this post was submitted on 24 Nov 2023
11 points (60.0% liked)

Linux

47290 readers
2390 users here now

From Wikipedia, the free encyclopedia

Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).

Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.

Rules

Related Communities

Community icon by Alpár-Etele Méder, licensed under CC BY 3.0

founded 5 years ago
MODERATORS
 

I use KDE. Some use GNOME. Most other options are probably to be left out as X11 is unsafe.

Cosmic is not nearly finished, but will probably be a bit safer, as its in rust, even though not tested.

Then there are window managers like Sway, Hyprland, waymonad, wayfire, etc.

RaspberryPi also has their own Wayland Desktop.

Is every Wayland Desktop / WM equally safe, what are other variables here like language, features, control over permissions, etc?

you are viewing a single comment's thread
view the rest of the comments
[–] chaorace@lemmy.sdf.org 13 points 9 months ago* (last edited 9 months ago) (1 children)

Wayland is Wayland. If you use a Wayland compositor, you're getting a lot of security by virtue of design alone. Things like keyloggers and screenrecorders will not be able to intrude on your session barring vulnerability exploits. I'm not going to touch on the relative vulnerability risk of each environment since a) they're all relatively new & b) I've never implemented Wayland myself

With that being said, here's what's not protected by Wayland regardless of the chosen compositor: microphones, webcams, keyrings, and files.

For microphones & webcams, any distro which rolls Pipewire in combination with Wayland will be sufficient to secure these. Pretty much all Wayland environments roll Pipewire so this is only important to consider if you're running your own customized environment (be sure to disable any pre-existing PulseAudio daemon after setting up Pipewire to close this security hole)

For keyrings, these are handled by your environment's polkit implementation. Much like Wayland, there are several implementations of polkit and they're all just about equally secure barring any potential vulnerabilities... Just make sure that you're using an encrypted database (usually on by default) and that you have it configured to always relock & properly prompt for the unlock key.

For file access, this is actually a core probelm with Linux as a whole -- any unsandboxed application you run will be able to read any file that you can read. The solution is to use sandboxed applications whenever possible. The easiest way to achieve this is through using flathub/flatpak applications, since they will always list out and enforce their required permissions on a per-application basis. For non-flatkpak applications, you'll need to use "jail" environments (e.g.: bubblejail, firejail) in order to artificially restrict application permissions by hand.

[–] kevincox@lemmy.ml 2 points 9 months ago

Things like keyloggers [...] will not be able to intrude on your session

This isn't really true. Run libinput debug-events. In most distros users will have access to run this and keylog all input events.

I use Wayland and love it, but keyloggers are not prevented on most common setups.