It is my understanding that XACE doesn't actually provide any security features itself. It just provides the "hooks" to implement security extensions. Like LSM feature in Linux kernel. You have to install a additional X11 extension to do something useful with it.
So the most common X11 security extension is going to be xcsecurity which enables the SECURITY extension. It allows a course permission model were applications can be designated as "Trusted" or "Untrusted". That is going to show up in many Linux distributions.
However all applications default to "trusted" because if they are untrusted they tend to cause lots of other annoying problems and crashes a lot of apps, apparently.
In practice the only place it shows up is if you are using "ssh -X". That uses the security extension by default. Which is why there is also a "ssh -Y" that disables it for applications that it breaks.
This sort of thing is why to fix X11 security you have to give up backwards compatibility and create a new X version.
Oh, wait, that is what the X developers did with Wayland.
Lobbyists turning into government regulator is a lot more common then people realize. It is normal regardless of what party occupies the Whitehouse.
This is one of those things were most people don't realize this goes on because it is rarely reported on. Also who is involved in running administrative agencies is largely irrelevant and very boring subject. It isn't like you get to vote for any of them.
Loabyist-as-head-regulator situation is a reflection of how the administrative state actually works and the role that large public corporations play in that administration.
The 'ELI5' explanation is...
Modern politicians are career politicians. Meaning most of them they start off by getting their law degrees and then immediately pursue a political career using whatever connections they have. This means that they have no real experience of the world outside of law and internal bureaucracy of their parties and governments.
This means they are extremely unqualified at regulating any sort of industry. They just don't know anything about 'the real world'. They know nothing about how to make cars, smelt steel, drill for oil or designing light switches.
It is a similar situation for career administrators in the 400+ administrative agencies in the Federal Government. They get degrees in public administrator or in fields related to their regulatory function. Many of the top administrators will have masters and PHDs. But as anybody with experience in the "private sector" there is a very significant gap between what you can learn in a University setting versus what gets applied in actual practice.
So to fill the gap they require the participation of the major corporations in these industries. They help draft legislation, they have representatives in regulatory committees, the provide the information necessary for economic analysis, and so on and so forth.
This, after 80 years of USA history of the modern administrative state, even involves having corporate representatives participate in party politics, sometimes even becoming politicians, and having positions in the agencies that regulate them.
The term for this is "regulatory capture".
There is a trade off for having highly regulated industries. The main one is that by accepting control of the government the government takes on the responsibility of making sure these corporations remain profitable.
The cost of regulatory overhead is very significant and forms a massive barrier of entry for new businesses. So the established corporations are likely the only corporations that are going to exist for some major industries. Once you lose them they are gone forever.
So the more regulation you have the more protective the government needs to be of these businesses and their profits.
Fixing X11's security would of broken window positioning as well. Since that is a security issue.
The deal here is that the only way to fix X11's security issues is by breaking all those types of workflows and forcing application rewrites to implement them in authenticated ways.
So if you are going have to go and break all that stuff, why not fix a crapload of other problems while you are at it?
Calling Wayland "X13" may have avoided a lot of misunderstandings, but it probably would of caused others.
Yes it was bit uncharitable, but I couldn't resist based on the way he phrased it. It was just a joke.
"Preventing" the vulnerability would indeed require going back to 1994. Since it is a vulnerability that has existed in every display server released since then.
The way X11 developers ended up fixing this is by creating Wayland. This way privileged operations (like keylogging, screen capture, etc) require the cooperation and authentication through the display server.
Modern science is derived from Christian Scholasticism from the middle ages so this way of talking and thinking about science as being divinely originated is only unusual in the past couple centuries or so.
It is from that era that they developed systems of rigorous debate, formal logic, and things like peered reviewed papers that we call "the scientific method".
As far as the history of these sorts of mathematical discussions the concept of negative numbers didn't exist until the 15 century. I am sure that each new concept was faced with some resistance and debate on its true nature before it became widely accepted.
So I am sure that somebody looking through the historical record could find all sorts of wild quotes from different theologians trying to grasp new concepts and reconcile them with existing mathmatical standards.
I think that using the term 'application containers' to reference docker and 'system containers' to reference LXC is a bit of a meaningless distinction.
You can 100% host "systems containers" on Docker and you can host "applications" on LXC.
Like if I want a entire OS with it's own init system and users and so on and so forth I can do it it OCI images.
In fact I use it every single day with distrobox on top of Podman using OCI container images.
And it works a hell of a lot better then if I tried to do it on LXC.
"Systems containers" are almost certainly isn't more secure since 'root' means things, even in a container.
Containers just leverage existing Linux namespace isolation techniques to isolate applications.
A good way to think about it is that they act like blinders on a horse. If applications can't "see stuff" or reference items outside of the container then they don't know it exists and don't know how to interact with it.
"application containers" can take advantage of more then just namespaces to isolate applications, such as running them as unprivileged users inside the container's context and thus limiting them from the sort of kernel features that get exposed inside the containers. Or cgroups to limit resource usage and other smaller things like that.
Regardless "Security" and "Containers" really shouldn't be written about in the same paragraph without MAC framework like SELinux in place or additional isolation techniques like VMs.
Although VMs are a lot more like containers then people realize.
Generally speaking the cells that are welded on are designed to be welded on in the areas were you do the welding. Doing something other then welding on them properly is going to be more unsafe then welding.
The proper tools to do this are not that expensive anymore in the greater scheme of things. It is just a question of whether or not it is worth to do it at the scale you are doing it or pay somebody else to do it.
Of course if you buy cells that are designed to be bolted together then bolt them together.
Of course the bolts, or whatever else provides the threads, on those cells are welded on.
Replace well known, fast, and efficient image to text algorithms that can happily run on my ancient Kindle with a gigantic black box of ML mush that requires tens of thousands of dollars of GPU to run?
Sign me up!
Might as well claim that computer science is obsolete now since LLMs exist while you are at it.
One of the effects of ISG15 deficiency is a disease called "Type I interferonopathy".
Among the symptoms of this disease includes things like necrotic lesions and severe multi-systemic damages.
From what I gather the fact that these people are not more susceptible to viral infections was a surprise. Which probably relates to why the doctors in the parent article were investigating its possible anti-viral properties.
AMDgpu is the driver for newer GPUs, radeon is for the older GPUs. This is like circa 7 or 10 years ago.
So it is both driver changes and architectural changes.
There is also AMDGPU-PRO, which is the proprietary version based on AMDGPU. Used to be you'd need it for ROCm, but that hasn't been true for a while not. There really isn't any reason to use the "pro" version anymore, unless you have a some special proprietary app that requires it.
Open source GPU drivers are based on Mesa stack. So they share a common code base and support for things like Vulkan.
So it is sorta similar to how DirectX works. With old-school OpenGL drivers each stack was proprietary to the GPU manufacturer so there was lots of quirks and extensions that applied to only one or another GPU. That is one of the reasons DirectX displaced OpenGL in gaming... Microsoft 'owned' DirectX/Direct3d stack.
Well the open source equivalent to that is Mesa. Mesa provides APi support in software and it is then ported to each GPU with "dri drivers".
For gaming things have improved tremendously with "Proton", which is essentially Wine with vastly improved Direct3D support.
This is accomplished with "DXVK", which is a Direct3D to Vulkan translator.
This way Linux essentially gets close to "native windows speed" for most games that support proton in one way or another.
Which means that most games run on Linux now. Probably over 75% that are available on Steam, although "running" doesn't mean it is perfect.
One of the biggest problems faced with Linux gaming nowadays is anti-cheat features for competitive online games. Most of the software anti-piracy and anti-cheating features games use can technically work on Linux, but it is really up to the game manufacturer to make it work and support it. Linux gamers can sometimes make it work, but also they get flagged and booted and even accounts locked for being suspected of cheating.
Things have changed a lot since Steam deck. Especially in the last 3 or 4 years.
Mobile users suffer more problems then people with dedicated desktop GPUs, but it still gotten a lot better.
The one thing to be careful about AMD GPUs is that for most GPU OEMs AMD is just a after thought. So they get sub-par QA and heatsinks compared to their more popular Nvidia models.
It is best to go with card makers that only sell AMD GPUs, like Sapphire, PowerColor, and XFX. I am partial to Sapphire.
XFree86, which is the "standalone DDX" you see on X11 desktops, is being actively maintained.