Hacker News Reader

Why is X11 unsandboxable? A similar but reverse approach to Xwayland, something like waylandX could be used to be part of the overall sandbox approach to run untrusted applications. That would have the advantage that the severe restrictions and feature degradations of wayland are only applied to those untrusted sandboxed applications, not everything.

View on HN

Ultimately, X11 opens up everything. What you suggest (WaylandX) is essentially allow-by-default.

When this is the case and there is a supply chain attack, what you think is a trusted application (and therefore not running under "WaylandX") can very well keylog you or take screenshots of your desktop without your consent.

In a deny-by-default model ala Wayland, applications will have to ask for permissions before they can do something considered to be privileged.

Reply on news.ycombinator.com