> The X.Org security team would like to take this opportunity to remind<p>> X client authors that current best practices suggest separating code<p>> that requires privileges from the GUI, to reduce the attack surface of<p>> issues like this.<p>A naïve reading of this statement seems to suggest that no "modern operating system" built on X can be secure should they follow the X.Org team's advice because no privileged clients can exist. Perhaps this is a gross misunderstanding of mine with respect to how distros use X, but is it not possible to display to the user a privileged password input window that can't be tampered with? And, if said window can be made, wouldn't it be privileged and thereby susceptible to this attack unless they displayed it without using an X server?<p>Or would the X.Org security team suggest that operating systems run dual X servers, or many X servers, one for each privilege level, and then render one on top of another?<p>This mess has me quite confused as to the security model surrounding X.