Fedora Linux Looks To Close Another "Large Attack Surface" With The X.Org Server

[phoronix]

Phoronix: Fedora Linux Looks To Close Another "Large Attack Surface" With The X.Org Server

Fedora is looking at disallowing X.Org/XWayland clients of difference CPU endianess from connecting to the X.Org Server. Such a combination of different endianess between the X.Org Server and clients is rather rare these days but is yet another "large attack surface" of the X.Org Server that needs addressing...

https://www.phoronix.com/news/Fedora-Disallow-Endianess-X.Org

[Monsterovich]

The safety nerds are coming again.

[avis]

In my 25+ years of using Linux I've never even seen X11 applications with a different endianess let alone run them. Someone has to have some very quirky devices or emulation programs to have/run those. It's cool a possible vulnerability is to be addressed but, oh boy, I'm not sure this has warranted a whole news piece.

[Volta]

The safety nerds are coming again.

Not everyone grew up on windows where security and privacy are just slogans.

[Volta]

In my 25+ years of using Linux I've never even seen X11 applications with a different endianess let alone run them. Someone has to have some very quirky devices or emulation programs to have/run those. It's cool a possible vulnerability is to be addressed but, oh boy, I'm not sure this has warranted a whole news piece.

It's a clickbait. Just like m68k strcmp() article. EDIT: Ok, when comes to first part I tried to make an impression I'm not always against X. The truth is I want this old junk burn in fire.

[zboszor]

In my 25+ years of using Linux I've never even seen X11 applications with a different endianess let alone run them. Someone has to have some very quirky devices or emulation programs to have/run those. It's cool a possible vulnerability is to be addressed but, oh boy, I'm not sure this has warranted a whole news piece.

Around 2001-2002, I have set up Fedora with XDM on colleagues' PCs so they could login to Sun Sparc workstations and run some apps. It worked fine then. This is exactly the scenario that is now disabled. 20 years is a lot in terms of bitrotting, though.

[Beherit]

The code was hand-written, what would be the other ways of writing code that is deemed acceptable? AI-generated?

Or do they mean it was written using pen and paper?

[Hibbelharry]

No, it's not clickbait. Remember the holy grail, x11 being network transparent and all really well and without any problems at all? Now go on, connect to some machine with a different architecture via ssh and try to start a X11 app, boom. Sure, most machines today are little endian like any x86, current apple and for the most part arm machines. But if you're talking to a IBM Mainframe or some slighly obscure arm this might hit you in the face.

[oiaohm]

In my 25+ years of using Linux I've never even seen X11 applications with a different endianess let alone run them. Someone has to have some very quirky devices or emulation programs to have/run those. It's cool a possible vulnerability is to be addressed but, oh boy, I'm not sure this has warranted a whole news piece.

https://www.debian.org/ports/mips/

You would not have been dealing with mips based systems or some of the other oddities. Main reason why you would have something mips and arm in big endianness is network processing. Yes Network byte order defined for TCP and so on is Big-endian. There are different mainframes that are still made that are big-endian only and yes Linux is made for these things.

Lot of the cases where you would have different endianess most case proper remote desktop protocol(vnc/rdp) or http or ssh would be preferred over X11

The news is required just in cases there is a case someone has that need the different endianess with X11 that the developers need hear about and possible make solution. I would guess mainframe something.

https://xpra.org/ Yes making solution could be making something like xpra that does just a little extra of making Big-endian X11 applications be little-endian like majority of everything else. Of course if no one need this solution no point going to the massive effort making it.

It's a clickbait. Just like m68k strcmp() article.

More people are starting to use m86k in fpga these days with Linux. It is linked m68k is another pure Big-endian platform. This is not clickbait the problem being detected show people still using Linux kernel on m68k even today.

[coder]

In my 25+ years of using Linux I've never even seen X11 applications with a different endianess let alone run them.

I once worked at a place which ran EDA simulations on Solaris servers and used Linux desktops. We'd frequently run xterms and other stuff remotely, on the Solaris machines. This would exactly fit the usage model of different-endian programs connecting into an X server.

Interestingly, we ran the GNU toolchain on those Solaris boxes. I'm not exactly sure why, as that was already in place when I got there, but perhaps to minimize platform-specific differences.

Does anyone know what endian-ness you get by running Linux on late-model SPARC machines? Are the CPUs even bi-endian, or just big-endian? Depending on the answers, this could definitely affect some people and might not be as untested as the maintainers assume.