On Sunday, August 21, 2016 at 4:40:55 AM UTC-7, kev27 wrote: > I know Joanna has long talked about how insecure X11 is and how the Qubes > team worked to isolate the GUI. Wouldn't it be simpler if Qubes became > Wayland-only sooner?
the gui isolation issues are mostly solved by the current version of qubes, but it is messy under the hood. the biggest current problem is the lack of isolation within a vm. just making more vms quickly adds up in resources. you could run firejail with xpra in an appvm. havent tried it in qubes yet, but thats how i do it on my work laptop. the gui tools would have to be a wayland compositor, not just a window manager. given how qubes works, this will probably smaller and cleaner than the x11 based tools. the first target should probably be dom0. qubes has so many problems with graphics drivers that this might actually help. > It seems Fedora 25 will enable Wayland by default , but I think it will > still have a XWayland layer for app compatibility. Will Qubes need that, too? > Or can it become Wayland-only by the time Qubes OS 4.0 is out? Are there > still too many components in the Fedora core that need X11 and can't be > transitioned to Wayland anytime soon? im running fedora 24 with wayland in a vm. most of the apps run in wayland, some are still x11. firefox, chrome, and thunderbird all run in x11. chromium crashes on startup. firefox-wayland crashes on startup. so, for the most part, some apps would benefit. i also hope this gets sorted out in fedora25, and that makes it in time for default templates in qubes-4.0. > Also, since flatpaks  will take full advantage of Wayland security, and it > seems to be the app packaging format to take security seriously the most > , maybe encourage flatpak use in Qubes 4.0 somehow, and install its > runtime by default in Qubes 4.0? thats already going into fedora 25, so it would inherit it by default. i dont see anything about configuring the sandbox. have you looked at appimage and firejail? https://firejail.wordpress.com/documentation-2/appimage-support/ -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to qubes-users+unsubscr...@googlegroups.com. To post to this group, send email to email@example.com. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/b5d5f98f-723d-4cde-bd48-fb0b5519bfbb%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.