logoalt Hacker News

athrowaway3ztoday at 8:28 AM1 replyview on HN

> > I also don't care for the "security" argument when parts of the core reference implementation are written in a memory-unsafe language.

> Doesn't sound like a super informed way to look at security (not even mentioning that Wayland was started in 2008, and Rust was not a thing). One can also say that "as long as you run X11, there is no need to think about security because X11 just defeats it all".

I think the argument is not that X11 defeats it all - but that for 99.9999% of users its security theater when deployed in the real world. Most commonly, as long as processes can read each other's memory/configuration/etc.

I'm sure there is a use-case for untrusted sharing of Wayland enabled GPU rendering or something - though AFAIK none of the enterprise remote desktop use it, and they have the resources to implement it themselves anyway.

I've been running Wayland for two years now. I still hit weird bugs with desktop sharing / obs tinkering; It's just not a critical use for me.

So it's fair to question the design wisdom of adding the complexity and UX pain points if it seems to be worth so little.

But maybe i'm overlooking some large group of people dependent on Wayland security boundaries?


Replies

palatatoday at 9:22 AM

> Most commonly, as long as processes can read each other's memory/configuration/etc.

And there is no point is working on the Desktop security as long as X11 defeats it all.

> if it seems to be worth so little

I, for one, value the security standpoint.