Bonum Certa Men Certa

Phoronix Keeps Exaggerating the Severity of X11 Bugs to Promote Wayland, Which is Unfit for Consumption

posted by Roy Schestowitz on Oct 06, 2023

Ladybug Cartoon

Reprinted with permission from Ryan Farmer.

I just got the X11 security updates for CVEs that were recently patched.

“Microsoft Larabel” over at “Moronix” (Phoronix), has been a foaming-at-the-mouth promoter of IBM Wayland ever since 2008 when the idea was announced.

Since Wayland still has at least 50 major problems when KDE 5.27.x LTS runs on it, I can’t switch from X11 right now, and that’s fine with me.

I’ve blogged before, huge blog posts, about how much I despise Wayland. It’s nothing but trouble even under GNOME, which has the most support for it.

(It causes X11 applications, including Windows programs in Wine, to have serious problems up to and including crashing, but usually just performing worse. X11 applications are still the overwhelming majority.)

Promoting something that’s both problematic and unfinished after 15 years and so badly specced out that common use cases are missing and everyone who points it out gets personal invective insults and FUD coming from a general IBM direction, is unacceptable.

Fortunately, the Xorg Server still works fine.

But, Microsoft Larabel and others went off the rail exaggerating the relevance of some recent security flaws.

Alan Coopersmith of Oracle fixed these flaws quickly, and rather well (he patched the X Server to not take corrupt input like that and do something with it anymore, and also the component that was sending the corrupt input so that it wouldn’t do that), and Debian pushed out the updated components today. I installed them immediately and rebooted my laptop.

There’s no way to secure any software that does anything non-trivial. There’s just not. Even this Rust nonsense has had a lot of emergency updates that have broken things.

If you like rewriting your software constantly because they didn’t standardize on anything, make promises, and make sure it worked before the specification was frozen, then Rust is for you. Unfortunately, this is “modern”.

X11 goes back nearly 40 years and is therefore “not modern”.

That’s a problem to these people. Actually supporting something (including the mistakes) and just fixing what’s actually impossible to live with, is “bad”.

That’s their attitude towards everything from programming languages like Rust and Python (which are horrible….people are STILL trying to move from Python 2 even though it’s been unsupported for years….it just adds negative work when they break things), to glibc (Hello DT_GNU_HASH! Let’s just drop DT_HASH with no warning even though they could live together for a while with a notice to developers!), to Wayland.

Why support something when you can just break it all the time and force everyone into this “It’s IBM’s world and you just live in it.” concept?

Rational person that I am, I hail from a time when people were just crazy and wanted their computer to work, so I installed the security updates and now I’m running the improved version of the software that can’t be attacked with those bugs anymore.

They act like Xorg only needs security updates, like all software does, because it’s old.

I wonder what the position on Web browsers, like Chrome and Firefox, where every update is an emergency and every emergency update, monthly, rolls at least 20 CVEs.

By far, the most dangerous application on your computer, is the Web browser you’re reading this in right now. Nobody wants to make that better. Everyone is making that big shitpile higher. Yet, security posers, including Matthew Garrett say that the Web browser is by far the safest way to run “untrusted code”. It’s actually not.

The safest way to run untrusted code is to not run untrusted code. For the most part, I don’t even run JavaScript if there’s any possible way to avoid doing it. Much less WebMs and WebGL, and all of this other garbage they’re dumping on us that’s full of bugs and can never, ever, be made secure.

Unfortunately, the enemies of Free Software throw around the word “trust” and use it wrongly, use it in bogus ways, corrupt the very meaning of the word, intentionally, to promote Microsoft locking down your computer to impose DRM and trap you on Windows.

Trusted code is an application I can verify the authenticity of, from my Linux distribution’s repo or another verified source, and we’ve had the ability to run this code on Linux distributions for decades now. Windows, which “Secure Boot” is designed to trap people on, doesn’t even do this. Get a file from some random site that’s loaded with spyware, and play the “anti-virus guessing game”.

Being trapped on an OS with no concept of security, that was basically designed like this and can’t be fixed without making the OS so terrible that nobody would want to use it (Windows “S Mode”), is not a solution.

Maybe if Web browsers from Google and Mozilla were just a dumb window server from 1984 instead of Google and Mozilla shitting all over the Internet and turning it into Orwell’s 1984, things would get better on the Web browser front.

If your argument is that a lot of these bugs go back to 1988 or 1998, yeah they do.

If this is your argument, then you should try Windows sometime. Tavis Ormandy alone keeps identifying CVEs that go back into the early 90s Windows NT releases and are still in Windows 10 and 11.

There’s a lot of old rotting code in Windows like this, and Microsoft frequently doesn’t act on private reports, for over a year, and then scrambles after the security researchers publicly out them, and then complain about how unfair it is to put them on the spot like that. As if they had been blindsided and not given months or a year to fix it.

Again, tell me how X11 is somehow special. Find a bug, squash a bug, apply the update.

Same as any other software.

