Hacker News Reader

> copy-paste

When I was talking about switching to wayland with a colleague, who was already moved over at the time, he tried to convince me that having no copy paste is better for security.

And I, using a password manager that generates unspeakably complex passwords everywhere, was kinda stunned by that blindsightedness.

If you don't want copy and paste, use Qubes OS. That's the philosophy matching the rest of the architecture of the OS.

But as long as you have a binary named "[" on your system, don't try to convince people that you are doing it in the name of security. There is much more rotten fish to throw away before that.

The only thing that recently convinced me to give wayland another go is hyprland. Seeing all kinds of nice WM concepts being implemented in it, maybe hyprland is "the interoperability specification" we needed all along.

On the other hand, I think it’d make total sense to implement an optional mode that blocks programs’ ability to read the clipboard until the user explicitly approves them. I understand why some people might not want that (which is why I’d like it to be a setting), but it’s always felt a little weird that any program on desktop programs can grab the clipboard at will.

Things like making the clipboard “intelligent” might help too. On macOS there’s a bit of this when copying passwords from the system password manager, where the clipboard is cleared either after paste or after some short period of time to reduce chances of grabby programs pulling it.

I feel like there's some other reasonable middle grounds too. If you don't want your clipboard to always be cleared, it seems sensible to e.g. only allow the currently active window to read the clipboard.

Yeah, or show a popup with the name of the window that just grabbed your paste buffer.

It makes a huge amount of sense to control what programs can snoop on each other. There won't be a lot of people against the idea in principle. Eventually the Wayland ecosystem will be strictly better than X because at least there is some amount of control over that sort of thing.

The problem that Wayland had is it took the stance of "just no!" and that means Wayland is now almost an adult (15 years, so a little time to go) and only just arrived at a place where a Wayland compositor is about as useable as an X11 based system (thanks Pipewire). Wayland has been a mess for so long I think even in Debian Bullseye swaywm didn't support Zoom (or any other program) screensharing. Which for 2022 was a remarkable gap in capability. I'm all aboard for the Wayland transition because it is a definite improvement, but Wayland's "security" debacle is a legendary case study in design gone wrong.

It's not just security, there's a bit of an over-obsession with generalised future-proofing: useful optional proposed protocols have been shot down because they 'assume windows will be laid out on a screen with xy coordinates'. It's a recipe for committee bikeshedding to run rampant, especially with multiple very opinionated parties involved, any of which can torpedo even an 'accepted' extension by just not implementing it. It's a nightmare of fragmentation.

The X11 primary selection buffer is an even better variant of that though. It allows single-shot copy&paste (meaning only one application can grab it) from the password manager to the target application and it tells the password manager the name of the application that grabbed it.

I think it shouldn't be too hard to hack in a dialog to password managers to confirm if the destination is correct before replying to the data request. But even without that one at least notices that a malicious/wrong application grabbed the password.

Preach it! I'm always dumbfounded by the insanity on MS Windows (and nowadays Gnome, too!) that disallows copy-pasting into the UAC. Do they want me to use weak passwords? I don't get it.

What's wrong with having a symlink called '[' for 'test'?

A programming language should not be parsed and neither lexed on the filesystem layer. This is what REPL or interpreters are for.

Counter question: would you have all C++ macros from libboost as symlinks on the filesystem, too? How would that work? /usr/bin/C++/[ and /usr/bin/bash/[ maybe? What's the difference of the operator behaviors, given that macros exist?

If you're not understanding where I am getting at: these types of hacks were the reason for a lot of fuckups and a lot of CVEs in the past. Directly or indirectly. I'd even encourage every distro to use busybox at this point, just for having a centralized entrypoint for your shell scripts.

I have come to love shells with little special syntax, namely fish, so generally write

  if test

rather than

  if [

in any shell. I'm not particularly a fan of special syntax, let alone external commands pretending to be special syntax.

But restricting commands to specific character sets also seems a bit cheesy to me. It seems more natural that a character is a character. I can see the other side here, though.

