130 The X-Windows Disaster PLAY boris:0. Presumably this means that X is too stupid to figure out where you are coming from, or Unix is too stupid to tell it. Well, that’s Unix for you. (Better not speculate about what the 0 is for.) Run the program again. Now it tells me that the server is not autho- rized to talk to the client. Talk to the unix wizard again. Oh, yes, you have to run xauth, to tell it that it’s OK for boris to talk to akbar. This is done on a per-user basis for some reason. I give this 10 seconds of thought: what sort of security violation is this going to help with? Can’t come up with any model. Oh, well, just run xauth and don’t worry about it. xauth has a command processor and wants to have a long talk with you. It manipulates a .Xauthority file, apparently. OK, presumably we want to add an entry for boris. Do: xauth help add add dpyname protoname hexkey add entry Well, that’s not very helpful. Presumably dpy is unix for “display” and protoname must be… uh… right, protocol name. What the hell protocol am I supposed to use? Why should I have to know? Well, maybe it will default sensibly. Since we set the DISPLAY variable to “boris:0,” maybe that’s a dpyname. xauth add boris:0 xauth: (stdin):4 bad "add" command line Great. I suppose I’ll need to know what a hexkey is, too. I thought that was the tool I used for locking the strings into the Floyd Rose on my guitar. Oh, well, let’s look at the man page. I won’t include the whole man page here you might want to man xauth yourself, for a good joke. Here’s the explanation of the add command: add displayname protocolname hexkey An authorization entry for the indicated display using the given protocol and key data is added to the authorization file. The data is specified as an even-length string of hexadecimal digits, each pair representing one octet. The first digit gives the most significant 4 bits of the octet and the second digit gives the least significant 4 bits. A protocol name consisting of just a single period is treated as an abbreviation for MIT-MAGIC-COOKIE-1. This is obviously totally out of control. In order to run a program across the goddamn network I’m supposed to be typing in strings of hexadecimal digits which do god knows what using a program that

X Myths 131 has a special abbreviation for MIT-MAGIC-COOKIE-1? And what the hell kind of a name for a network protocol is that? Why is it so important that it’s the default protocol name? Obviously it is Allah’s will that I throw the Unix box out the win- dow. I submit to the will of Allah. Anybody who has ever used X knows that Chapman’s error was trying to use xauth in the first place. He should have known better. (Blame the vic- tim, not the program.) From: Olin Shivers shivers@bronto.soar.cs.cmu.edu Date: Wed, 30 Jan 91 23:49:46 EST To: ian@ai.mit.edu Cc: zvona@gang-of-four.stanford.edu, UNIX-HATERS Subject: MIT-MAGIC-COOKIE-1 Hereabouts at CMU, I don’t know anyone that uses xauth. I know several people who have stared at it long and hard. I know several people who are fairly wizardly X hackers. For example, the guy that posted the program showing how to capture keystrokes from an X server (so you can, for example, watch him type in his password) is a grad student here. None of these guys uses xauth. They just live dan- gerously, or sort of nervously toggle the xhost authentication when they need to crank up an X network connection. When I think of the time that I have invested trying to understand and use these systems, I conclude that they are really a sort of cognitive black hole. A cycle sink a malignant entity that lurks around, wait- ing to entrap the unwary. I can’t really get a mental picture of the sort of people who design these kinds of systems. What bizarre pathways do their minds wan- der? The closest I can get is an image of an order-seeking system that is swamped by injected noise—some mental patients exhibit that kind of behavior. They try so hard to be coherent, rational, but in the end the complexity of the noise overwhelms them. And out pops gib- berish, or frenzied thrashing, or xauth. It’s really sobering to think we live in a society that allows the people who design systems like xauth to vote, drive cars, own firearms, and reproduce.