Other Recent Techrights' Posts

Sheriff of Cork & Debian Edward Brocklesby or Brockelsby Street confusion
Reprinted with permission from Daniel Pocock
Over at Tux Machines...
GNU/Linux news for the past day
"Conviction for a Crime he Did Not Commit," Said Jennifer Robinson
Robinson is the kind of woman accomplisher we should look up to
An Extended Statement on Julian Assange
Assange's release was not important enough to "make the cut" for News, only "tweets" and other Social Control Media nonsense.
Microsoft Falling to New Lows in Aruba
Being below 20% in America is the exception, not the norm
 
Debian Project Still Has a Lot of Explaining to Do...
Assange was actually a Debian Developer
[Meme] When Ian (of Debian) Was Still Alive
I wasn't always a Debian Developer...
"Julian Assange is Free"
Published ~34 minutes ago
GNU/Linux Userbase Surging in Iceland
Maybe there's something big going on, like people deleting Vista 11 in droves and installing GNU/Linux instead
Jennifer Robinson: "After 14 years of legal battles, Julian Assange can go home a free man”
She explains the implications for the general freedom of the press
Judge: Assange Leaves Court 'A Free Man'
on his way to Australia now
Julian Assange verdict: guilty, not guilty or blackmailed
Reprinted with permission from Daniel Pocock
12 Months Ago the FSF Said It Would Issue a Statement on IBM Taking RHEL Proprietary
Statement never happened
Microsoft's Bing Fall From 2.6% Before LLM Hype to Just 0.79% Right Now in Russia
statCounter's data
[Meme] Speaking Truth to Power (Still Easier in the West Than in Russia/BRIC)
Different people, different outcomes
IRC Proceedings: Tuesday, June 25, 2024
IRC logs for Tuesday, June 25, 2024
The Plot to Silence (or Deplatform) Techrights
This past month I've been spending time working on the text of an online publication
[Meme] Julian Assange's Lawyers Need to Ensure Assange Maintains Freedom to Publish
Let's ensure he can continue to publish
Trying to Make Blogs (Independent and Mostly Decentralised Platforms) What Comes After Social Control Media
Social Control Networks 'stole the thunder' of blogs, but can we get back to blogs?
Julian Assange Has Landed
There will probably be some press interviews some time this month or next month
L is for Linux and Lao
Lao should really have something called LaOS
[Meme] Need More Sites Like Wikileaks, Not Less
On US government vs Wikileaks
We Know Who Stands to Gain From the Demise of the Press
the Assange release was a win for his family, but likely a dire loss for press freedom
[Meme] Think Twice Before Exposing or 'Embarrassing' Powerful People and Interests
The United States government has basically won the Assange case
The Open Source Initiative (OSI) is Openwashing, Ben Cotton (Fedora) Acknowledges It, Fails to See How Bribes Led to That
As if... it "just happened"
Links 25/06/2024: RAM Stress, COVID Graft
Links for the day
Gemini Links 25/06/2024: Hey Hi Punditry and Right to Repair
Links for the day
Links 25/06/2024: Julian Assange Freed From Prison, "AI" Bubble Imploding Some More
Links for the day
Three Points About Julian Assange Plea Deal
There is still a secret problem
[Meme] EFF Became a 'Bunch of Pussies' Working for GAFAM (and Sponsored by GAFAM)
It won't protect people, except very rich people's interests
IBM Does Not Care for the Blind (Wayland Harms Accessibility)
What a punch in the gut
Who Is This Backup FOR, the NSA?
As Admfubar put it, "backups for everyone..."
Tux Machines Past 20: Still Thriving
Now 20 years and 2 weeks old
[Meme] Microsoft is Coming /Home
"LOL, REAL SORRY!!!"
Microsoft's Siege of Libya Coming to an End
One might be tempted to guess the users deleted Windows and installed something else
Gemini Links 25/06/2024: Old Computer Challenge; An Opinionated GNU/Linux Guide
Links for the day
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Monday, June 24, 2024
IRC logs for Monday, June 24, 2024
IEEE Computer Society on Andrew Tanenbaum, Winner of ACM Award, Who Also Inspired Linux Development
10 years ago
New Talk by Dr. Richard Stallman Published Two Days Ago By CeSIUM - Centro de Estudantes de Engenharia Informática da Universidade do Minho (Portugal)
The FSF no longer mentions Richard Stallman's talks, but we will
FSF Looking to Raise Money by Adding 200 New Members by July 19
The FSF is in good shape, according to Alexandre Oliva
Not Only Does It Not Add Security... (UEFI as a 'Bug Door')
SecureCore?
Data From Monaco Should Alarm Microsoft
Just how many people are deleting Windows and installing something else this year?
Name the Threats and Threat Actors
Looking back to 2006, there was Novell and gregkh (partly salaried by Microsoft), so these are familiar territories
Linux in Central Sahel (Burkina Faso, Mali and Niger)
Vast area, vast number of "Linux users" (if one counts Android as such)
[Meme] Gagging One's Own Staff as a Signal of Corporate Distress
