AMD Radeon Linux Gaming Performance At Parity Between KDE Plasma 6.0 X11 vs. Wayland

[mSparks]

I wonder why this would even need to be said.

Everyone who has a basic understanding of unix domain socket knows that it its file permissions can be changed.

If the owning group has file access permissions any member of that group can connect to it.
If it has world file access permissions any user's process can connect to it.

Because some people seem to think giving an application group permissions (wayland) is better security than limiting an application to a user with no other permissions (X11/Xauthority), and are additionally not distinguishing between the two when it suites their narrative.

[anda_skoa]

Because some people seem to think giving an application group permissions (wayland) is better security than limiting an application to a user with no other permissions (X11/Xauthority), and are additionally not distinguishing between the two when it suites their narrative.

Security considerations aside, the point was that obviously one can allow other users to connect to one's socket, whether that is being use for Wayland or something else.

Xorg creates it socket work accessible which makes it slightly more convenient but nevertheless the same underlying permission model applies to any other socket

[mSparks]

Security considerations aside, the point was that obviously one can allow other users to connect to one's socket, whether that is being use for Wayland or something else.

Xorg creates it socket work accessible which makes it slightly more convenient but nevertheless the same underlying permission model applies to any other socket

The point is wayland is not "multi user".
giving an application group permissions so it can access pretty much anything from all the other users does not make it multi user.

presumably that's why waydroid had to opt for running as root to provide its "multi user" functionality.....

I personally don't want any part of that nonsense anymore, and I cannot recommend any one else does either -> uninstall wayland asap, even for, if not especially for games: "at parity performance" simply isn't worth the risks.

[oiaohm]

Security considerations aside, the point was that obviously one can allow other users to connect to one's socket, whether that is being use for Wayland or something else.

Xorg creates it socket work accessible which makes it slightly more convenient but nevertheless the same underlying permission model applies to any other socket

https://marc.info/?l=best-of-security&m=96843699420401&w=2

As noted Section 8 It takes exactly 131072 iterations break "X11/Xauthority" by pure brute force without any other defect to help.

Little note mSparks will keep on attempting to pull you back to security with bogus. X11/Xauthority is this in fact brute force-able and it not security. He just presented another lie. Xauthority is the old school security by obscurity. Using the OS permission system instead is not security by obscurity so is not open to brute forcing.

X11 Xauthority is done on a per user base. The socket access granularity is using stock dac/acl permissions is per user base(that X11 by default does not take advantage of). LSM the socket access granularity comes down to per application.

Yes the stuff that cannot be brute forced is your OS provided security system. To set particular LSM permissions on the wayland socket you will need root access to be able to set them.

anda_skoa by the way he has played this same argument against me in another thread right down the waydroid bit. At this point msparks is a broken record of lies.

Yes as noticed in the above posts in 1995 the flaw in Xauthority was found it is still there. and bare metal X11 for local has not changed over to using the unable to brute force host OS controlled permissions.

Wayland in reality has just not reinvented a broken decorative wheel hub instead depends on the functional wheel.(yes there joke here)

The sad part is there are true flaws that Wayland has that he could be talking about instead of these fake issues.

[mSparks]

https://marc.info/?l=best-of-security&m=96843699420401&w=2

Little note mSparks will keep on attempting to pull you back to security with bogus. X11/Xauthority is this in fact brute force-able and it not security. He just presented another lie. Xauthority is the old school security by obscurity. Using the OS permission system instead is not security by obscurity so is not open to brute forcing.

X11 Xauthority is done on a per user base. The socket access granularity is using stock dac/acl permissions is per user base(that X11 by default does not take advantage of). LSM the socket access granularity comes down to per application.

Yes the stuff that cannot be brute forced is your OS provided security system. To set particular LSM permissions on the wayland socket you will need root access to be able to set them.

anda_skoa by the way he has played this same argument against me in another thread right down the waydroid bit. At this point msparks is a broken record of lies.

Yes as noticed in the above posts in 1995 the flaw in Xauthority was found it is still there. and bare metal X11 for local has not changed over to using the unable to brute force host OS controlled permissions.

Wayland in reality has just not reinvented a broken decorative wheel hub instead depends on the functional wheel.(yes there joke here)

The sad part is there are true flaws that Wayland has that he could be talking about instead of these fake issues.

you pulling up a 30 year old fixed flaw as a reason to switch from multi user to single user is going to convince no one.

To be clear, you are as good as claiming security superiority of an ftp server that will only let you connect to it if you consent to send it all the files on your machine that you have permission to read.

That pretty much 100% confirms wayland - and you - are malicious.

your link even says - it was a flaw in rand() not xauthority.

magic cookies are also not used for local user authentication, you expect people to believe you dont know that after a post like that?

Just wow, what a shitshow. It was bad enough when the summary of the current situation was just wayland breaks everything, offers nothing and is only picking up updates from the code it shares with xorg-server.

Turns out the only reason wayland still exists at all is so former clients of Jeffrey Epstein can attempt to keep their Afghan spice trade alive, my bet is on wayland failing just as hard.

[oiaohm]

Deleted Post

Get the point I am never answering your posts again. You did something you should not have and I am not tell you what it was either. Of course again what you wrote is not what is written in the link because you did not read the complete link did you.

[anda_skoa]

The point is wayland is not "multi user".
giving an application group permissions so it can access pretty much anything from all the other users does not make it multi user.

It is as "multi user" as X11, they have just different defaults.
Wayland's socket defaults to access being restricted to the owning users, X11 defaults to world access.

In either case you can decide to replicate the other's default access rights by applying the respective file permissions.

And in both cases one would use a nested display server if the user separation is done for the purpose of sand boxing.

[anda_skoa]

anda_skoa by the way he has played this same argument against me in another thread right down the waydroid bit. At this point msparks is a broken record of lies.

I've been following these exchanges - and had some of my own - and it seem they are deeply entangled in a web of misinformation, misconception and misinterpretation due to lack of fundamental knowledge around the technologies in question.

In their quest to find differences between Wayland and X11 they often arrive at aspects in which the two technologies are actually more similar than different.
Without the actual knowledge on how things work they invent differences instead of extracting the existing ones.

System level technologies are often misunderstood by application developers as they often deal with abstractions.
So normal users are even more likely to arrive at wrong conclusions or misinterpretations of something they've read.

Once their mental model of the world has disconnected too far from reality it becomes increasingly difficult to digest, let alone accept bits of information that contradict their carefully constructed alternate reality.

[mSparks]

It is as "multi user" as X11

not even close

https://en.m.wikipedia.org/wiki/X_Window_authorization

vs

https://en.m.wikipedia.org/wiki/Wayland_authorization

I doubt anyone in camp wayland have even heard of Kerberos let alone built out a deployment of it.
Actually, given what we just learnt, that probably isn't true. Keeping Kerberos out of the hands of J6P is more likely a key incentive for those investing in wayland propaganda.

[oiaohm]

In their quest to find differences between Wayland and X11 they often arrive at aspects in which the two technologies are actually more similar than different.

The case with Wayland lot of core wayland comes straight out of either the X11 protocol or proposed changes to the X11 protocol.

It was proposed by nokia developer (you can guess who) Daniel Stone to change x.org server to a OS permission model for local connections. This was before Wayland existed. So the author of how Wayland socket secruity works wrote it before any of the Wayland protocol itself was written or even the first line of code for wayland was code. The reason why the change was turned down was breaking legacy applications.

Remember in 1995 think I pointed to. 131072 iterations break "X11/Xauthority" that complexity has not increased. From 1995 when that was written to 2005 computers had increased in performance by 40 times. So what use to take 8 hours to crack by then 2005 is 12 mins. So what was not a major threat in 1995 over the years have got worst as cpu power has increased.

What was added to replace the broken and busted "X11/Xauthority" that right xhost, Now you go and read the xhost x.org documentation and there is a serous problem.

https://www.x.org/releases/X11R7.6-RC1/doc/man/man1/xhost.1.xhtml

The xhost program is used to add and delete host names or user names to the list allowed to make connections to the X server. In the case of hosts, this provides a rudimentary form of privacy control and security. It is only sufficient for a workstation (single user) environment, although it does limit the worst abuses. Environments which require more sophisticated measures should implement the user-based mechanism or use the hooks in the protocol for passing other authentication data to the server.

