Re: Wayland Is Coming

On Sun, 12 May 2024 00:51:06 -0000 (UTC)
Lawrence D'Oliveiro <ldo@nz.invalid> wrote:

On Sat, 11 May 2024 08:58:29 -0000 (UTC), Muttley wrote:
>

On Fri, 10 May 2024 21:56:59 -0000 (UTC)
Lawrence D'Oliveiro <ldo@nz.invalid> wrote:

>
On Fri, 10 May 2024 08:32:51 -0000 (UTC), Muttley wrote:
>

SSH is the door, whatever is tunnelled is behind it.

>
Which is where I point out that SSH does not validate who or what is
going through its tunnelled port. It is wide open to any process on the
remote machine.

 
If you don't want remote machines to connect to X then
either use xhost to set up whitelists

>
Note that xhost only offers host-level access control: you can’t restrict
accesses from arbitrary processes on the remote machine.

And how do you propose to restrict access to specific processes? Process
name, user, some kind of certificate? All these things can be spoofed.

I did say the door was made of cardboard, didn’t I?
>

... or disable the TCP connection entirely. Simple.

>
In other words, disable the tunnelling you thought was such a good idea?

You're the one who's paranoid about remote connections, not me. But then
wayland can't do this anyway (obviously too hard for the devs), it kicks it
into the weeds and lets higher level libraries do it so the point is moot.