Comment by jchw | Hacker News Reader

Comment by jchw | Hacker News Reader

I have a lot of disagreements about things said here. For example, I suspect wlroots based compositors are not particularly inefficient, therefore I’m not sure I strongly agree with the ewaste issue. GNOME 3 doesn’t seem particularly lightweight either way; most low end devices would not be running GNOME and KDE to begin with. Also, wlroots is listed alongside GNOME and KDE, but it is a library or framework for Wayland compositors. It’s an ecosystem of compositors. wlroots is basically a logical conclusion of Wayland’s different approach versus X; since the DE/WM is the compositor, it makes sense to make the common display server components into a library, the same way you would hope GNOME and KDE would not reimplement Xorg (though the lower surface area of Wayland and shared components like libinput and libwayland make it more tenable that they do in fact implement their own Wayland compositors largely from scratch.)

> However, Xorg code can be secure! Just look at xscreensaver,

I am rubbed the wrong way by this, because it sounds a lot like “just don’t make mistakes!” — if there’s any way to crash xscreensaver, that is a potential security issue...

Replace "Rewrite-it-in-Wayland has become a moral imperative. " with Rewrite-it-in-Rust (for example) and many of the "arguments" immediately apply. E.g. "You could also code in C without bugs!"

... and I now realize this was done intentionally. Shame on me.

I was picking up on the intentional irony, but it also has me confused. I was not able to pick up on if this piece was purely parody, partly parody, or just drawing parallels to support arguments...

The name “Drew Default” was not lost on me either.

> if there’s any way to crash xscreensaver, that is a potential security issue...

This has happened before: https://github.com/linuxmint/cinnamon-screensaver/issues/354

This is not xscreensaver though. This is important because jwz, xscreensaver's author, has written about this at length [1,2]. He was very careful to make the core of xscreensaver as small as possible to avoid crashes.

[1] https://www.jwz.org/xscreensaver/toolkits.html

[2] https://www.jwz.org/blog/2015/04/i-told-you-so-again/

(open these links in a new tab or by copy-pasting the URL)

True, and certainly a fair distinction. Perhaps I should say that a vulnerability of this nature - involving an xscreensaver fork - has occurred in practice.

Yes, your point still stands, this class of bugs is "fatally" present on X11, there is seemingly nothing that can be done about it.

It can actually be avoided on X11 if you're willing to make the screensaver an integral part of the desktop environment. The way KDE has done it since the KDE 4 era at least is by doing the actual screen locking in ksmserver and having the unlock screen and password entry dialog as a seperate process. This has two effects: crashing the password entry dialog or the screensaver will not unlock the desktop, and if you do somehow manage to crash ksmserver the session will immediately terminate, because ksmserver exiting for any reason is how X decides that the session is over. This is a bit like Wayland's solution, except with much less potentially buggy and crashy code in the process responsible for locking the desktop.

I had forgotten about that redirection (and didn't read your note), so I thought you were making a crude joke with that link at first.

The Referer header can't die soon enough. Or HN could implement rel=noreferrer (at least on links to this website) or the relevant CSPs. Or jwz stop doing this redirection but I don't see this happening.

> I suspect wlroots based compositors are not particularly inefficient,

AFAIK, nobody has done any performance analysis on wlroots, so nobody knows whether they are efficient or not.

They are "fast enough" for most people, so nobody has felt the need to look into this either.

This seems to have been downvoted. If someone knows of any performance analysis of wlroots, with a per frame analysis of perf, please go ahead and share it.

Reply on news.ycombinator.com