Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Enhancing x11 Application Security with LXC (2025)

dobrowolski.dev

Post reply on HN
Print view View original

21–30 of 78 posts

Re: Enhancing x11 Application Security with LXC (2025)

#21

Post by shevy-java »

lotharcable wrote: post #13
ChocolateGod wrote: post #12

Earlier quoted context omitted.

> XACE Which is configured by default on what distros?

Nowhere (and everywhere). It is my understanding that XACE doesn't actually provide any security features itself. It just provides the "hooks" to implement security extensions. Like LSM feature in Linux kernel. You have to install a additional X11 extension to do something useful with it. So the most common X11 security extension is going to be xcsecurity which enables the SECURITY extension. It allows a course permi…

> that is what the X developers did with Wayland

This is rather incomplete. For instance, gtk devs already threw out tons of old code in GTK4. Wayland also has fewer features than xorg; and there are also fewer choices available. I noticed this with regards to WMs/DEs. I am not even going to issues wayland has with regards to certain video graphics - that's another not mentioned issue here.

You are trying to pick individual cherries.

> This sort of thing is why to fix X11 security you have to give up backwards compatibility and create a new X version.

I don't think so: https://github.com/X11Libre/xserver

Let's have a look in a little while. I myself hope for better and more transparent information at all times. Probably others want better security overall. Would it not be somewhat interesting if wayland were to be abandoned eventually due to having too few useful features compared to xserver?

Re: Enhancing x11 Application Security with LXC (2025)

#22

Post by BobbyTables2 »

mid-kid wrote: post #6

For an article written late last year I hoped for a little more awareness of how massive a security hole granting full, unfiltered access to the X11 server is. Granted, any sandboxing is better than none, but firefox is one of the few apps that already sandboxes itself really well, and with a blog title like that it might be good to touch upon things like nested X servers such as Xephyr.

Yeah, sadly Firefox and Chrome want almost full privileges so that they can sandbox themselves.

X itself always bothers me. Xeyes is cute until one considers the practical implications…

Re: Enhancing x11 Application Security with LXC (2025)

#23

Post by shevy-java »

asveikau wrote: post #10
mappu wrote: post #8

Earlier quoted context omitted.

There's also this new one: https://github.com/joske/yserver

Hard for me to take that one seriously.. For example they call out byte swapping for endianness as the type of cruft holding back X11. Such a trivial thing to be concerned enough to put in the readme... (I guess Phoenix is also putting this..) Seems like mostly authored by Claude too.

> Seems like mostly authored by Claude too.

This is a problem in many projects now. xserver and mruby for instance also succumbed to claude. It seems claude is the ultimate virus. It leaks into almost every project now. So I am not sure it can be used as differentiating criterium here merely for being claude AI slop. I've noticed a lot of documentation is now totally useless though; claude slop is just unreadable to me. It's like a person who is not able to think, wrote the documentation. I did not have this issue back when real humans wrote documentation, even though high quality documentation was always rare anyway. But, for instance, Jeremy Evans in his projects tends to write high-quality documentation in general, and I can understand it fine, whereas if you look at matz spinel, I have no idea what the AI slop in the README is really trying to convey. Or on ffmpeg, a german dev used AI slop to try to create some proposal, and someone else pointed out that this is pointless and impossible to read and understand, yet the original guy did not understand why real people don't want to be AI slop spammed. It's very strange.

Re: Enhancing x11 Application Security with LXC (2025)

#25

Post by kstrauser »

shevy-java wrote: post #20
ElijahLynn wrote: post #18

Is X11 going to be like IE6. Still around in another 10 years after it was intended to be deprecated across all major distros (2025/2026).

I don't think it is "just around" - it is actively maintained still: https://github.com/X11Libre/xserver In the end Red Hat failed to kill off X11. Let's see what happens next. The GTK devs already rejected patches for maintaining the toolkit further for the xorg platform, following their "GTK5 will no longer support x11" agenda. Would be kind of great to have a universal GUI toolkit that would work rather than have…

Real question: is X11Libre widely used by anyone but its maintainers?