I'm curious about those CVEs. Surely any script involving the hijacking of `[` to obfuscate malicious code could also just as well have hijacked `test` (wherever `test` is not a shell built-in), right?

> I'd even encourage every distro to use busybox at this point, just for having a centralized entrypoint for your shell scripts.

For operating system scripts, I guess that's fine. But administrators who are writing their own scripts should choose a shell that's actually pleasant to read and write, and ship an appropriate runtime, including external commands. You can do this today in a portable way with Nix or Guix and a bit of footwork, just as well with bash as with Python.

If you're writing scripts in something other than your daily login shell, you might as well use a non-shell programming language, because you're now losing the advantage of writing in a language that you practice constantly. And BusyBox is not a pleasant daily login shell, so you shouldn't use it for that, either.

> Surely any script involving the hijacking of `[`

It's not about hijacking of any binary, it's about mutation of state, and having to keep the same parsing state across multiple binaries, which is very bad practice (apart from USR1/2 and stdout/stdin not even remotely being made for that).

Keep in mind that the architecture we are speaking about was implemented when an OS had less than 20 binaries overall.

Now we have thousands of binaries with absurd levels of complexity, and nobody really knows what's going on anymore.

This still seems very handwavey to me with respect to the actual vulnerabilities. And the only 'split parsing' going on is external commands parsing arguments passed to them. `test` doesn't parse bash or any other shell. `[` is not special, either; it doesn't have to communicate anything back to the shell invoking it about how to parse the rest of the program, either!

Are you categorically against shell scripting (the invocation of external binaries as commands), then?

I'm confused, as every desktop environment and tiling window manager I've tried on Wayland has had copy-paste. There has never been a point in my Wayland experience where I had to even think about this.

You're speaking as though there is someone out there operating without that capability, when my experience has been the opposite. If that was the case you'd hear about it in every single "Wayland is bad" video, instead of the usual focus on nvidia (which I also have no issues with, even using Prime).

It was a problem in the early days. Some clipboard interop bugs between wayland-native and xwayland apps persisted for quite a while after too, but those have also been solved some time ago now.

There is (was?) an keepassxc issue where the auto fill shortcut won't work due to wayland limitations... That was one time i remember wayland to be not working for my usual flow.

> I'm confused, as every desktop environment and tiling window manager I've tried on Wayland has had copy-paste

what's the wayland equivalent to xclip that works on every WM ? e.g. `uuidgen | xclip -selection clipboard`

wl-copy

Some background here:

https://wiki.gnome.org/Initiatives/Wayland/PrimarySelection

My understanding is that PrimarySelection is not supported by Wayland out of the box. It has to be implemented optionally by Wayland servers. See https://github.com/swaywm/sway/issues/1012 .

Also IIRC you still can't copy-paste between VMs on wayland (although that could be outdated by now)

And here we are, those are my two cents and my experience. I have used Linux for years, I liked the idea of defending something free and open.I absolutely love KDE and its personalization ability, it’s just exactly what I want.

Yet, I’m back on Windows, I like well defined screen, I have a 4K another one of lower resolution, to handle that well, I need Wayland, heck KDE just sometimes has less features or less solved bug on X11 now.

And at night I just want to watch one or two things before sleeping, I just need to turn my screen to my bed, and choose one the suggestions of plateforms like YouTube or Netflix with my mouse. …Yet, sometimes I like to type something, it’s usually short so I just use and on screen keyboard program which I’ve still wait to find one that works for Wayland.

This is so dum, it’s crazy to me that we used to fly away from all the dysfunctions of Windows to go the sane Linux ecosystem to only find that is starting to look a bit absurd on that side too. And we look at the discourse of Wayland devs, they speak exactly like corporate would do.

So that and few package management breakage and I think this is also a weak point of the ecosystem, tends to break, to upgrade everything when you only need one thing, too complex too trouble shoot.We usually think we have superior technological paleform on with Linux kernel, but package management is one of the weak point IMO.

