Hacker News

On their github you can see all three changes identical to x.org's happened on October 28th (same day as the advisory). So, they were not already fixed, but the fixes were applied immediately.

XLibre looks nice with lots of work happening in only 5mo.

This project has way more serious problem than security!

That's the fork where the primary cause was to be "anti-woke", right? Honestly it seemed like it was just because that one guy was a little unbalanced, and he happened to be channeling that energy into an X server fork.

That project is a pipe dream. They don't have what it takes to continue X11 alive once X.Org pulls the plug.

There are plenty of setups where the X server runs at higher privileges/on a different host than the (partially trusted) application that might exploit the X server. This is a classic elevation of privileges vulnerability in those setups.

X11's practical absence of any security mechanisms for user sessions means you should probably not run any kind of low-trust UI program anyway, as there is no prevention of keystroke injection or screen recording, but that's a design flaw that will never be solved. That doesn't mean that EoP style attacks like these should be ignored or underestimated, though.

Some oldschool legends are still fixing bugs in xorg.

Alan Coopersmith in particular. He even fixed a bug I reported. :)

(I forgot in which app it was but the bug report should be somewhere still; it is not old, perhaps 2 years ago or 3 years ago. The xorg app in question behaved oddly when doing "--version". I only noticed this because I wrote a ruby script that displays which version of programs are installed, and that one kept on making problems, whereas the others worked fine. After I reported it, Alan fixed this very quickly. I think it was some missing flag in the C program or something like that; right now I can not remember the name of the program ... my brain tries to say xrandr but I think it was not xrandr but a less frequently used program somewhere in the FTP listing ...)

> Bonus points if you have any Tcl/Tk apps running, where you can simply transmit commands for the program to run via the X server.

Back in 1996 the level of X integration in Tk was awesome; I had a shell tool that could make Netscape do stuff by firing MIT magic cookies at it.

In a contemporary setting, it's pretty horrifying.

These are all "no way to prevent this, say users of only language where this regularly happens" type problems though.

The send command in Tk is lel, but can easily be effectively closed by rebinding it to a no-op.

I think the short story is that the people who develop Wayland are the people who used to develop Xorg.

And they’d rather spend their energy on giving you a compelling reason to switch, rather than using it to add to the reasons for staying on a project they now consider obsolete.

You may disagree with their assessment, but you can’t blame them for how they decide to prioritize.

Xorg is indeed a lot of painful complexity. This being said, the software is not Linux specific, and for modern Linux distributions, it is more and more a legacy technology.

Our chief pain is graphics... graphics and audio... audio and graphics... our two pains are audio and graphics... and wifi hardware support... Our three pains are audio, graphics, and wifi hardware support, and an almost fanatical devotion to the command line.... Our four... no... Amongst our pains... are such elements as graphics, audio.... I'll come in again.

By my reading, it would have prevented all of them.