Re: Netowrk connectivity (was: segfault on font ...)

On 2004-05-19 10:34:03 +0800 Rogelio M.Serrano Jr. 
<[email protected]> wrote:

> On 2004-05-19 09:22:25 +0800 Andrew Suffield <[email protected]> 
> wrote:
> 
>> On Tue, May 18, 2004 at 09:15:39AM -0400, Timothy C. Brown wrote:
>>> When you say "UNIX domain socket" I assume you are talking about an 
>>> AF_UNIX
>>> socket,
>> 
>> It's a PF_UNIX socket. AF_UNIX is the type of their address. The fact
>> that they have the same numeric value on many platforms doesn't make
>> them interchangeable.
>> 
>>> SSH doesn't forward these sockets, it creates an
>>> Xauthority file and forwards the connection over TCP (i'm sure you 
>>> know all
>>> this already - i'm typing it for posterity, for those of us who 
>>> don't know
>>> it).
>> 
>> The above paragraph is wrong in every relevant particular. Every ssh
>> server I can think of can forward X11 using unix domain sockets. The
>> clients obviously can do as they please.
>> 
>> [Skip the lengthly discussion of PF_INET sockets; suffice it to say
>> that this is an SEP]
>> 
>>> Anyway - that was my digression.  Using TCP should be a 
>>> possibility; let
>>> us not ignore it because it is "insecure", when realistically 
>>> *some* 
>>> security
>>> *must* be implemented in Y, beyond what Xauthority generally 
>>> provides.
>>> Session cookies are at least a good idea and the client should be 
>>> smart
>>> enough to re-establish a session (or the server, in the appropriate 
>>> cases).
>> 
>> I have to wonder what you think .Xauthority does if not precisely
>> this, at least with the MIT-MAGIC-COOKIE-1 mechanism (some are
>> considerably more sophisticated, like MIT-KERBEROS-5). It would
>> provide a perfectly adequete security scheme.
>> 
>> However, this need not be implemented in Y, should not be, and
>> probably *will* not be; it's completely the wrong way to go about it,
>> from the perspectives of security, performance, and
>> usability. Xsecurity mechanisms other than MIT-MAGIC-COOKIE-1 are
>> almost never used, and even that is overkill for the scenarios in
>> which it is used. UID-based authentication over unix domain sockets
>> should be all we ever need in the server.
>> 
> 
> Is that why X never put security in the protocol? Is SSH the oinly 
> secure 
> network transport available? How should a security policy implemented 
> with 
> uid authentication then? Is there a super user?
> 
> 
> 

Im using a linux system where there is no superuser and no ssh. no c++ 
too.