Wine 9.0-rc3 Released With 35 Fixes In Total, Some Wayland Driver Fixes

[cj.wijtmans]

Tbh an app is not a window manager. An app having absolute window positioning is a security risk.

[Lycanthropist]

Tbh an app is not a window manager. An app having absolute window positioning is a security risk.

How is that a security risk? What confident information can be acquired from absolutely positioning a window on the screen?

[cj.wijtmans]

How is that a security risk? What confident information can be acquired from absolutely positioning a window on the screen?

It could pretend to be a different window that it is not and capture user interactivity, a password for example.

[MrCooper]

I'm hoping they let us enable the Wayland driver soon. [...], I'd love to test it out.

It's easy:

1. Run

   wine regedit

2. Set the key

   HKEY_CURRENT_USER\Software\Wine\Drivers

   to "x11,wayland"
3. Run Wine apps with empty or unset $DISPLAY, e.g.

   DISPLAY= wine notepad

If $DISPLAY is set, Wine will use the x11 driver by default.

[Lycanthropist]

It could pretend to be a different window that it is not and capture user interactivity, a password for example.

Highly improbable. That would need a malicious program that runs locally on your machine and in that case there are much easier ways to extract confident information from your computer.

[cj.wijtmans]

Highly improbable. That would need a malicious program that runs locally on your machine and in that case there are much easier ways to extract confident information from your computer.

linux is more vulnerable than you think. And its not just about your computer sitting at home its about corporate/political work laptops that could compromised.

[smitty3268]

Highly improbable. That would need a malicious program that runs locally on your machine and in that case there are much easier ways to extract confident information from your computer.

Unlikely sure, but most security these days is built on having multiple layers of protection, forcing attackers to chain multiple different vulnerabilities together. Generally speaking a lot of those layers could arguably be considered unnecessary, but it's the combination of all of them that makes attacks more difficult.

Sometimes the downsides aren't worth the extra security. That's always a judgement call that has to be made, and I think different people can reasonably have different opinions about how useful controlling absolute positioning can be.