Censorship at Microsoft
The "Other" SPLC
You know you're winning the debate when censorship is explored
Staying the Course
censorship isn't easy against sites that understand ways to resist it
The 'All-Seeing' Microsoft Eye
Microsofters are observing us closely
Links 24/06/2024: Long COVID and "How I Write Blogs"
Links for the day
Microsoft: By Default, Destroy Linux
Here is what the very "polite" Microsoft Boccassi had to say
Allegations That Microsoft is Covering Up Employee Dissatisfaction and Using a Survey to Catch 'Risk' to the Cult Mentality
This favours or gradually socially-engineers a company for sociopathy
'Linux Hint' Inactive for Nearly a Month (It Used to be Very Active)
Their Twitter account hasn't been active for a long time and it's not too clear what's going on
An Unexpected GNU/Linux Trend
Burkina Faso is changing and not just politically
Android (Linux) at New Highs in Burkina Faso, Now Measured at 72% (Windows Was Measured at 98% 15 Years Ago)
based on this month's estimates
With 0.76% for ChromeOS and 3.7% for GNU/Linux (4.5% Total) Burkina Faso Approaches 5% for 'Linux'
More if one counts Android as "Linux"
Gemini Links 24/06/2024: Being Dull and OpenSSH Autoban
Links for the day
EPO Issues in The Hague
a report dated 4 days ago about a meeting that took place 12 days ago
[Meme] Garbage in, Garbage Out (EPO Patent Quality)
"Get back to work"
When the Employer Makes You Too Sick to Go to Work (New EPO Document)
"registering when you are sick"
Perens on a Stick
Remember what Novell did and how few (barely anyone) sided with Novell
Andrew Tanenbaum Gets an Award for His Work on MINIX
ACM one week ago
Twitter's Fall to Irrelevancy in Europe
Musk bought a dud
[Meme] 'Useless' Kids of EPO Examiners
malnourished?
Granting Loads of Monopolies in Europe (to Foreign Corporations of Epic Size and Far Too Much Power Inside Europe) is Vastly More Important Than Raising European Kids Properly?
"Efficiency" first? Whose? Corporations or families? No wonder so many young families are hesitant to have any kids these days; that's particularly true in east Asia and also in north America, not just Europe
[Meme] Putin's Red Flags
Firefox ESR or Firefox USSR
The Corporate/Mainstream Media and Even Social Control Media is Distorting the Record About What Mozilla Actually Did (It Originally Surrendered to Vladimir Putin)
Mozilla being avoided for purely technical reasons (sites not being compatible with it) is one thing. Foolishly, Mozilla is giving people more political reasons to also shun Mozilla. This is suicide.
GNU/Linux Up Some More This Morning, Windows Down Sharply Even in Rich Countries
Microsoft is in trouble in the Muslim world
United Arab Emirates (UAE) Rising... Towards 5% for ChromeOS and GNU/Linux
the latest numbers show it growing from about 0.1% to around 2.4% for GNU/Linux, plus 2.01% for Chromebooks (ChromeOS), i.e. about 5% in total.
Techrights in the Coming Decade: The Free Speech (Online) Angle
Free speech is a fundamental tenet of a free society
Links 24/06/2024: New Research, New Attacks on Justices Sceptical of Patent Maximalists, European Commission for Copyright Maximalists
Links for the day
[Meme] 12 Years a Fedora Volunteer
IBM gives me a 'free' Fedora badge as recognition
IBM Slavery: Not a New Problem
When IBM got rid of Ben Cotton it showed the world how much it valued Fedora
Why They Want to Abolish Master/Slave Terminology (Because This is What They're Turned Free Software Into)
It used to be about community; GAFAM turned that into exploitation and worse
Roy and Rianne's Righteously Royalty-free RSS Reader (R.R.R.R.R.R.) Version 0.2 is Released
They say summer "officially" started some days ago
Torvalds' Number Two Quit Linux a Decade Ago and Has Since Then Earned an Honorary Doctorate
Revisiting Fuzix and Alan Cox
GNU/Linux Reaches All-Time High in Tunisia
Based on statCounter
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Sunday, June 23, 2024
IRC logs for Sunday, June 23, 2024
Edward Brocklesby (ejb) & Debian: Hacking expulsion cover-up in proximity to Oxford and GCHQ
Reprinted with permission from Daniel Pocock
You Know the Microsoft Products Really Suck When...
"Qualcomm and Microsoft go 'beyond the call of duty' to stop independent Copilot+ PC reviews"
IBM and "Regime Change"
Change of regime is not the same as freedom
Microsoft Windows in Nicaragua: From 98% to Less Than 25%
Operating System Market Share Nicaragua
Techrights in the Coming Decade: The Community Angle
Somebody needs to call them out on their BS
Techrights in the Coming Decade: The Software Angle
Gemini Protocol has just turned 5 - i.e. roughly the same age as our Git repositories
Techrights in the Coming Decade: The Patent Angle
Next month marks 10 years since we began covering EPO leaks
Wookey, Intrigeri, Cryptie & Debian pseudonyms beyond Edward Brocklesby
Reprinted with permission from Daniel Pocock