|
|
Log in / Subscribe / Register

Xlibre

Xlibre

Posted Jun 16, 2025 13:48 UTC (Mon) by pizza (subscriber, #46)
In reply to: Xlibre by eru
Parent article: Ubuntu 25.10 to drop support for GNOME on Xorg

> ssh is nowadays a common piece of infrastructure with multiple uses, so it can be assumed to be available. Rather like sh, ls, cat etc. Waypipe is specialised, complex, and has a ton of dependencies.

So... [random X11 application] isn't specialized, complex, with a ton of dependencies? I mean, if you're trying to run an X11 application remotely, you're going to need at minimum full client xlib+whatever else on one side, and an running xserver+whatever else on the other side. In other words, by definition, both sides need to have everything necessary to run said application, and *all of it* is outside the scope of what ssh provides (ie a forwarded TCP connection)

Along that line, nothing prevents [Portable] OpenSSH adding support for wrapping waypipe, eg by adding -W and associated configuration options. There's plenty of precedence, not just with X11 (via -X) and various authentication agents but also things like scp/sftp which work by forking off separate executables (on both sides) and shuffling data between the two.

(I would also point out that openssh's -X option claims to support interacting with X11 "Security extensions" by default; I don't know exactly what that entails under the hood but it's clearly more than just setting up a port forward and setting $DISPLAY on the remote side)


to post comments

Xlibre

Posted Jun 17, 2025 1:50 UTC (Tue) by raven667 (subscriber, #5198) [Link] (1 responses)

> openssh's -X option claims to support interacting with X11 "Security extensions"

I think this refers to running xauth to set an MIT Magic Cookie value in ~/.Xauthority which is like an API token that prevents other users on the same system from just connecting to your forwarded X11 port on localhost and rickrolling (at best) your screen.

Xlibre

Posted Jun 23, 2025 8:29 UTC (Mon) by cortana (subscriber, #24596) [Link]

The SECURITY extension allows certain clients to be marked as "untrusted" which prevents them from being able to spy on input events, take screenshots of other clients and so on.

Unfortunately many clients break completely under such restrictions. For many years, Debian patched OpenSSH to disable the use of the SECURITY extension by deafult. Nowadays I think the situation is a bit better but I've not used X11 forwarding for a long time so haven't verified.


Copyright © 2026, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds