Enhancing x11 Application Security with LXC (2025)

Post by [deleted] » Sun, Jun 28, 2026, 9:23 AM UTC

orangeboats wrote: post #33

enriquto wrote: post #29

Earlier quoted context omitted.

> Xeyes is cute until one considers the practical implications… what's the problem with xeyes? it reads data on your computer and displays it. Just like vim or cat. If, for some reason, you want to run a program that you don't trust, you should sandbox it from the outside . But granting full rights to distro-provided programs like vim or xeyes is perfectly sane. Just like you trust your kernel.

> But granting full rights to distro-provided programs like vim or xeyes is perfectly sane Saying this after the whole XZ utils ordeal has happened is quite interesting. Can you really guarantee that your distro is not compromised? And if it is compromised, how can you easily _discover_ that a program is doing something strange? X11 ( the one that most people are familiar with, not the locked down one with X security…

Post by microgpt » Sun, Jun 28, 2026, 9:41 AM UTC

lotharcable wrote: post #14

calvinmorrison wrote: post #3

Xlibre (the only current actively developed implementation of a X11 server) has a new extension - XNamespace to address some challenges as well. https://github.com/X11Libre/xserver/blob/master/doc/Xnamespa...

XWayland is actively developed. XFree86, which is the "standalone DDX" you see on X11 desktops, is being actively maintained.

Post by uecker » Sun, Jun 28, 2026, 10:35 AM UTC

orangeboats wrote: post #33

enriquto wrote: post #29

Earlier quoted context omitted.

> Xeyes is cute until one considers the practical implications… what's the problem with xeyes? it reads data on your computer and displays it. Just like vim or cat. If, for some reason, you want to run a program that you don't trust, you should sandbox it from the outside . But granting full rights to distro-provided programs like vim or xeyes is perfectly sane. Just like you trust your kernel.

> But granting full rights to distro-provided programs like vim or xeyes is perfectly sane Saying this after the whole XZ utils ordeal has happened is quite interesting. Can you really guarantee that your distro is not compromised? And if it is compromised, how can you easily _discover_ that a program is doing something strange? X11 ( the one that most people are familiar with, not the locked down one with X security…

Post by jcelerier » Sun, Jun 28, 2026, 11:30 AM UTC

BobbyTables2 wrote: post #22

mid-kid wrote: post #6

For an article written late last year I hoped for a little more awareness of how massive a security hole granting full, unfiltered access to the X11 server is. Granted, any sandboxing is better than none, but firefox is one of the few apps that already sandboxes itself really well, and with a blog title like that it might be good to touch upon things like nested X servers such as Xephyr.

Yeah, sadly Firefox and Chrome want almost full privileges so that they can sandbox themselves. X itself always bothers me. Xeyes is cute until one considers the practical implications…

Post by nosioptar » Sun, Jun 28, 2026, 11:55 AM UTC

mike_hock wrote: post #39

_jackdk_ wrote: post #30

Earlier quoted context omitted.

The problem is that Wayland just isn't a compelling alternative for many people, so they don't move. For me, I see no benefit because I got used to avoiding HiDPI and don't have a mixed-DPI workspace. For some bizarre reason they made each compositor implement input-handling separately, so for example artists might have to switch compositor just to use their tablet of choice. And worse yet, some people with input acc…

> I like my cozy Plasma DE [...] clean, all free of ads and bad UI redesigns and AI injected into every corner. Plasma itself is an example of bad UI redesign (but a far cry from Gnome).