux, open source and gpl. and yes, microsoft sucks.