Alright, after going over this in my head a million times, I think I've
reached a conclusion.
I'm very interested in Wayland because of the better client isolation.
There is no reason why *any* X11 client can be a global keylogger, no
exploits required.
Sometimes I'm even panicking about that a little bit.
At the same time, we don't do application sandboxing on a *large* scale
yet. This just isn't a reality yet. Also, I install programs through my
distribution and I *want* there to be a distribution. (Sadly, Kyle
Keen's article "maintainers matter" is offline now.)
Just today, I had to deal with a Snap application and the sandboxing
totally got in the way. I'm not ready yet to rewire my entire brain to
work around this. That's a topic for another day.
(Also, I'm not convinced yet that full sandboxes like Snap are how I
*want* to use my computer. Something like pledge/unveil makes more sense
to me.)
Anyway, when you don't do sandboxing to begin with, it hardly matters if
you're using Wayland or X11. `ping` can read my SSH keys. My terminal
can. `ls` can. `jq` can.
If Wayland gave me a huge boost in terms of security, it would be worth
the sacrifices. We're not there yet.
This whole situation reminds me a lot about my efforts to switch from
Windows to Linux some 20 years ago. I tried to switch to 100% Linux many
times because it was interesting and supposedly better, but it just
wasn't what I *wanted*. There were too many things that caused pain.
Only when I eventually got sold on the philosophical/political/moral
idea of Free Software, I was able to think: "Okay, this is worth it, I'm
gonna push through. This is what I want now."
I'm simply not sold on Wayland yet. All I see are pain points.
I sincerely hope that I'll get convinced eventually -- because if that
doesn't happen and if X11 actually dies some day, I'm gonna be very
miserable.
