Xlibre [LWN.net]

Xlibre

Posted Jun 16, 2025 12:37 UTC (Mon) by eru (subscriber, #2753)
In reply to: Xlibre by intelfx
Parent article: Ubuntu 25.10 to drop support for GNOME on Xorg

ssh is nowadays a common piece of infrastructure with multiple uses, so it can be assumed to be available. Rather like sh, ls, cat etc. Waypipe is specialised, complex, and has a ton of dependencies. X11 remoting has worked well for my needs, obviously I am not running games or video editors through it. Anyway, I'll stop grumbling now.

to post comments

Xlibre

Posted Jun 16, 2025 13:48 UTC (Mon) by pizza (subscriber, #46) [Link] (2 responses)

> ssh is nowadays a common piece of infrastructure with multiple uses, so it can be assumed to be available. Rather like sh, ls, cat etc. Waypipe is specialised, complex, and has a ton of dependencies.

So... [random X11 application] isn't specialized, complex, with a ton of dependencies? I mean, if you're trying to run an X11 application remotely, you're going to need at minimum full client xlib+whatever else on one side, and an running xserver+whatever else on the other side. In other words, by definition, both sides need to have everything necessary to run said application, and *all of it* is outside the scope of what ssh provides (ie a forwarded TCP connection)

Along that line, nothing prevents [Portable] OpenSSH adding support for wrapping waypipe, eg by adding -W and associated configuration options. There's plenty of precedence, not just with X11 (via -X) and various authentication agents but also things like scp/sftp which work by forking off separate executables (on both sides) and shuffling data between the two.

(I would also point out that openssh's -X option claims to support interacting with X11 "Security extensions" by default; I don't know exactly what that entails under the hood but it's clearly more than just setting up a port forward and setting $DISPLAY on the remote side)

Xlibre

Posted Jun 17, 2025 1:50 UTC (Tue) by raven667 (subscriber, #5198) [Link] (1 responses)

> openssh's -X option claims to support interacting with X11 "Security extensions"

I think this refers to running xauth to set an MIT Magic Cookie value in ~/.Xauthority which is like an API token that prevents other users on the same system from just connecting to your forwarded X11 port on localhost and rickrolling (at best) your screen.

Xlibre

Posted Jun 23, 2025 8:29 UTC (Mon) by cortana (subscriber, #24596) [Link]

The SECURITY extension allows certain clients to be marked as "untrusted" which prevents them from being able to spy on input events, take screenshots of other clients and so on.

Unfortunately many clients break completely under such restrictions. For many years, Debian patched OpenSSH to disable the use of the SECURITY extension by deafult. Nowadays I think the situation is a bit better but I've not used X11 forwarding for a long time so haven't verified.

Xlibre

Posted Jun 16, 2025 16:11 UTC (Mon) by intelfx (subscriber, #130118) [Link]

Of course, OpenSSH (not just ssh, but very specifically OpenSSH) is going to be more widely available than Waypipe, simply by virtue of being an older and more established technology (as well as historical precedent). However, we weren't discussing that:

>> <...> With X11, you get the functionality out of the box. <...>

What we were discussing is that both are structurally *third-party software*. There is nothing conceptually "out-of-the-box" about `ssh -X`, not any more than Waypipe. Whether the latter is significantly more specialized and complex is in the eye of the beholder.

> X11 remoting has worked well for my needs

Nobody was disputing that. We were talking about whether it actually is a "killer feature".