We Love Privacy Club

www.uninformativ.de

Wed, Jul 30 2:52AM 2025 (1y ago)

In 1996, they came up with the X11 “SECURITY” extension:

https://www.reddit.com/r/linux/comments/4w548u/what_is_up_with_the_x11_security_extension/

This is what could have (eventually) solved the security issues that we’re currently seeing with X11. Those issues are cited as one of the reasons for switching to Wayland.

That extension never took off. The person on reddit wonders why – I think it’s simple: Containers and sandboxes weren’t a thing in 1996. It hardly mattered if X11 was “insecure”. If you could run an X11 client, you probably already had access to the machine and could just do all kinds of other nasty things.

Today, sandboxing is a thing. Today, this matters.

I’ve heard so many times that “X11 is beyond fixable, it’s hopeless.” I don’t believe that. I believe that these problems are solveable with X11 and some devs have said “yeah, we could have kept working on it”. It’s that people don’t want to do it:

Why not extend the X server?

Because for the first time we have a realistic chance of not having to do that.

https://wayland.freedesktop.org/faq.html

I’m not in a position to judge the devs. Maybe the X.Org code really is so bad that you want to run away, screaming in horror. I don’t know.

But all this was a choice. I don’t buy the argument that we never would have gotten rid of things like core fonts.

All the toolkits and programs had to be ported to Wayland. A huge, still unfinished effort. If that was an acceptable thing to do, then it would have been acceptable to make an “X12” that keeps all the good things about X11, remains compatible where feasible, eliminates the problems, and requires some clients to be adjusted. (You could have still made “X11X12” like “XWayland” for actual legacy programs.)

⤋ Read More

movq

www.uninformativ.de

Fri, Jul 25 3:50AM 2025 (1y ago)

↳ In-reply-to » I was drafting support for showing “application icons” in my window manager, i.e. the Firefox icon in the titlebar:

@lyse@lyse.isobeef.org True, at least old versions of KDE had icons:

GNOME, on the other hand, didn’t, at least to my old screenshots from 2007:

Image

I switched to Linux in 2007 and no window manager I used since then had icons, apparently. Crazy. An icon-less existence for 18 years. (But yeah, everything is keyboard-driven here as well and there are no buttons here, either.)

Anyway, my draft is making progress:

I do like this look. 😊

⤋ Read More

movq

www.uninformativ.de

Thu, Jul 24 12:14AM 2025 (1y ago)

Only figured this out yesterday:

pinentry, which is used to safely enter a password on Linux, has several frontends. There’s a GTK one, a Qt one, even an ncurses one, and so on.

GnuPG also uses pinentry. And you can configure your frontend of choice here in gpg-agent.conf.

But what happens when you don’t configure it? What’s the default?

Turns out, pinentry is a shellscript wrapper and it’s not even that long. Here it is in full:

#!/bin/bash

# Run user-defined and site-defined pre-exec hooks.
[[ -r "${XDG_CONFIG_HOME:-$HOME/.config}"/pinentry/preexec ]] && \
        . "${XDG_CONFIG_HOME:-$HOME/.config}"/pinentry/preexec
[[ -r /etc/pinentry/preexec ]] && . /etc/pinentry/preexec

# Guess preferred backend based on environment.
backends=(curses tty)
if [[ -n "$DISPLAY" || -n "$WAYLAND_DISPLAY" ]]; then
        case "$XDG_CURRENT_DESKTOP" in
        KDE|LXQT|LXQt)
                backends=(qt qt5 gnome3 gtk curses tty)
                ;;
        *)
                backends=(gnome3 gtk qt qt5 curses tty)
                ;;
        esac
fi

for backend in "${backends[@]}"
do
        lddout=$(ldd "/usr/bin/pinentry-$backend" 2>/dev/null) || continue
        [[ "$lddout" == *'not found'* ]] && continue
        exec "/usr/bin/pinentry-$backend" "$@"
done

exit 1

Preexec, okay, then some auto-detection to use a toolkit matching your desktop environment …

… and then it invokes ldd? To find out if all the required libraries are installed for the auto-detected frontend?

