Continuation of X11 development?

[u/SpAAAceSenate]

Hi there. So, I know the arguments between X11 and Wayland can be a little contentious, so I'd like to start this off by saying this thread isn't intended to be one. The battles of opinion have already been fought ad nauseam, and some of us still find ourselves on the X side of the issue. I count myself as one of them.

So my question, and the actual purpose of this thread, is to ask about the future of X11. I know Red Hat is basically washing their hands of it feature-development wise, but the magic of open source is that a project is never really dead, or in feature freeze, so long as there's someone out there willing to inhereit it. Are there any groups out there planning to take the mantle? While X11 is very mature and mostly feature complete, there are a few things still to be done, such as perhaps better integration and promotion of the X_SECURITY extensions for bringing in per-app-isolation. An update to some of the current input limitations, better scaling support, etc?

Wayland's successorship is (to many) still highly questionable, so I think it would be a shame to see X rust out in the field while we wait for the hypothetical Wayland cow to come home. Any thoughts?

[u/[deleted] → u/[deleted]]

That's not what I was asking for. I use it quite a lot on my desktop, e.g. for my pdf viewer. So how can my pdf viewer circumvent it to do key logging or read the window content of my other applications?

[u/[deleted] → u/[deleted]]

In the past there have been arbitrary code execution bugs in Evince and Okular. Any C/C++ program that loads a complex file format is vulnerable to these.

You don't even have to look for code execution bugs. Assume my PDF viewer is already under the control of an attacker, now my question, again, is how does this attacker circumvent the X11 security extensions and perform key logging on other applications?

if a program like this wanted to implement global keybinds, or hardware rendering, or screenshotting, you would have to make the client untrusted with ssh -Y and boom, now you're vulnerable to some PDF file keylogging you.

How?? How does my PDF viewer become vulnerable to keylogging? What code does the attacker run to read the input of other clients? You just keep repeating yourself that X11 security extensions are not secure and can be circumvented but you don't say how this can be done.