Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zellij: A terminal workspace with batteries included

zellij.dev

Post reply on HN
Print view View original

21–30 of 105 posts

Re: Zellij: A terminal workspace with batteries included

#21

Post by OJFord »

da39a3ee wrote: post #5
slang800 wrote: post #3

Please do not pipe scripts downloaded through curl into bash. Use a package manager. That way the downloaded binary can be verified against a checksum and/or GPG signing.

Please don't contribute worthless and irrelevant comments like this. As you doubtless well know, piping from curl into bash is something that a large subset of respected programmers think is reasonable, and another rather tedious subset do not. For example, the entire Rust community clearly has a consensus that it's reasonable: https://rustup.rs/ As does homebrew https://brew.sh/ and pyenv https://github.com/pyenv/py…

Why do you think your opinion is more valuable than that to which you reply?

For what it's worth, I can rattle off many more project names at random in 30s, and odds are they'll all have installation methods that aren't curl-pipe-shell, there are just so many more of them.

Re: Zellij: A terminal workspace with batteries included

#22

Post by cassepipe »

lillecarl wrote: post #20
sreevisakh wrote: post #18

Earlier quoted context omitted.

The interface is very discoverable, unlike screen or tmux. You can start using it productively even before reading any documentation. The keybindings feel like a cross between vim (modal) bindings and CUA bindings.

One thing that is a bit weird still is that the displayed keybindings doesn't reflect your configuration, so if you use an alternative config you'll see the wrong bindings for some thing all the time.

I though that but I just installed the latest version and it does change the displayed keybindings

Re: Zellij: A terminal workspace with batteries included

#23

Post by jcpst »

I kinda fell in love when I started using zellij.

I say this as a vim user, but it reminds me of what nano is compared to vim. With zellij, you can jump in blind and learn how it works. Compared to tmux, which is great, but like vim, requires more upfront learning.

And the configuration is awesome. I’ve defined workspaces that look like a sophisticated IDE with little effort. It always seemed to be more effort doing the same in tmux.

Re: Zellij: A terminal workspace with batteries included

#24

Post by nine_k »

qbasic_forever wrote: post #14
aspaceman wrote: post #6

Earlier quoted context omitted.

"a bunch of folks do something insecure" does not speak argument. The argument is that it is insecure. Most easily because I can inject, "cat ~/.ssh/*_rsa | curl ..." and get your company ssh keys. There's no reason rust, brew and all the rest can't provide a Download page with a checksum. They choose not to, like this project chose not to, because it doesn't look as sexy. It's really silly.

If someone has pulled off a sophisticated enough attack to intercept your http curl of the script and inject a malicious version, why can't they also intercept your brower http requests for the download page and inject different html that gives a good hash/checksum of the malicious script? Going even further, what is stopping a malicious attack on the package source itself--like someone gaining control of the package…

No, the concern is not your computer is compromised. Yours is a low-value target, sorry.

It's their http server, or a machine that feeds that http server, which is a good target for a compromise. Injecting a little bit of malicious code that steals something, or installs a fileless piece of malware, would bring massive benefits to the perpetrator, even if the exploit is short-lived.

That shell script should be a zip (gzip, xz) file, with a sha256 hash of it published on a different, separately hosted resource.

Maybe we should provide an utility that just does that in one command. It could even be a shell script...

Re: Zellij: A terminal workspace with batteries included

#25

Post by qbasic_forever »

nine_k wrote: post #24
qbasic_forever wrote: post #14

Earlier quoted context omitted.

If someone has pulled off a sophisticated enough attack to intercept your http curl of the script and inject a malicious version, why can't they also intercept your brower http requests for the download page and inject different html that gives a good hash/checksum of the malicious script? Going even further, what is stopping a malicious attack on the package source itself--like someone gaining control of the package…

No, the concern is not your computer is compromised. Yours is a low-value target, sorry. It's their http server, or a machine that feeds that http server, which is a good target for a compromise. Injecting a little bit of malicious code that steals something, or installs a fileless piece of malware, would bring massive benefits to the perpetrator, even if the exploit is short-lived. That shell script should be a zip…

Realistically a poisoned ARP or DNS attack that redirects your machine's traffic to the attacker's server, both for the download and the download page, is something to be concerned about. This only requires someone to have access to your local network, not to your machine. It could be as innocent as working at a coffee shop from their wifi network and an attacker being on it too...

Re: Zellij: A terminal workspace with batteries included

#26

Post by kej »

tslocum wrote: post #17
yunohn wrote: post #11

Earlier quoted context omitted.

The developer has accounted for this with a prominent link to the file in question, see “View the script that will be executed here”.

This actually doesn't protect you the way you think it does. Using a simple check of the user agent which makes the request, an innocuous file may be served to browser requests, while an infected file may be served to cURL requests.

You can even get more devious and use timing differences to serve one thing to `curl` and a different thing to `curl | bash`: https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b...

Re: Zellij: A terminal workspace with batteries included

#27

Post by abrax3141 »

Serious Q: Has a serious emacs user checked this out? It looks exciting, but I’m a full time, long time, emacs -nw multi-buffer M-xshell user. Am I going to be disappointed bcs either it’s not going to let me run emacs on its sub windows, or it will have unresolveable key binding incompatibilities?

Re: Zellij: A terminal workspace with batteries included

#28

Post by rgoulter »

As a tmux user, I take a look at zellij every now and then.

I love that it's more discoverable, with the keybindings displayed more readily.

I think one feature I use from Tmux frequently enough is switching between sessions. It's not currently something the zellij client can do.

Re: Zellij: A terminal workspace with batteries included

#30

Post by samatman »

slang800 wrote: post #3

Please do not pipe scripts downloaded through curl into bash. Use a package manager. That way the downloaded binary can be verified against a checksum and/or GPG signing.

Definitely don't curl | less first if you're concerned, or make a tmpfile if you're really paranoid.

That would be using your tools, not kvetching online. And we can't have that.

Post reply on HN