It is, but my argument is that better security is not needed! There is only one user. All apps are his/hers.
Linux security inside a user's session is bad in general. It all started in the '90s from the principle that all installed software is FOSS, sources inspected, and compiled distro packages trusted.
- Permissions are per-user, not per-app. If I ever need permissions to something, every app I run gets the same permissions.
- No isolation for personal files. Any app running as me can read all of them. Bookmarks, firefox passwords, everything.
- No per-app firewall mechanisms. Any app can call home and send user's files, including those passwords.
- System events are broadcasted via dbus to any app wanting to listen to them.
So why make the GUI secure if everything else isn't? If anyone wants to have better security (or privacy) in Linux, would have to start with the basic permissions model.
IMO the issue is that the same group stewarding Wayland was also xorg, and intentionally stifled improvement on xorg even when the work just a matter of merging the PR.
Merging a PR by drive-by contributors is far from trivial. As the maintainer, you become responsible for the other person's code for all eternity; it's on you to read it, understand it, update it when stuff around it changes, and fix it when it breaks.
Not a problem for obviously-correct changes of a couple of lines, but most PRs aren't like that.
I understand and that's a fair point. I should have phrased that differently, in that the PRs for features were waiting to be merged. I'm sure merging into a codebase as... storied? as xorg is no small task.
Open source developers are not required to spend their time prioritizing your priorities. You just have to look to Xlibre to see that a lot of contributions are quite bad quality, and in a C codebase of Xorg's complexity and security profile it's not a small job to review things.
Nothing I said in any way implied that freedesktop should be required to do anything. I can't speak to the quality of xlibre merges, only that if whatever is going on over there led to improvements in xorg after a drought, that's a good thing.
If wayland had been sold as a hardened display for those who needed that level of security, I would not have a problem with it.
As it is, the community got constantly browbeat with 'this is the future' and 'it's so much faster!' when recent benchmarks have proven that to be false.
Then go use X. Nobody's stopping you, you can just ignore any brow beating. /ignore is a useful IRC command.
You'll probably find it to be a not great experience, since almost all the people who spend their time actually working on graphics and GUIs in the Linux world prefer to work on Wayland. So X doesn't get much love these days (and you're not entitled to their efforts after all). But it's not like they erased all the old X code from existence.
It is, but my argument is that better security is not needed! There is only one user. All apps are his/hers.
Linux security inside a user's session is bad in general. It all started in the '90s from the principle that all installed software is FOSS, sources inspected, and compiled distro packages trusted.
So why make the GUI secure if everything else isn't? If anyone wants to have better security (or privacy) in Linux, would have to start with the basic permissions model.Great, so let wayland be a hardened option for those who care.
It is and you're free to use X if you want
IMO the issue is that the same group stewarding Wayland was also xorg, and intentionally stifled improvement on xorg even when the work just a matter of merging the PR.
Merging a PR by drive-by contributors is far from trivial. As the maintainer, you become responsible for the other person's code for all eternity; it's on you to read it, understand it, update it when stuff around it changes, and fix it when it breaks.
Not a problem for obviously-correct changes of a couple of lines, but most PRs aren't like that.
I understand and that's a fair point. I should have phrased that differently, in that the PRs for features were waiting to be merged. I'm sure merging into a codebase as... storied? as xorg is no small task.
>and intentionally stifled improvement on xorg
Open source developers are not required to spend their time prioritizing your priorities. You just have to look to Xlibre to see that a lot of contributions are quite bad quality, and in a C codebase of Xorg's complexity and security profile it's not a small job to review things.
Nothing I said in any way implied that freedesktop should be required to do anything. I can't speak to the quality of xlibre merges, only that if whatever is going on over there led to improvements in xorg after a drought, that's a good thing.
If wayland had been sold as a hardened display for those who needed that level of security, I would not have a problem with it.
As it is, the community got constantly browbeat with 'this is the future' and 'it's so much faster!' when recent benchmarks have proven that to be false.
Then go use X. Nobody's stopping you, you can just ignore any brow beating. /ignore is a useful IRC command.
You'll probably find it to be a not great experience, since almost all the people who spend their time actually working on graphics and GUIs in the Linux world prefer to work on Wayland. So X doesn't get much love these days (and you're not entitled to their efforts after all). But it's not like they erased all the old X code from existence.
> You'll probably find it to be a not great experience
I'm confused where I'm likely to be suffering. If I start using Wayland tomorrow would I even notice? Apart from having to switch DEs, of course.