What wrong with x.org X11 xhost. x.org X11 xhost is not setting the Unix permissions on the local socket for the X11 server. Instead query information about the process connecting to the socket so making the attack surface huge resulting in the forbid to use on anything other than a single user machine..

The following is the rabbit hole that mSparks is coming out of and he is horrible not alone.

https://gitlab.gnome.org/GNOME/mutter/-/merge_requests/1790

https://gitlab.gnome.org/GNOME/mutter/-/merge_requests/1790/diffs?commit_id=6b4438672d339e8b9db6e9f9afdda5fcdbf21a2c

The X11 server has its own authentication mechanism, we do not (and
should not) need to rely on UNIX permissions for that, otherwise that
prevents X11 clients from other users from connecting to the Xserver
even though the X11 credentials are valid.

Problem the x.org X11 documentation like the xhost and Xauthority and other security documentation and breaches tell you that the X11 credential system is not secure.

Obey the X11 documentation X11 x.org server should only be used workstation single user. X11 x.org server like it or not secure to be used multi user and recommend against.

Yes the reason why X11 x.org server does use UNIX permissions as it should to protect the socket because doing so breaks legacy applications and a total miss place trust in the X11 credential system.

Would the alteration to mutter be needed if X11 server xhost in fact updated the XWayland sockets permissions to match the X11 credentials the answer is no the mutter alteration would not be need.

Wayland being single user is not the case. X.org X11 server not being coded correctly to integrate with OS is a big problem.

One of the things that is serous-ally against keeping on using X11 is the failure of x.org X11 server with xhost to set the Unix permissions on the socket to match current X11 credentials. Funny enough AIX X11 server xhost does in fact set the Unix permissions on the X11 server socket so this is not something the X11 protocol itself forbids just something the X11 reference implementation x.org chooses not to-do.

This is the stupid part. Wayland design is be multi user secure because it use the host/Unix permissions when it should.

I know exactly what rabbit hole mSparks is coming out of. It comes out of we don't want to use Unix Permissions should to reduced attack surface area we want to trust provable broken X11 permissions(that have only got simple to exploit with years) or solutions like Xhost that leave socket open to everyone on the system to attack when this is absolutely not required by the X11 protocol..

This starts to explain some of the Wayland protocol break away from the X11 protocol. Total lack of will to reduce attack surface area even worse just straight up document attack surface area problems and call it done with x.org X11 reference server.

Lot of ways I would far prefer to be talking about X11 protocol fairly. Don't false claim X11 protocol is more multi user than Wayland because its not. Be truthful that the xhost in x.org X11 reference implementation is absolute broken from a security point of view then hopefully put pressure to get it fixed to match the AIX X11 xhost..

anda_skoa basically one of the major difference is:
1) Wayland protocol demand you use the host permission system so act like a audit when it comes to security.
2) X.org X11 implementation avoids setting UNIX permissions correctly like the plague and walks around with it pants basically around it ankles from the security point of view because it attempting to be a cool kid of a deranged grand father then wondering why he getting broken bones all the time.

There is no technical reason why X.org X11 server with the lot of security issues has to remain this deranged grand father its only got this way because of the incorrect idea that its perfect and stack of half done implementations like xhost being part of x.org X11 reference server.

Lot of cases what appears to be a large difference between X11 and Wayland turn out to be a security fault in x.org X11 server that no one wants to fix. x.org X11 appearing to be more multi user is because it got a defective xhost implementation so the users are not use to having to set what users can and cannot access their X11 server/Unix permissions since you are not doing this the x11 server is only suitable for single user systems and they put that in the documentation..

Sorry for the long post anda_skoa this is the rabbit hole you are dealing with. Due to the fact we have x.org X11 core developers including xwayland ones at time pushing the same stupidity people like mSparks are going to incorrectly believe they are in the right.. Attack surface area and reducing attack surface area are quite simple security concepts these people seam to miss.