Join the discussion
Write your take first — we'll ask for email only when you're ready to publish.
- Hacker News
- Would Fil-C have prevented the first or third?
- By my reading, it would have prevented all of them.by pizlonator
- How did Twitter get away with taking X.com?
If it was the other way around, would an open source or whatever project have been able to take Twitter.org?
by Razengan - It was from x.com in the late 90s, merged with PayPal, Elon took the domain with him.by bastawhiz
- _Roughtly_ speaking, X11 is only there for old games and the steam client. It is even worse with the steam client since the main executable in still 32bits.by sylware
- > _Roughtly_ speaking
_Strictly_ speaking X11 is only there because, after all those years, Wayland still does not meet expectations.
by hulitu - Considering how nicely Weston with SW rendering runs in Fil-C, I bet that the X server will run fine in Fil-C, too.
Fil-C exhibits the lowest overhead in code that spends its time on primitive bits.
Fil-C exhibits the highest overhead in code that chases pointers.
I'm assuming X is the former. Weston seems to be.
by pizlonator - Don't kill xorg! :(by shevy-java
- The main pain in linux is graphics. It's a shame.by ekvintroj
- Our chief pain is graphics... graphics and audio... audio and graphics... our two pains are audio and graphics... and wifi hardware support... Our three pains are audio, graphics, and wifi hardware support, and an almost fanatical devotion to the command line.... Our four... no... Amongst our pains... are such elements as graphics, audio.... I'll come in again.by immibis
- Xorg is indeed a lot of painful complexity. This being said, the software is not Linux specific, and for modern Linux distributions, it is more and more a legacy technology.by goneri
- Graphics is the reason Linux got over 1% desktop market share. When you have a problematic piece of hardware, sure, it sucks. But most setups will run Steam games near native quality out of the box. I'd blame the hardware not Linux.by pluc
- Coverity is pretty good about finding these kinds of bugs. Is there a reason why a project as significant as Xorg isn't taking advantage of their gratis access for that tool?
- I think the short story is that the people who develop Wayland are the people who used to develop Xorg.
And they’d rather spend their energy on giving you a compelling reason to switch, rather than using it to add to the reasons for staying on a project they now consider obsolete.
You may disagree with their assessment, but you can’t blame them for how they decide to prioritize.
by josteink - Good that people are finding and fixing these, but basically allowing any untrusted client to talk to your X server is asking for trouble just by design. (Bonus points if you have any Tcl/Tk apps running, where you can simply transmit commands for the program to run via the X server.)by rwmj
- You do realize that your web browser is executing code feeded by remote servers (RCE). But it is important to fix the windowing system. /sby hulitu
- These are all "no way to prevent this, say users of only language where this regularly happens" type problems though.
The send command in Tk is lel, but can easily be effectively closed by rebinding it to a no-op.
by bitwize - > Bonus points if you have any Tcl/Tk apps running, where you can simply transmit commands for the program to run via the X server.
Back in 1996 the level of X integration in Tk was awesome; I had a shell tool that could make Netscape do stuff by firing MIT magic cookies at it.
In a contemporary setting, it's pretty horrifying.
by exasperaited - Some oldschool legends are still fixing bugs in xorg.
Alan Coopersmith in particular. He even fixed a bug I reported. :)
(I forgot in which app it was but the bug report should be somewhere still; it is not old, perhaps 2 years ago or 3 years ago. The xorg app in question behaved oddly when doing "--version". I only noticed this because I wrote a ruby script that displays which version of programs are installed, and that one kept on making problems, whereas the others worked fine. After I reported it, Alan fixed this very quickly. I think it was some missing flag in the C program or something like that; right now I can not remember the name of the program ... my brain tries to say xrandr but I think it was not xrandr but a less frequently used program somewhere in the FTP listing ...)
by shevy-java - There are plenty of setups where the X server runs at higher privileges/on a different host than the (partially trusted) application that might exploit the X server. This is a classic elevation of privileges vulnerability in those setups.
X11's practical absence of any security mechanisms for user sessions means you should probably not run any kind of low-trust UI program anyway, as there is no prevention of keystroke injection or screen recording, but that's a design flaw that will never be solved. That doesn't mean that EoP style attacks like these should be ignored or underestimated, though.
by jeroenhd - Wonder how these play out against the https://github.com/X11Libre/xserver base, would be interesting to hear from that end as to how these things are handled. My understanding is that they address any sec issues that arise on x.org but it would be fascinating if the issues are already mitigated since XLibre updated their xserver port with 1000s of issues that were never addressed on the x.org side of things.by dingdingdang
- That's the fork where the primary cause was to be "anti-woke", right? Honestly it seemed like it was just because that one guy was a little unbalanced, and he happened to be channeling that energy into an X server fork.by asveikau
- That project is a pipe dream. They don't have what it takes to continue X11 alive once X.Org pulls the plug.by themerone
- XLibre looks nice with lots of work happening in only 5mo.by forgotpwd16
- On their github you can see all three changes identical to x.org's happened on October 28th (same day as the advisory). So, they were not already fixed, but the fixes were applied immediately.by richard_todd