Hacker Newsnew | past | comments | ask | show | jobs | submit | StillBored's commentslogin

https://www.x.org/releases/X11R7.6/doc/xextproto/security.ht...

Is the security extension from 1996, which has a section on keyboard security

and its crazy to me that this anyone can claim X11 can't be off loaded, which its been doing for decades. From all the crazy blt/pattern HW acceleration to GL/vulcan implementations to the fact that the entire server can be on the other side of a network pipe, meaning it could be anywhere, including entirely encapsulated on a graphics card/smart nic/etc.

And if your talking about the xlib serialization, that was largely fixed with XCB.


https://www.x.org/releases/X11R7.6/doc/xextproto/security.ht...

Notice the date.. 1996

(for those that didn't click the link, that is the X11 security extension which address all that, and it was published ~30 years ago).


The KDE blog entry reads like a modern political platform denying climate change, or claiming renewable energy can replace traditional energy sources on the grid.

One head strictly stuck in the ground and ignoring the cases that make many of those statements flatly false. Like for example, the nvidia support. Nvidia support in Linux is in the 'good luck' catalog, especially on any optimus laptop, where one is lucky if the power management works, much less multiple screen docking/undocking, and a heap of other issues. Then please clarify which actual driver stack one is running (nouveau vs provide by nvidia binaries, vs nvidia open source) To claim its great with wayland ignores core failures that still exist.

Its the same with X11 forwarding, which like copy paste, has been steady degrading to the point where all the dbus/etc services being depended on makes double digit percentages of applications not work with 'ssh -X' and oh wow, waypipe. It seems all of windows/osx and KDE/Gnome are steadily shooting themselves in the foot.

I'm sorta happy I pulled my financial support not long ago, there are a couple 'toxic' people in the distro DE community who are pushing their own agendas, everyone else be damned. And weirdly enough it seems those people aren't doing it for some corporate/whatever reason, but just to wave a flag about their accomplishments. The entire reason most people claim wayland is 'better' is largely FUD, but that doesn't stop the true believers.


> In case I wasn't clear enough, there was never a screenshot feature. Any X11 client could read any pixel written by any other X11 client.

Which is a load of FUD, the X11 security extensions from (checks google) 1996, restrict this.


The 1996 extension had severe limitations. Untrusted clients have no clipboard, but also no GPU acceleration at all and other features were barely tested using it so it was somewhat random if they would work. It breaks a ton of applications and was therefore used by approximately no one.


Ok, so instead of a couple UAC style prompts for screen readers, macro recording, desktop sharing, etc, and some tweaks to GDK, we got what? An entire new backend GDK windowing system, and a pile of broken applications? And its been decades?

And its not like actual flaws people found couldn't be fixed.

There is a word for this.


Did you consider that maybe when you hold an opinion different than the people actually knowledgeable about a topic - like the people developing desktop environments and the former developers of X building Wayland - it might be because you are wrong and have a poor understanding of the field and not because they want to annoy you?

The flaws were not limited to the 1996 poor security extensions. These kind of half broken extensions are everywhere in X11. At some point, if the tweaks you have to do is basically rewriting the whole rendering pipeline and adding new APIs for the most significant systems, what you are doing is strictly équivalent to writing a new piece of software which is exactly what the people behind Wayland did.

And don't worry, the change adverse people you see here complaining about limitations fixed years ago would be complaining the same if the effort was on rewriting part of X11. That's life. Armchair complainers and keyboard warriors will complain while actual doers push things forward.


> Which is a load of FUD, the X11 security extensions from (checks google) 1996, restrict this.

Wait, what ? X11 has extensions ? As in can be "extended" ? And has the same thing since ( for the sake of dialogue) 1996 ? That't why it must die. We need a monolith window system, with clear versions, all incompatible with each other. Only then, real progress can be made. /s


ECC! I don't care what BS people say about ZFS/Btrfs/whatever, if a bit flips on your router hopefully the checksum fails and nothing bad happens.

If you flip a bit in memory, on the way to the disk, then its corrupt at rest, and future reads will likely propagate the error.

Sure, who cares, a glitch here/there in your kids first birthday video. Better hope the glitch is there, rather than in say the bit of code computing the sector offsets/whatever.

Stories like this hit the media every couple years, so if it can happen on the big fancy EMC/whatever then it can happen on your little NAS in the closet.

So, just pay the little extra for the CPU+MB+RAM that protects your data from the NIC all the way to the HD.


Asahi is also still a platform with a huge pile of out of tree patches on top because the platform itself is pretty unusual, requiring for example, a 16K page size kernel which is unlike pretty much every other arm Linux platform.


I was going to write a snarky comment, but in the "if any of Qualcomm leadership is listening" I'm going ask a question:

Why is any of this needed when the kernel is full of platforms that are forward compatible with the Linux kernel and boot and generally operate on day one, without a huge pile of changes?

What does it benefit the user to have a huge pile of proprietary implementations of devices they frankly don't care about? Ex: just about anything related to power management? Why can't QC adhere to industry standards when they implement standard devices, ex: USB? Why can't these platforms adhere to industry standard firmware interfaces rather than custom mailbox interfaces?


And generally considered unconstitutional, until suddenly it wasn't, just like GWB nationalizing the TSA itself thereby creating the single largest case of the federal government pilfering through everyday Americans persons and property hunting for things that are legal to own. Which was also wildly considered unconstitutional, until it wasn't.

And go read the 4th amendment, with the understand that no one who signed it thought anything in the constitution authorizes any part of the federal government to ignore the absolutist language the bill of rights is written in. The assumption was that if there arose a need to justify the federal government searching people like this it needed a super majority to pass an amendment to fix it.


Right, and the reason this has been going on for nearly a quarter century in the USA is because it was widely considered an unconstitutional national passport until 9-11, and got bipartisan push-back from a number of states following its passage.

The federal government passed it along with the authoritarian wishlists various agencies had been salivating over for 40+ years and unable to get passed, until under the guise of saving us from the 'terrorists', who now 25 years later, turned out the actual terrorists were probably just domestic authoritarians. The guys living in caves weren't really a threat and could be dealt with, without passing a bunch of stuff to affect every single citizen of the country.


Sure, but i suspect for basically all of us (maybe Elon is surfing HN today), that literally means nothing. Few of us have the 100's of millions required to design and fab a competitive SoC, and for those that do, the arm licenses are easier to acquire than the knowledge of how to build a competitive system (see RISC-V). You might as well complain about TSMC not publishing the information on how to fab 2nm parts or the code used to generate the mask sets.

For the rest of us, what matters is whether we can open digikey/newegg/whatever and buy a few machines and whether they are open enough for us to achieve our goals and their relative costs. So that list of vendors is more appropriate because they _CAN_ sell the resulting products to us. The problem is how much of their mostly off the shelf IP they refuse to document, resulting in extra difficulties getting basic things working.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: