Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Warp, a Rust-based terminal

warp.dev

Post reply on HN
Print view View original

661–670 of 757 posts

Re: Show HN: Warp, a Rust-based terminal

#661

Post by bongobingo1 »

edgyquant wrote: post #636
eterm wrote: post #478

Earlier quoted context omitted.

A lot of workplaces don't even bother to ban grammarly, which is literally a keylogger*, this won't even be on their radar. * I feel compelled to point out that Grammarly disagree with this definition because it doesn't send every single keystroke , just the ones in non-password text boxes .

Is grammarly not correct here?

If my plugin Passwordly, only sends the keystrokes inside password boxes, is or isn't that a key logger? It's only capturing a subset of your input, like Grammarly, so not a keylogger?

If the argument is, it's not a keylogger because it's not logging sensitive information, well I type plenty of sensitive information into non-password textboxes.

Re: Show HN: Warp, a Rust-based terminal

#662

Post by smt88 »

warent wrote: post #654
smt88 wrote: post #643

Earlier quoted context omitted.

I am not conflating the two. If the terminal can run programs connected to the internet, then the terminal has internet connectivity. The host system would not be able to tell the difference. Warp could certainly promise not to include any phone-home functionality in their code, but unless it's open-source and everything is audited, it could easily call the host system's HTTP client and still phone home.

> If the terminal can run programs connected to the internet, then the terminal has internet connectivity. Is this true? This sounds wrong to me but I don't know the inner workings of terminals. The terminal just executes programs and handles pipes it seems. A terminal can be completely walled from the internet, and when you execute something from it, say, curl, then curl has it's own memory space and access layer ou…

> The terminal just executes programs and handles pipes it seems. A terminal can be completely walled from the internet, and when you execute something from it, say, curl, then curl has it's own memory space and access layer outside the terminal, and just has it's stdio wired to the terminal.

As I said in my comment, even if you "wall" the terminal off from the internet, if it can make system calls on behalf of the user, it can still access the internet.

If a terminal has sufficient access to the host system to call `curl https://www.google.com` on behalf of the user, then it can call it without any user input.

There is nothing on the host machine that can authenticate system calls coming from the terminal application as "user-initiated" or not. This is similar to the warning that "you can't trust the client"[1].

1. https://security.stackexchange.com/questions/105389/dont-tru...

Re: Show HN: Warp, a Rust-based terminal

#664

Post by stouset »

btown wrote: post #606
zachlloyd wrote: post #559

Earlier quoted context omitted.

As the author of the post, I think this is totally reasonable feedback and something we have discussed quite a bit on the team. The general stance on telemetry that we have is that a) we are just starting and it's really helpful to see which of our product ideas are useful to our users (e.g. does anyone use AI Command Search? Should we continue to invest in it) b) we tried to be very explicit about what we are and ar…

As a Sentry user (for a web app where people are not placing sensitive IP!) - it is INCREDIBLY easy for it to be configured to suck up massive amounts of PII and sensitive IP in the context of its crash reports. If I am running `kubectl create secret --from-literal` and something crashes, can you guarantee that the contents of that command will not be loaded into Sentry? Breaching this guarantee would be as simple as…

> - make Sentry crash reporting opt-in (or at the very least have a popup that occurs with the content of what will be sent to Sentry before anything is sent to Sentry), AND

100% this. I don't entirely understand why Warp needs to connect to Sentry right at application launch. If it crashes, capture that crash and present me an opportunity to report it or not. If I do agree to report it, first present me the complete text of everything that will be reported.

I understand that this puts some hurdles in the way of getting crash reports. But terminals frequently contain information far too sensitive to trust with these things being automated.

Re: Show HN: Warp, a Rust-based terminal

#665

Post by eloisius »

buro9 wrote: post #44
orastor wrote: post #20

Wanted to give it a shot but got disappointed when I launched it and the following happened: - Outgoing request to googleapis.com - Outgoing request to segment.io - Outgoing request to sentry.io - Requires sign up (only via Github, mind you) I understand the first request is probably to get some dynamic configuration, even though I'd rather my terminal ship with static configuration. But then you have segment and sen…

I'm not sure I'm ready to have SaaS models replace core utilities and tools locally. > Announcing Warp’s Series A: $17M to build a better terminal And just thinking about this... it's not clear to me what their moat will be as I suspect if there's a really compelling feature it will be available in OSS terminals quite quickly. Perhaps it's the product polish? But I'm not sure polish is what I want from a terminal, at…

$3.99/mo for the Pro plan let's you run as many concurrent processes as you want!

Re: Show HN: Warp, a Rust-based terminal

#667

Post by animuchan »

zachlloyd wrote: post #563
jnovek wrote: post #99

Earlier quoted context omitted.

Also: security? I expect my terminal to be a much more secure environment than my web browser. When an application starts communicating with the internet, I have no choice but to treat it with the same level of scrutiny as my browser. Even making telemetry opt-in means that it has the capability to send information to the internet that I don’t know about, which means that I have to treat it like an application that c…

As the author of the post (and founder of the company), I think this is also a very reasonable concern. It's one that we have as well and that we take very seriously. Our stance here is that: 1) We are very explicit about what gets sent (only telemetry and crash reporting) and you can see the full list of telemetry events here ( https://docs.warp.dev/getting-started/privacy#exhaustive-tel... ) 2) For collaborative fe…

As a user, I can see the potential, sure. But it's not realized in any way. Right now this terminal uses Internet only for collecting my data (GitHub account, telemetry, and more).

The value proposition is negative. A paradigm shift, sure, but IMO in wrong direction.

Re: Show HN: Warp, a Rust-based terminal

#669

Post by [deleted] »

websap wrote: post #412
ushakov wrote: post #231

Earlier quoted context omitted.

this isn't Dropbox though terminals are used by sysadmins/software developers/hackers HN the most important resource in this category their product has the hotspot they should be fixing the telemetry ASAP (i'd suggest - before next release) or else their product will be forgotten for a while and next time it comes up everyone will be sceptical to upvote again

There are 1000s of developers who use the terminal for simple things like running dev workflows - git checkout, build, edit code, send a PR, etc. It seems wrap is trying automate things here to help these developers. Just because there are plenty of bash wizards who don't like this, it doesn't mean this isn't useful. There are still plenty of users who swear by Vim / Emacs. I've been a software engineer for 10 years…

[deleted]

Re: Show HN: Warp, a Rust-based terminal

#670

Post by the_gipsy »

w4rh4wk5 wrote: post #456
esrh wrote: post #446

Earlier quoted context omitted.

It is a little bit unfortunate that alacritty is licensed under Apache, which means it can be forked into proprietary software like this. If it was gpl like kitty, the authors would have had no choice but to make it fully open source from the start.

They would not have used alacritty in that case.

Well, it doesn't look like they will be giving back. They will open source some things yes, but it doesn't look like it will go back into alacritty.
Post reply on HN