Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

It's worked fine for X for decades now, so simply claiming "it's not a solution" is kind of silly.

I get that people pretend they are afraid some nefarious program is going to scrape their screen, but since I don't use closed source software this just isn't a real worry.

Also do keep in mind this is about more than global hotkeys; there are several accessibility paradigms that simply don't and can't work on Wayland.



> It's worked fine for X for decades now, so simply claiming "it's not a solution" is kind of silly.

It never worked "fine", it was always a failure from security and usability perspective.

> I get that people pretend they are afraid some nefarious program is going to scrape their screen, but since I don't use closed source software this just isn't a real worry.

You know that apps have security vulnerabilities that can be exploited over the network? Screen grabbing, keyloggers, input injection(you have open root terminal? let's type some commands there). And more.


As I have said many times, a good intentioned program with a bug only needs bad intentioned data.

A malicious PDF file is enough to break havoc with a simple memory bug, so unless you claim that open source is also bug-free, or that you don’t use any external data (but visiting this site already invalidates that assumption), then you are just being naive.

There is nothing inherent that couldn’t work with Wayland - there is nothing preventing the relevant teams agreeing on a new interface to broadcast accessibility information to the wayland server, that can thus share that with specific accessibility software (which is explicitly permitted to do it).


> I get that people pretend they are afraid some nefarious program is going to scrape their screen, but since I don't use closed source software this just isn't a real worry.

Do you personally audit the source code to every piece of software you run on your computer? Do you have the expertise necessary to even do that if you wanted to?

FOSS isn't magically immune to security exploits. Everything we build should assume any other software it interfaces with might be defective or even hostile.

https://en.wikipedia.org/wiki/Heartbleed


> Do you personally audit the source code to every piece of software you run on your computer?

No more than Wayland users have audited the process protection code.


You're not really addressing my argument here. Of course Wayland users don't audit the Wayland source code.

I was illustrating why Wayland's security paradigm is important. It doesn't assume all the apps it renders are safe. It can still (and probably does) have security holes, but it is already starting from a much more secure foundation than X11 ever had any hope of having.

Similarly, my web browser probably has not publicly known exploits that I haven't bothered to discover myself, but that doesn't mean I should be OK with using a browser that doesn't sandbox its javascript engine.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: