Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Déjà vu: Ghostly CVEs in my terminal title

dgl.cx

Post reply on HN
Print view View original

21–30 of 68 posts

Re: Déjà vu: Ghostly CVEs in my terminal title

#21

Post by moderation »

aumerle wrote: post #15
mitchellh wrote: post #12

Earlier quoted context omitted.

Sorry to be a broken record but I have no “proposal” whatsoever. It’s more of an information sharing and seeking discussion. I don’t know what I want yet except that I think we can do better. The end result could be that it’s all a terrible idea and that’s okay, but hopefully something comes out of it eventually. Id love to continue this discussion, but I think HN threads probably aren’t the right medium. If you’d li…

Of course, I didn't mean to put you in a spot. We can always continue this later once your thoughts have matured. Sadly I have an extremely full schedule so I dont think I have the badwidth to noodle on this at this stage but if and when you have something more concrete please do post it somewhere public and I will try to contribute to the discussion.

But strangely have a lot of time to post here

Re: Déjà vu: Ghostly CVEs in my terminal title

#22

Post by sevg »

aumerle wrote: post #20
sevg wrote: post #18

Earlier quoted context omitted.

It’s actually possible to make a positive comment about something and for it to be sincere. These are not mutually exclusive. Though it seems if there’s a positive comment about a terminal that you don’t personally think deserves it, the commenter must be a shill. Honestly quite bizarre how this sub-thread has turned out. What I thought was an innocent comment, you’ve turned into ghostty vs kitty. Not everything has…

[flagged]

Personal attack? I just said it was interesting you mostly only comment about Kitty. Which is factually true. (It’s also not a criticism to be singularly passionate about something.) I’m often curious about people’s previous comments, it’s not some decision I made to research your comment history.

I make one, single, lone comment about ghostty. You regularly (almost exclusively) seize opportunities to talk about Kitty, especially in threads that are about other terminals. And I’m the shill? Ok.

You’ve also successfully set the goalposts up such that, even if I did have something to prove to you (which I don’t), I can’t prove anything anyway! It’s impossible to prove what terminal I use or don’t use. And impossible to go back and change my comment history. So, well played I guess ;)

Re: Déjà vu: Ghostly CVEs in my terminal title

#23

Post by hnlmorg »

mitchellh wrote: post #3

Just cross posting my lobsters post: I want to say thanks to @dgl for reporting this, and this article is also expertly written. I also have to say for me personally its quite embarrassing because as I told @dgl when he reported this: I’ve studied his work before and made it a note to test Ghostty against his past discoveries prior to release. And I… quite simply forgot. I didn’t make an issue for myself so it slippe…

I’m working on similar issues with my terminal emulator. So I’d very much like to be part of that conversation too.

Re: Déjà vu: Ghostly CVEs in my terminal title

#24

Post by aumerle »

sevg wrote: post #22
aumerle wrote: post #20

Earlier quoted context omitted.

[flagged]

Personal attack? I just said it was interesting you mostly only comment about Kitty. Which is factually true. (It’s also not a criticism to be singularly passionate about something.) I’m often curious about people’s previous comments, it’s not some decision I made to research your comment history. I make one, single, lone comment about ghostty. You regularly (almost exclusively) seize opportunities to talk about Kitt…

[flagged]

Re: Déjà vu: Ghostly CVEs in my terminal title

#25

Post by sevg »

aumerle wrote: post #24
sevg wrote: post #22

Earlier quoted context omitted.

Personal attack? I just said it was interesting you mostly only comment about Kitty. Which is factually true. (It’s also not a criticism to be singularly passionate about something.) I’m often curious about people’s previous comments, it’s not some decision I made to research your comment history. I make one, single, lone comment about ghostty. You regularly (almost exclusively) seize opportunities to talk about Kitt…

[flagged]

> To wit, ghostty does not actually have a fast release velocity compared to its peers.

Sigh. I’ll explain again but seems like you don’t want to listen either ;)

My original comment didn’t have to spark a comparison war.

If I walk past a new flower shop in my village and remark at how beautiful the roses look, it isn’t criticizing all other flower shops and or saying this one has the best roses. Maybe I even already know a shop with better roses. It’s just a comment, not a declaration of superiority. It actually doesn’t matter if another shop sells better roses, it doesn’t make the initial comment wrong, worthless and worth shooting down.

Now let’s say 5 days after the shop opens, they leave the doors and till unlocked and the local news posts an article about it on the front page. The shop owner reacts quickly to improve security.

A little embarrassing perhaps. So seeing this, I think to say something encouraging instead of piling on negativity, because new businesses can be good for people but also face a lot of challenges.

Basically, something called empathy :)

Re: Déjà vu: Ghostly CVEs in my terminal title

#26

Post by sevg »

moderation wrote: post #21
aumerle wrote: post #15

Earlier quoted context omitted.

Of course, I didn't mean to put you in a spot. We can always continue this later once your thoughts have matured. Sadly I have an extremely full schedule so I dont think I have the badwidth to noodle on this at this stage but if and when you have something more concrete please do post it somewhere public and I will try to contribute to the discussion.

But strangely have a lot of time to post here

And a lot of time to post only about kitty XD

Re: Déjà vu: Ghostly CVEs in my terminal title

#27

Post by rurban »

aumerle wrote: post #4
sevg wrote: post #2

I’m impressed with how many bugs (security and otherwise) have been fixed and new features included [0] in the 1.0.1 release, considering the first public release (1.0) was only 5 days ago. [0]: https://ghostty.org/docs/install/release-notes/1-0-1

[flagged]

Actually usable now, or still entirely insecure?

Re: Déjà vu: Ghostly CVEs in my terminal title

#28

Post by gigatexal »

mitchellh wrote: post #9
aumerle wrote: post #5

Earlier quoted context omitted.

You proposal does not address this issue since shells would still need full privileges. This entire class of exploits (query responses with user controlled data leading to shells executing commands) would be removed if shells just moved to using the kitty keyboard protocol with all key events represented as escape codes and implemented a full escape code parser for data received form the terminal. You cannot embed an…

I believe it could. A shell could reduce capability by default for all executed shell scripts (file or inline on the prompt) and require opt in to not do this. Something akin to a umask of sorts. It’d break exceedingly few real scripts. (Hand waving a lot here with the “opt in” mechanism to avoid that being scripted but I have ideas) Also note my thoughts (very much not even close to being a proposal) are very raw. I…

Whatever you all do please continue the fight. I love love love the ergonomics of the terminal. It feels like a super power for me and is crucial to my work flow. If someone told my CTO that terminals are an attack vector they might do something silly and ban them — might sound crazy but management has gone crazier things.

Re: Déjà vu: Ghostly CVEs in my terminal title

#29

Post by throwawaykitten »

aumerle wrote: post #4
sevg wrote: post #2

I’m impressed with how many bugs (security and otherwise) have been fixed and new features included [0] in the 1.0.1 release, considering the first public release (1.0) was only 5 days ago. [0]: https://ghostty.org/docs/install/release-notes/1-0-1

[flagged]

it's good practice to note when you're the maintainer :)

still if you insist on direct comparison, ghostty addressed 5x as many issues in half the time

Re: Déjà vu: Ghostly CVEs in my terminal title

#30

Post by throwawaykitten »

sevg wrote: post #6
aumerle wrote: post #4

Earlier quoted context omitted.

[flagged]

It’s interesting how singularly passionate you are about Kitty, with almost all of your comments for the last year (or longer) being about Kitty. Don’t you have something more interesting to do with your time than to find opportunities to say: nah Kitty is better ;) I was just finding something to be impressed about, considering it has only just gone public and open source (as opposed to a mature project with establi…

FYI: aumerle is kitty's maintainer.

i don't know why he is talking about the project as if unaffiliated.

Post reply on HN