Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

KDE Plasma 6.8 Will Go Wayland-Exclusive in Dropping X11 Session Support

phoronix.com

Post reply on HN
Print view View original

171–180 of 248 posts

Re: KDE Plasma 6.8 Will Go Wayland-Exclusive in Dropping X11 Session Support

#171

Post by panzi »

theoldgreybeard wrote: post #119
panzi wrote: post #23

Earlier quoted context omitted.

The future seems buggy and incomplete.

That seems to be the mood du-jour - see also: rust coreutils in Ubuntu.

Personally I like Rust, but I'm against rewriting old well tested tools in Rust just because. There is this opinion out there that Rust devs rewrite everything for no good reason, but I only really saw that happening in coreutils and sudo. In the other cases that I heard of the rewrite wasn't from C/C++ (but e.g. from JavaScript and they need more speed) or they needed a rewrite anyway for different reasons (e.g. first working parallel style calculation in Firefox).

So I'm very skeptical of the coreutils rewrite. In the current state it's incomplete, slower (not optimized), and replacing all GPL code with MIT/BSD code also feels strange to me.

Re: KDE Plasma 6.8 Will Go Wayland-Exclusive in Dropping X11 Session Support

#172

Post by prmoustache »

lousken wrote: post #168
prmoustache wrote: post #166

Earlier quoted context omitted.

If you can use the cli, it is at best mildly annoying but not critical. Having said that, deprecating x11 completely is the one motivation for dev to fix bugs and/or find ways. Wayland really started to catch up with missing features when some distros like Fedora started using it by default. If you want to stay on legacy stuff such as x11 while the remaining stuff is fixed, there are plenty of long term support distr…

It would be critical if I were to move any non-IT employees from windows to linux. As said in one of my comments - this could very well mean that the next version of Debian will have KDE Wayland only which would already mean <5years of support today. I am not saying wayland is not catching up, I am saying enterprise apps are the issue.

Almalinux 10 will receive security updates until 2035, Ubuntu 24.04 until april 2039, 25.04 would go until april 2041 by that logic, many of us will be considering retirement at that point. Enterprise malware will have plenty of time to adapt and many will have disappeared before reaching the 2040's.

Re: KDE Plasma 6.8 Will Go Wayland-Exclusive in Dropping X11 Session Support

#173

Post by atherton94027 »

estebank wrote: post #164
ottah wrote: post #101

Earlier quoted context omitted.

I 100% agree with the performance improvement goals, but I think the security claims are overblown, and overly cautious. I honestly don't understand the point of trying to implement the security boundary in the display manager. It solves one class of security issues, while breaking a lot of accessibility and automation. The display manager just shouldn't be enforcing rigid per processes security controls, that's bett…

Where in the stack should it be enforced that my cute desktop clock doesn't pull a Copilot and takes a screenshot of the entire desktop every 15 seconds to send to a remote service?

If your system is already running malware, why wouldn't the malware use a privilege escalation exploit (which are relatively numerous on linux) to access your data rather than some X11 flaw which depends on their code getting started by the user?

Re: KDE Plasma 6.8 Will Go Wayland-Exclusive in Dropping X11 Session Support

#174

Post by noisem4ker »

aidenn0 wrote: post #160
noisem4ker wrote: post #83

Earlier quoted context omitted.

For RDP, you've got KRDP and gnome-remote-desktop. That "with a running session" bit greatly helps here. While GDM allows you to have remote login and headless sessions [1], with SDDM you're locked out for the moment. There's plans to turn SDDM into a KDE-powered, more featured plasma-login-manager with KRDP integration, but no concrete development yet [2]. [1]: https://gitlab.gnome.org/GNOME/gnome-remote-desktop [2]…

Last time I tried krdp, it didn't fit my needs. I needed to have already started krdp locally if I want to connect remotely. Neither x11vnc nor freerdp-shadow have that limitation.

Since Plasma 6.1 (june 2024) you get a system settings module where you can enable KRDP to run at login.

https://quantumproductions.info/articles/2024-06/krdp-plasma...

(I assumed being logged in is what you meant by having "a running session".)

Re: KDE Plasma 6.8 Will Go Wayland-Exclusive in Dropping X11 Session Support

#175

Post by noisem4ker »

aidenn0 wrote: post #91
c-hendricks wrote: post #87

Earlier quoted context omitted.

KRDP: https://invent.kde.org/plasma/krdp But it needs a logged-in session, you can't get access to the login manager.