Oof. I was sitting here wondering why it would use pinentry-gtk on one machine and pinentry-gnome3 on another, when both machines had the exact same configs. Yeah, but different libraries were installed. One machine was missing gcr, which is needed for pinentry-gnome3, so that machine (and that one alone) spawned pinentry-gtk …

⤋ Read More

movq

www.uninformativ.de

Fri, Jul 18 5:56AM 2025 (1y ago)

↳ In-reply-to » HTTP referrers are quite broken, aren’t they?

@lyse@lyse.isobeef.org Hm, I don’t think so, the requested page was a Linux-specific post. 🤔 I sometimes wonder if privacy-oriented browsers might do this on purpose, to create garbage data? 🤔 No idea.

⤋ Read More

bender

twtxt.net

Wed, Jul 16 10:04PM 2025 (1y ago)

This is it, boys and girls! The year of the Linux Desktop is this! I can smell it! :-D

For the first time, Linux has officially broken the 5% desktop market share barrier in the United States of America! It’s a huge milestone for open-source and our fantastic Linux community.

⤋ Read More

yue-fang-readfog

feeds.twtxt.net

Tue, Jul 15 1:06PM 2025 (1y ago)

FeatherScan v4-0 - 一款 Linux 內網全自動信息收集工具
前言–在平時滲透打靶的時候，經常要自己手工輸入命令，做各種基本的信息收集，非常的繁瑣，所以自研了一款工具，這款工具沒有接入 AI，因爲不合適，接入了 AI 的話在一些不能上網的環境下進行信息收集，權限提升的分析，會非常的不方便，這款工具全都在目標機器本地執行（執行速度快，提高滲透測試效率），類似於 fscan，需要上傳到目標靶機上，後期會增加離線的 POC 和漏洞庫對 linux 系統進行全面的 ⌘ Read more

⤋ Read More

yue-fang-readfog

feeds.twtxt.net

Tue, Jul 15 12:52PM 2025 (1y ago)

Linux 驚羣效應解析，讓性能不再 “浪費”
在 Linux 服務器的複雜世界裏，性能優化如同一場永無止境的馬拉松。衆多影響性能的 “暗礁” 中，“驚羣效應” 頗具隱蔽性卻又影響深遠。想象這樣一個場景：多個進程或線程宛如一羣在巢穴中休憩的鳥兒，同時阻塞等待着同一個事件的發生，如同等待遠方傳來的食物信號。一旦該事件出現，所有 “鳥兒” 瞬間被驚醒，一擁而上。但殘酷的現實是，最終僅有一隻 “鳥兒” 能成功獲取並處理這個事件，其餘的只能失望而歸，重 ⌘ Read more

⤋ Read More

movq

www.uninformativ.de

Sat, Jul 12 8:56PM 2025 (1y ago)

PSA: setpriv on Linux supports Landlock.

If this twt goes through, then restricting the filesystem so that jenny can only write to ~/Mail/twt, ~/www/twtxt.txt, ~/.jenny-cache, and /tmp works.

⤋ Read More

movq

www.uninformativ.de

Tue, Jul 8 4:51AM 2025 (1y ago)

The Linux installation on my main PC turned 14 today:

$ head -n 1 /var/log/pacman.log
[2011-07-07 11:19] installed filesystem (2011.04-1)

⤋ Read More

movq

www.uninformativ.de

Tue, Jul 8 4:24AM 2025 (1y ago)

↳ In-reply-to » I bought the “remastered” versions of Grim Fandango and Forsaken on GOG, because they’re super cheap at the moment. Both have native Linux versions.

@eldersnake@we.loveprivacy.club This wasn’t always the case, though. Quake3, Quake4, Unreal Tournament 99 and 2004 are examples of games that used to run very well as native Linux games. But that was 20+ years ago …

⤋ Read More

eldersnake

we.loveprivacy.club

Mon, Jul 7 1:52PM 2025 (1y ago)

↳ In-reply-to » I bought the “remastered” versions of Grim Fandango and Forsaken on GOG, because they’re super cheap at the moment. Both have native Linux versions.

@movq@www.uninformativ.de reminds me how many Windows games using Proton (or WINE with similar patches) on Linux run better than some of the old native Linux binaries.

⤋ Read More

movq

www.uninformativ.de

Sat, Jul 5 9:02PM 2025 (1y ago)

↳ In-reply-to » I bought the “remastered” versions of Grim Fandango and Forsaken on GOG, because they’re super cheap at the moment. Both have native Linux versions.

In all fairness, GOG says that Forsaken is only supported on Ubuntu 16.04 – not current Arch Linux. If you ask me, this just goes to show that Linux is not a good platform for proprietary binary software.

Is it free software, do you have the source code? Then you’re good to go, things can be patched/updated (that can still be a lot of work). But proprietary binary blobs? Very bad idea.

⤋ Read More

movq

www.uninformativ.de

Sat, Jul 5 8:57PM 2025 (1y ago)

I bought the “remastered” versions of Grim Fandango and Forsaken on GOG, because they’re super cheap at the moment. Both have native Linux versions.

And both these Linux version crap their pants. 🫤 The bundled SDL2 of Forsaken says it “can’t find a matching GLX visual” and I couldn’t figure out how to fix that. I didn’t spend a lot of time on Grim Fandango.

Both work great in Wine. 🤦

(I do have the original version of Grim Fandango from the 1990ies, but that one does not work so well in Wine. I figured, if it’s so cheap, why not. And I now get to play the english version. 😃 The german dub is pretty damn good, actually, but I always prefer the original these days.)

⤋ Read More

movq

www.uninformativ.de

Fri, Jun 20 3:46AM 2025 (1y ago)

Speaking of Wine, Arch Linux completely fucked up Wine for me with the latest update.

16-bit support is gone.
Performance of 3D games is horrible and unplayable.

Arch is shipping a WoW64 build now, which is not yet ready for prime time.

And then I realized that there’s actually only one stable Wine release per year but Arch has been shipping development releases all the time. That’s quite unusual. I’m used to Arch only shipping stable packages … huh.

Hopefully things will improve again. I’m not eager to build Wine from source. I’d rather ditch it and resort to my real Windows XP box for the little (retro)gaming that I do … 🫤

⤋ Read More

kat

yarn.girlonthemoon.xyz

Thu, Jun 19 10:12PM 2025 (1y ago)

update on tux racer: ofc it doesn’t run on modern linux LMFAOOOOOOO i’m installing red hat in a VM right now

⤋ Read More

movq

www.uninformativ.de

Tue, Jun 17 4:28AM 2025 (1y ago)

OpenBSD has the wonderful pledge() and unveil() syscalls:

https://www.youtube.com/watch?v=bXO6nelFt-E

Not only are they super useful (the program itself can drop privileges – like, it can initialize itself, read some files, whatever, and then tell the kernel that it will never do anything like that again; if it does, e.g. by being exploited through a bug, it gets killed by the kernel), but they are also extremely easy to use.

Imagine a server program with a connected socket in file descriptor 0. Before reading any data from the client, the program can do this:

unveil("/var/www/whatever", "r");
unveil(NULL, NULL);
pledge("stdio rpath", NULL);

Done. It’s now limited to reading files from that directory, communicating with the existing socket, stuff like that. But it cannot ever read any other files or exec() into something else.

I can’t wait for the day when we have something like this on Linux. There have been some attempts, but it’s not that easy. And it’s certainly not mainstream, yet.

I need to have a closer look at Linux’s Landlock soon (“soon”), but this is considerably more complicated than pledge()/unveil():

https://landlock.io/

⤋ Read More

Searching We Love Privacy Club