Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 



Forgot your password?
typodupeerror
×

Comment Re:If it's accessing your X server, it's elevated (Score 1) 375

Oh how about a new protocol extension that allows one designated program to receive all keyboard inputs regardless of any other grabs. The X11 server can keep on pretending that the other grabbers still have such a grab.

I'm not really sure how creating yet another way for a "designated program" to monitor input events is supposed to address the problem that any X11 client can monitor keyboard events on any window in the absence of a grab, unless you intend to rewrite all existing software to grab the keyboard on receiving input focus, and force all the desktop environments to implement support for the extension and move their global keybindings into a specially designated client. At that point you might was well switch to a system designed for secure I/O from day one—like Wayland.

Look: X11 works on Windows even though windows can apparently REALLY gab the keyboard. X11 will we are told work on Wayland too despite the fact that wayland can apparently REALLY grab they keyboard. Do you really think it couldn't be extended to do that itself?

It's no different with a rootless X server on Windows. Input received by any X window can be observed by any X client, unless one client grabs the input. XWayland will probably work the same way, with native Wayland clients secure from each other and from X11 clients but no isolation between X11 clients and no support for grabbing input directed at non-X11 windows. XWayland is meant as a shim between the Wayland compositor and ordinary X clients; it doesn't support external window managers and isn't expected to host a full X11 desktop environment. You wouldn't run something like a screen locker as an X11 client under XWayland. It wouldn't be secure, for the same reasons that screen lockers aren't secure under X11 now, and similar compatibility problems would occur if you tried to implement the Wayland input model with X11 extensions.

It's easy to implement the insecure X11 model on top of a secure system. The reverse is much more difficult.

Comment Re: If it's accessing your X server, it's elevated (Score 2) 375

Some other window most likely does have the keyboard focus, but that's not the same as grabbing the keyboard. Having the focus doesn't prevent input events from also being delivered to other windows, it just tells the non-focused windows to ignore the events. Integrity and privacy for both input and output is a hard problem and something very few windowing systems manage to get right. The solutions tend to involve some degree of inconvenience for the user.

Comment Re:If it's accessing your X server, it's elevated (Score 1) 375

What exactly would you propose to add? This isn't a matter of implementing new functionality, but rather removing fundamental misfeatures. Any change to address this issue is going to end up breaking existing applications which depend on the original input behavior.

In any case this is hardly the only reason to switch to Wayland. It's just one of many areas which highlights the drawbacks of trying to tack modern best practices on top of an aging framework. Better to adopt a clean and modern design as the base and confine the hackish workarounds needed to support older clients to a separate compatibility layer.

Comment Re:If it's accessing your X server, it's elevated (Score 5, Informative) 375

I'm not familiar with writing apps for X, but are you saying that every program that displays a window in X can log all keystrokes including in windows that are not associated with that program?

Yes. This isn't just X, by the way; it's a common design across most operating systems. Any client can register to receive keyboard and mouse input regardless of the current focus, unless another client has already "grabbed" the input device. This is how things like global keybindings are typically implemented. Windows used for password entry (including lock screens) can grab the keyboard to prevent other programs from listening in. The problem is that this only works if no other program has already grabbed the keyboard.

Secure input handling is one of the many reasons why everyone is eventually planning to switch to Wayland. Under Wayland, only the compositor has access to the raw input or the ability to inject simulated input events. The compositor manages any global keybindings and forwards the remaining events exclusively to the active window.

Comment Re:Now using TOR after WH threats to invade homes (Score 1) 282

If you are calling trying to stop things like the Charlie Hebdo a Nanny State then I think your definitions are a bit off.

The concept of the "Nanny State" is more about means than ends. If a state's approach to "protecting" people involves restricting their freedom, then it's a Nanny State. The goal is laudable, but does not justify the means.

Comment Re:lol (Score 1) 323

It's just like handing over keys to a storage cabinet you own. There's no Fifth Amendment protection here. You aren't being forced to testify against yourself.

You're assuming that they already know that you have the keys. If they don't know that, then demanding that you open the cabinet amounts to a call for self-incrimination—not because of the contents per se, but because it would show that you had access to the contents. (Perhaps you received a locked cabinet with no key, and have no idea what may be inside.)

Similarly, if they haven't already shown that you have access to the social media account in question, then simply revealing that you know the password would be self-incrimination. Perhaps someone else set up the account in an attempt to frame you.

Comment Re:If I were a kid in that school district... (Score 1) 323

If they know that an account was used for cyber-bullying, but don't know for sure that it was you using the account, revealing that you know the password would already be self-incrimination. You don't need to make up a convoluted password in order to plead the 5th.

Comment Re:Wackadoddle (Score 1) 667

Timezones exist because the world is curved around the axis of rotation, meaning that the angle to the Sun varies according to one's longitude. If the world were flat, but still rotating so as to allow for day and night, then the Sun would be at (very nearly) the same angle to the ground everywhere, and thus the time should be the same everywhere.

Unless there are people living on the back of the plane, that is, in which case there would be two diametrically opposed timezones rather than the continuous variation you get with a sphere or cylinder.

Comment Re:Brazil has long had a very protectionist (Score 1) 111

The theorem doesn't require money. You could be trading apples for money, apples for butter for oranges, apples directly for oranges, doesn't matter. If three's comparative advantage, people trade. Period.

If people aren't trading, that doesn't mean the theorem is wrong; it means one of the conditions isn't being satisfied.

Comment Re:Brazil has long had a very protectionist (Score 1) 111

What part of beneficial for both of us don't you understand? Both parties will be able to eat more total food. The less productive group will still be eating less, but more than if they didn't trade at all.

There is no situation in which it's bad to permit people to trade. Again, mathematical theorem.

Comment Re:Third World Status, Here We Come! (Score 1) 496

So let me get this straight, in 1776 the Founding Fathers got together to protest the mass poverty and bad British tea, and started NASA so we could lob said tea into space. It eventually made us so rich we became the best developed country on the Earth and now we're exploring how to cultivate tea and coffee on Mars.

Uh huh. If it were that easy to create developed nations, we'd be going into third world countries handing out space programs, not rice (and all the less lovely stuff our foreign aid props up)

Comment Re:WTF (Score 0) 496

Science is a process, the process of coming up with a hypothesis and experimentally testing it in controlled conditions.

Saying we should take less money from people doesn't make you an "enemy of science." If anything, it makes you a champion of the dismal science (you know, economics).

Comment Re:Brazil has long had a very protectionist (Score 1) 111

How in the world does comparative advantage not exist in a place like Brazil? To say there's no comparative advantage is so statistically improbable you may as well get hit by an asteroid. A million times.

You know what comparative advantage is, right? If it takes me $5 to produce an apple and $4 to produce an orange, and it takes you $2 to produce an apple and $1 to produce an orange; that's comparative advantage: Even though you produce both fruits by far and away cheaper than I do, you produce oranges at an opportunity cost 2x cheaper, and so Economics says we will trade, and it will be beneficial for both of us to do so.

Comment Re:Brazil has long had a very protectionist (Score 2) 111

You're not supposed to produce everything as cheap as your neighbors, it's actually bad thing to do that. Even if your neighbor produces literally everything below the cost of domestic production, so long as the two entities have different opportunity costs for different goods, it's still more beneficial to outsource stuff and trade. Economists call this comparative advantage and it's a mathematical theorem.

Slashdot Top Deals

Old programmers never die, they just hit account block limit.

Working...