I want to connect to a logged-in session; I can't get krdp to let me do it without me locally granting permissions though.

They fixed that. I can definitely connect remotely in an unattended way as long as I'm logged in locally.

These might have something to do with it:

https://develop.kde.org/docs/administration/portal-permissio...

https://invent.kde.org/plasma/krdp/-/merge_requests/102

Re: KDE Plasma 6.8 Will Go Wayland-Exclusive in Dropping X11 Session Support

#176

Post by ottah »

estebank wrote: post #164
ottah wrote: post #101

Earlier quoted context omitted.

I 100% agree with the performance improvement goals, but I think the security claims are overblown, and overly cautious. I honestly don't understand the point of trying to implement the security boundary in the display manager. It solves one class of security issues, while breaking a lot of accessibility and automation. The display manager just shouldn't be enforcing rigid per processes security controls, that's bett…

Where in the stack should it be enforced that my cute desktop clock doesn't pull a Copilot and takes a screenshot of the entire desktop every 15 seconds to send to a remote service?

A security in depth approach obviously. Run less, use vetted sources, when running suspect software execute in a properly sandbox context. Seriously what's the point of securing screenshot and key loggers if a malicious process has full access to the users home directory, auido stack, webcam and network?

If you can't trust the process don't run it. If you have to run it, isolate all of it.

Wayland gives you neither the freedom to safely tailor your security policy, nor the security guarantees to warrant its inflexibility.

Re: KDE Plasma 6.8 Will Go Wayland-Exclusive in Dropping X11 Session Support

#177

Post by ottah »

creatonez wrote: post #129
ottah wrote: post #101

Earlier quoted context omitted.

I 100% agree with the performance improvement goals, but I think the security claims are overblown, and overly cautious. I honestly don't understand the point of trying to implement the security boundary in the display manager. It solves one class of security issues, while breaking a lot of accessibility and automation. The display manager just shouldn't be enforcing rigid per processes security controls, that's bett…

> that's better done further down the stack If you do it further down the stack, you break accessibility and automation even more... this has been tried. Doesn't work. The end goal is to have actually working Android-like sandboxing rather than some broken firejail crap.

So we don't get the security benefits or accessibility. I'm not sure what is being solved. I'm all for a modern display system, I'm just not convinced the security claims are in anyway justified.

Re: KDE Plasma 6.8 Will Go Wayland-Exclusive in Dropping X11 Session Support

#178

Post by surajrmal »

ottah wrote: post #101
gary_0 wrote: post #61

Earlier quoted context omitted.

> what's so wrong with X11 so people need to replace it 1. Security - Any program using X11 can read keystrokes, passwords, or the contents of any other window. Fixing this would break all existing X11 applications. 2. Performance - X11's client-server model doesn't work with hardware accelerated graphics, requiring hacks to get around. X11 is basically stuck with this legacy. The ground-up re-design of X11 to fix th…

I 100% agree with the performance improvement goals, but I think the security claims are overblown, and overly cautious. I honestly don't understand the point of trying to implement the security boundary in the display manager. It solves one class of security issues, while breaking a lot of accessibility and automation. The display manager just shouldn't be enforcing rigid per processes security controls, that's bett…

The fact that desktop Linux is all or nothing in terms of privilege escalation is a design issue, however arguably Wayland gives us the tools to be more granular. Android has a permission system that makes sense can it's display manager is definitely closer in design to Wayland than it is to x11.

Re: KDE Plasma 6.8 Will Go Wayland-Exclusive in Dropping X11 Session Support

#180

Post by array_key_first »

atherton94027 wrote: post #173
estebank wrote: post #164

Earlier quoted context omitted.

Where in the stack should it be enforced that my cute desktop clock doesn't pull a Copilot and takes a screenshot of the entire desktop every 15 seconds to send to a remote service?

If your system is already running malware, why wouldn't the malware use a privilege escalation exploit (which are relatively numerous on linux) to access your data rather than some X11 flaw which depends on their code getting started by the user?

Because it's not an x11 "flaw" or exploit, it's just how X works. I also just don't buy the whole "well other stuff has exploits too" mentality.

I mean, yeah, it does, maybe. So why bother creating a password to a service if their database is probably running Linux anyway and the rdbms is probably compromised and yadda yadda yadda. It's the kind of argument you can make for anything.

Also no - privilege escalation is not "numerous" on Linux. It's very difficult to do in practice. It's only really a problem on systems built on old kernels which refuse to update. But those will always be insecure, just like running Windows 7 will be insecure.

Post reply on HN