bonifartius 𒂼𒄄
@velartrill i really like drew devaults stuff, but his fandom of wayland is mistaken imho.
@bonifartius and @velartrill, if you interact with X11 or Wayland API on a daily basis like he did you’ll probably have the same opinion, but for end users like you and me the difference is rather negligible.
@cnx @velartrill
note that i'm not a wayland expert..
it's not that the x api is good, more that the choices wayland made are not good, imho. e.g. i think that the way window managers are done with x11 is good. that other client windows can read the screen and input devices on X is based on the assumption that your X clients are trustworthy. wayland seems do think otherwise, missing that anything on your computer should be trustworthy in the first place.
in general wayland seems like it was designed by microsoft or some other big corporation that wants to be able to lock users into discrete Brand Experiences, not a platform meant to give users choice. and if X11's insecurity is the price i have to pay for a tolerable setup, it's worth the price
@velartrill
> i don't really agree that we should have to trust anything running on our computers simply because we can't all individually formally verify the source code of everything we run.
one also trusts the mechanic to properly fix brakes on the car. of course i can't verify everything on my computer, but i can choose to rely on due diligence from others i trust. if not, i can as well stop using computers (which would probably be a good idea :)
given how common it is for many people to have docker stuff running as root or just #yolo curl | sh installing stuff, the X11 security model is really.. not the thing i'd be worried about.
i bet there are other ways to keylog even with the wayland security measures. the only way to security is to just not run random garbage on your system. unfortunately we're getting there with snaps and flatpaks and docker.
"but it's all containerized!111" - you can also break out from xen hypervisor stuff. those things were never designed for security.