All of that pushed me outside of Linux for now.When I encounter something that looks infuriating on Windows, I just think I might see something like this on Linux.

Edit: typos

For work, Windows is not it for me anyone; it's a constant and distracting cesspool of ads for Microsoft services. In contrast, KDE wins here, by far, and not just because it's not distracting.

As for night time, I don't want or need my computer; I'll grab a tablet and consume all the content I want.

As for package management, let me know when I can type a single command on Windows and have my entire system and applications up-to-date.

I can only agree, Windows with its force restart, ads and little bugs and lags everywhere makes it a less suited plateform than Linux for word.

I can only lament that it’s kind of the opposite for personal usage.

> Yet, sometimes I like to type something, it’s usually short so I just use and on screen keyboard program which I’ve still wait to find one that works for Wayland.

KDE Connect does: https://kdeconnect.kde.org/

You can turn your phone into a trackpad/remote keyboard, as long as your desktop is running the host software. Works just fine on Wayland, in my experience.

Overall I think people are right to blame Wayland for asking developers to reinvent the wheel, but wrong to defend the first-draft nature of x11. In a truly reductive sense, Linux never really had a desktop that worked. It was a desktop server that got hacked into usability by a lot of contributors, who ended up building a big unusable monolith. Naturally, a solution that is neither big nor monolithic is bound to make people angry.

But, I think we're past the point of lamenting x11's death. It was meant to be this way, Microsoft built Desktop Window Manager and Apple rolled out Quartz; sticking with x11 just didn't make competitive sense. Wayland's "big problem" is that it asks desktop developers to go the extra mile, and I don't really think that's a bad thing to ask. Linux didn't need taller, more fragile software stacks; it needs more thoughtful integration and actual diversity in implementation. It's not a coincidence that modern applications like the Steam Deck practically rely on Wayland to deliver such a customized experience.

Thanks for the tip, I’ve already used KDE connect even for iOS-Windows communication, it’s just great.

I think people resort back to X11 because it’s only think that worked for a broad sets of features.Sure we can have Wayland making progress but it seems there’s little resource targeted it, not even implementation but even standardizing some things and we’re 15 years past. Linux kernel itself was already at infamous 2.6 version by then.

Sure proprietary desktops have kind of shown the way. One side, it’s good to have standards clear/clean enough that it can be easily implemented, on the other side, it can just be especially resource taking to redevelop things that are the core difference of the desktop environnement you might be developing.

I can wonder and worry, if we would have and will still ever see something like compiz fusion, the diagonal screen tick seen this year or anything else. Design standards api, inter app communication and make it customizable is no way easy and I feel like Wayland has absolutely not find how to articulate all of those things.

It's going to be a pain-point for a while. I invite you to look on the bright side, though; the past 10 years of Wayland was as bad as it will ever get. We live in wonderful times, where Nvidia/Wayland setups are actually stable; this is stuff people thought would never get fixed 10 years ago, but now we're starting to see the light at the end of the tunnel. There's still work to do, but I think we're passing the point where Wayland has more features than it lacks.

x11 has a place in my heart, I loved many of it's apps (shoutouts to xsnow) and cherished the wildly bloated featureset. But damn, it was broken. MacOS had a pretty terrible compositor for a while, but once you booted up Quartz with double-buffer V-sync (imagine, back in 2005) you would already know x11 was finished. Wayland was the inevitably long-winded response from the Open Source community, and while it languished for a long time it's finally quite usable.

Nobody is going to stop you from using x11, or maintaining it yourself if it comes down to it. The philosophy of the matter is decided, though; smaller featuresets are more secure and easier to implement. Especially since the advent of smartphones, I feel like the idea of an x11-native desktop metaphor has been nonsense. Yes, the GNOME pundits push this point pretty extremely, but there's a kernel of truth to it. We really do need more flexible desktop architectures if we want Linux to be a commercial-quality product. x11 is holding it back.