Honest question: why does this matter? If you end up with running malware as your user haven't you already "lost" in any of a wide variety of ways that Wayland does nothing against?
Or is it that Wayland is trying to bring the mobile security model to the desktop with partially untrusted apps?
The security benefits of wayland are useful when you're also using other things like namespaces/seccomp (with bubblewrap/flatpak), and pipewire which I believe has a similar access control mechanism.
>Or is it that Wayland is trying to bring the mobile security model to the desktop with partially untrusted apps?
I trust my programs, but they can have bugs when parsing untrusted content. (ffmpeg, browsers). Although I've never been hacked, I'd like my systems to have defenses against this (without going full mobile security mode and giving up functionality and user freedom, or running everything in inconvenient isolated boxes with VMs).
Also, I'm not sure if I'd trust proprietary games, so preventing them from doing naive things (I don't expect them to exploit kernel vulns) like snooping on files by using namespaces is nice.
But the Linux ecosystem builds up to things bit by bit. So in this case, Wayland is progress towards a goal where untrusted apps can be run and are limited in what they can do by design. It doesn't matter at the moment, but one day it'll be an important brick in a secure system.
That isn't a mobile security model. It's a good and more modern security model. Desktop operating systems are moving this way too but it's harder due to apps not originally being designed for it.
No. Your web browser does a pretty good job of not storing your login info (if you tell it not to) locally. Under X, malware can monitor everything you do and log your credentials. Under Wayland it can not. Simple as that.
Malware will still try to exploit bugs and CVEs to get access, but finding a hole in a wall is entirely different than not having a wall in the first place. Holes can be patched.
People run untrusted code on their machines every day. Most of it is in the browser (which has walls) and is written by advertisers that are not well scrutinized by the sites people visit. Then there is the whole trend of containers which put more walls around native apps.
So in your question, replace malware" with "untrusted code" and it becomes more realistic.
Anyway to echo beanjuiceII's point, number of times I've been pwned by an X keylogger: Zero.
(That you know of). Number of times I've been pwned by any technical vector (that I know of): zero. The fact it hasn't happened to you does not imply that defending against it is pointless. Early in my computing career I used the same weak password for everything. Never had an account takeover. That does not imply that using different secure passwords for each site is pointless.
The number of ways I might have been pwned and not known about it is basically infinite. Why should I prioritize replacing X11 over any other hypothetical threat for which I have no evidence that I'm at particular risk of? Nobody has photographed my house keys and made copies that I know of. Should I re-key all my locks just to be extra safe? I could replace my front door with an armored door too.. but a burglar would just come in through a window instead so what would be the point?
There's no point armoring your front door unless you also put bars on all your windows, and there's no point adopting wayland for security unless you fix all the other security problems with running malicious software on the GNU/Linux desktop too. And miss me with the QubesOS/flatpack/etc suggestions, my days of playing amateur sysadmin are over I just want to use my computer, not tinker with experimental desktop administration.
That's not true either. The malware would require privilege escalation to co-opt my browser. Even if you weren't wrong about that, I don't know why you complain about both weak security models AND a very big improvement in Linux security (Wayland).
Oh right, on X the malware could just wait for me to type in my password for something I wanted to do and grab it. then it could sudo just like me.
Does it? Sure it can't replace /usr/bin/firefox, but what's stopping the malware from writing a fake shortcut to ~/.local/share/applications/malwarefirefox.desktop and waiting until you click the fake shortcut? Or kill the running firefox and start the malware version? Or add some malware extension directly to ~/.mozilla/firefox/profiles? Or something else?
Or are you assuming the malware is running in a sandbox like AppArmor?
This means 99.9% of actual threats to your security remain the same.
If you want actual isolation you need to run something like qubes which ironically actuality uses X
Unfortunately most linux distros and users do not take security seriously unless it's in a server environment. Desktop linux is awfully far behind systems like MacOS.
This is a doomer mindset that ignores the advances the rest of the industry has been making. There is a big difference from malware having to find a 0day in order to cause harm to the user and malware developers being able to do exactly what they want without even a permission dialog box showing up.
I won’t debate whether that’s true (it probably is, given that “not compromising your data or credentials” is close to a tautology “if you don’t let your stuff get stolen, it won’t get stolen”), but focus on
> This means 99.9% of actual threats to your security remain the same.
I don’t see how that follows because we’re not living in “traditionally” anymore.
IMHO, if iOS and Android had run “traditional X Windows”, the number of successful over the air attacks would be way higher or nobody would use smartphones out of fear of getting hacked.