Re: Enhancing x11 Application Security with LXC (2025)

#26

Post by fluffybucktsnek »

shevy-java wrote: post #21
lotharcable wrote: post #13

Earlier quoted context omitted.

Nowhere (and everywhere). It is my understanding that XACE doesn't actually provide any security features itself. It just provides the "hooks" to implement security extensions. Like LSM feature in Linux kernel. You have to install a additional X11 extension to do something useful with it. So the most common X11 security extension is going to be xcsecurity which enables the SECURITY extension. It allows a course permi…

> that is what the X developers did with Wayland This is rather incomplete. For instance, gtk devs already threw out tons of old code in GTK4. Wayland also has fewer features than xorg; and there are also fewer choices available. I noticed this with regards to WMs/DEs. I am not even going to issues wayland has with regards to certain video graphics - that's another not mentioned issue here. You are trying to pick ind…

> Wayland also has fewer features than xorg; and there are also fewer choices available

Because Wayland is a strictly a window management protocol focused on policy over mechanism.

> I am not even going to issues wayland has with regards to certain video graphics - that's another not mentioned issue here.

We also aren't going to mention issues Xorg or XLibre have with some graphics setups, because that's neither here nor there. This is a thread about security.

> I don't think so:

Didn't XLibre break some applications when launched?

> Would it not be somewhat interesting if wayland were to be abandoned eventually due to having too few useful features compared to xserver?

It would be interesting to see Wayland abandoned for a better protocol/set of protocols, xserver is neither a protocol nor really better.

Re: Enhancing x11 Application Security with LXC (2025)

#27

Post by PowerElectronix »

kstrauser wrote: post #25
shevy-java wrote: post #20

Earlier quoted context omitted.

I don't think it is "just around" - it is actively maintained still: https://github.com/X11Libre/xserver In the end Red Hat failed to kill off X11. Let's see what happens next. The GTK devs already rejected patches for maintaining the toolkit further for the xorg platform, following their "GTK5 will no longer support x11" agenda. Would be kind of great to have a universal GUI toolkit that would work rather than have…

Real question: is X11Libre widely used by anyone but its maintainers?

Several distros have gone XLibre as their default display manager. I installed Artix on a bc-250 just last week and XLibre was the default there.

Re: Enhancing x11 Application Security with LXC (2025)

#29

Post by enriquto »

BobbyTables2 wrote: post #22
mid-kid wrote: post #6

For an article written late last year I hoped for a little more awareness of how massive a security hole granting full, unfiltered access to the X11 server is. Granted, any sandboxing is better than none, but firefox is one of the few apps that already sandboxes itself really well, and with a blog title like that it might be good to touch upon things like nested X servers such as Xephyr.

Yeah, sadly Firefox and Chrome want almost full privileges so that they can sandbox themselves. X itself always bothers me. Xeyes is cute until one considers the practical implications…

> Xeyes is cute until one considers the practical implications…

what's the problem with xeyes? it reads data on your computer and displays it. Just like vim or cat.

If, for some reason, you want to run a program that you don't trust, you should sandbox it from the outside. But granting full rights to distro-provided programs like vim or xeyes is perfectly sane. Just like you trust your kernel.

Re: Enhancing x11 Application Security with LXC (2025)

#30

Post by _jackdk_ »

ElijahLynn wrote: post #18

Is X11 going to be like IE6. Still around in another 10 years after it was intended to be deprecated across all major distros (2025/2026).

The problem is that Wayland just isn't a compelling alternative for many people, so they don't move. For me, I see no benefit because I got used to avoiding HiDPI and don't have a mixed-DPI workspace. For some bizarre reason they made each compositor implement input-handling separately, so for example artists might have to switch compositor just to use their tablet of choice. And worse yet, some people with input accessibility needs are just going to get straight up locked out of libre computing. See https://nocoffei.com/?p=451 for one example.
Post reply on HN