Not a terminal multiplexer, but https://github.com/LGUG2Z/komorebi might cheer you up!
Zellij: A terminal workspace with batteries included
41–50 of 105 posts
Re: Zellij: A terminal workspace with batteries included
#42Earlier quoted context omitted.
No, the concern is not your computer is compromised. Yours is a low-value target, sorry. It's their http server, or a machine that feeds that http server, which is a good target for a compromise. Injecting a little bit of malicious code that steals something, or installs a fileless piece of malware, would bring massive benefits to the perpetrator, even if the exploit is short-lived. That shell script should be a zip…
Realistically a poisoned ARP or DNS attack that redirects your machine's traffic to the attacker's server, both for the download and the download page, is something to be concerned about. This only requires someone to have access to your local network, not to your machine. It could be as innocent as working at a coffee shop from their wifi network and an attacker being on it too...
curl validates the TLS certificate by default, it will fail in your scenario unless you pass -k. dev TLD requires https on all connections
Re: Zellij: A terminal workspace with batteries included
#43Please do not pipe scripts downloaded through curl into bash. Use a package manager. That way the downloaded binary can be verified against a checksum and/or GPG signing.
Please lend your own time and energy to generate packages for bespoke distributions and package managers. You will need: deb, rpm, apk, AppImage, casks, tars, and likely more. Make sure to spend your time submitting your package to maintainers for each repository/registry for each distribution and each distro version. Don't forget to test each and every permutation!
Is all that too hard? No problem. Stand up your own repository for each distribution mechanism and instruct the user to run a bunch of random curl and key handling commands to bind their machine to this new software supply chain attack channel. At least this 'potentially malicious' code is being checksumed/gpg verified!
-- the point --
'curl | sh' is inherently no different from a trust perspective then issuing a package installation command or installing a new repository source for a package manager. Each user makes the value judgement if they trust the software or not. Your free to run the 'curl' part and inspect the script, or contribute packages to the byzantine linux/unix ecosystem if it boils your blood so hard.
Practicality is a feature sometimes.
Re: Zellij: A terminal workspace with batteries included
#44Serious Q: Has a serious emacs user checked this out? It looks exciting, but I’m a full time, long time, emacs -nw multi-buffer M-xshell user. Am I going to be disappointed bcs either it’s not going to let me run emacs on its sub windows, or it will have unresolveable key binding incompatibilities?
Hey, Zellij dev here. You should have no issue running emacs inside a Zellij pane. There might be some keybindings collisions, but you can always configure your way out of it if you like. In general the problem of colliding keybindings is a hard one, and one we plan to address in the near future as we chip away at some technical debt that stands in our way.
Thanks (both) for the guidance!
Re: Zellij: A terminal workspace with batteries included
#45I assume Neovim users don't need to care about this thanks to in-built terminal and ability to split, resize and switch between them using standard vim key bindings.
Re: Zellij: A terminal workspace with batteries included
#46Please do not pipe scripts downloaded through curl into bash. Use a package manager. That way the downloaded binary can be verified against a checksum and/or GPG signing.
Please lend your own time and energy to generate packages for bespoke distributions and package managers. You will need: deb, rpm, apk, AppImage, casks, tars, and likely more. Make sure to spend your time submitting your package to maintainers for each repository/registry for each distribution and each distro version. Don't forget to test each and every permutation! Is all that too hard? No problem. Stand up your own…
It is inherently different, because it's been proven that you can detect the use of curl|bash Serverside. This makes it possible to serve the malicious payload only to people which do that.
But I'd agree that the hurdle to get your package into system repositories likely ain't with it. People are free to compile it themselves, download it manually or whatever floats their boats if they don't want to use the quick and easy install script... Which they can audit by saving it to the filesystem before executing the file.
Re: Zellij: A terminal workspace with batteries included
#47I assume Neovim users don't need to care about this thanks to in-built terminal and ability to split, resize and switch between them using standard vim key bindings.
Or Vim users, they have those features too.
But for the Neovim users (including myself), this is handy if they would like to use other applications besides neovim while keeping their neovim session open.
Re: Zellij: A terminal workspace with batteries included
#48I loved the way the roadmap was presented... excellent design skills https://zellij.dev/roadmap/
Yeah, that is the best part of the site/features
Re: Zellij: A terminal workspace with batteries included
#49Earlier quoted context omitted.
Please lend your own time and energy to generate packages for bespoke distributions and package managers. You will need: deb, rpm, apk, AppImage, casks, tars, and likely more. Make sure to spend your time submitting your package to maintainers for each repository/registry for each distribution and each distro version. Don't forget to test each and every permutation! Is all that too hard? No problem. Stand up your own…
It is inherently different, because it's been proven that you can detect the use of curl|bash Serverside. This makes it possible to serve the malicious payload only to people which do that. But I'd agree that the hurdle to get your package into system repositories likely ain't with it. People are free to compile it themselves, download it manually or whatever floats their boats if they don't want to use the quick and…
"It is inherently different, because it's been proven that you can detect the use of curl|bash Serverside"
Malicious people do malicious things? I worry that we conflate trust with validity. Some package systems do it better than others, but in principle you trust that for example, a maintainer of a package repository is not serving you bad checksums and malicious content. After all these systems get their checksums/keys on-first-use, so you still need to make the trust judgement. And they could still change the responses based on your ip, user agent, or other metadata they have access to when you interact with the system.
To boil it down to my gripe, the comments about checksums/gpg signing being the reason to never 'curl | sh' make no sense until you can clear the trust argument first, which no one does. And once you do clear the trust argument, and conclude the source is trustworthy, we can have a more technical debate on the distribution mechanism itself and what makes sense from that perspective.
edit: forgot to add, 'curl | sh' is also a trust on-first-use scenario just like with package ecosystems.
Re: Zellij: A terminal workspace with batteries included
#50I loved the way the roadmap was presented... excellent design skills https://zellij.dev/roadmap/
...except for perhaps the most important and basic thing you want from a roadmap: being searchable.