Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Déjà vu: Ghostly CVEs in my terminal title

dgl.cx

Post reply on HN
Print view View original

51–60 of 68 posts

Re: Déjà vu: Ghostly CVEs in my terminal title

#51

Post by samatman »

mitchellh wrote: post #3

Just cross posting my lobsters post: I want to say thanks to @dgl for reporting this, and this article is also expertly written. I also have to say for me personally its quite embarrassing because as I told @dgl when he reported this: I’ve studied his work before and made it a note to test Ghostty against his past discoveries prior to release. And I… quite simply forgot. I didn’t make an issue for myself so it slippe…

It's not just Kitty graphics, the Kitty Keyboard Protocol is a DOS waiting to happen, and Goyal with his customary charm is very hostile to the idea of correcting his mistake: https://github.com/kovidgoyal/kitty/issues/7749

Short version: as defined, Mode 16 can deliver many megabytes of CSI parameters before the parser ever sees the `u` telling it what it's parsing. Since this is violently different from any other CSI code ever proposed or implemented, it cannot be parsed using any technique or parser which expects sane behavior.

This isn't the only problem with KKB, it must be deprecated and replaced.

Re: Déjà vu: Ghostly CVEs in my terminal title

#52

Post by wslh »

It is worth mentioning my prior report on Bugtraq from 1999 [1], which predates that Bugtraq 2003 report. I recall there were earlier reports elsewhere, though I'm uncertain if I made my exploit publicly available. What stood out about this type of exploit was that it could be triggered simply by a banner in FTP/Telnet/SSH.

[1] "Kvt bug": https://seclists.org/bugtraq/1999/Sep/432>

Re: Déjà vu: Ghostly CVEs in my terminal title

#53

Post by wunderwuzzi23 »

An important new attack vector are actually CLI LLM applications.

During prompt injection an attacker can cause such ANSI escape codes to be emitted!

Check out this post to learn more about Terminal DiLLMa and how to mitigate it:

https://embracethered.com/blog/posts/2024/terminal-dillmas-p...

Re: Déjà vu: Ghostly CVEs in my terminal title

#54

Post by aumerle »

sevg wrote: post #50
aumerle wrote: post #47

Earlier quoted context omitted.

[flagged]

> "It's impossible for me to be wrong" that right there tells us all we need to know about you. Actually, it doesn’t, as it’s very clear you still don’t understand what I’m saying XD If I was comparing ghostty to kitty, I can obviously be wrong. But I was just saying I’m impressed, which literally can’t be wrong unless I’m lying about being impressed. It’s like if I look across a lake and say “what a lovely view”. An…

[flagged]

Re: Déjà vu: Ghostly CVEs in my terminal title

#55

Post by machinestops »

rollcat wrote: post #36

I really wish that 1% of the sustained effort that is currently being devoted to building terminal emulators and TUI applications was collectively redirected at researching a better future to fill this niche. Terminal emulators and TUI applications belong with the DMG Gameboys, Commodore 64's, and DOSBoxes: as a historical curiosity and something for the enthusiasts to enjoy after hours. But we've come to rely on the…

Have you heard of Arcan? https://arcan-fe.com

Re: Déjà vu: Ghostly CVEs in my terminal title

#56

Post by MrLeap »

This is fascinating. I was just playing around with this pretty printing library in .net and I wondered how security critical such a thing was, and whether or not it could be trusted.

https://spectreconsole.net/

Things like this make me a little more cautious about standard out in general! More research to do.

Re: Déjà vu: Ghostly CVEs in my terminal title

#57

Post by voxtech »

aumerle wrote: post #54
sevg wrote: post #50

Earlier quoted context omitted.

> "It's impossible for me to be wrong" that right there tells us all we need to know about you. Actually, it doesn’t, as it’s very clear you still don’t understand what I’m saying XD If I was comparing ghostty to kitty, I can obviously be wrong. But I was just saying I’m impressed, which literally can’t be wrong unless I’m lying about being impressed. It’s like if I look across a lake and say “what a lovely view”. An…

[flagged]

Why would it need to be faster than its peers to be impressive? That implies that a person can only be impressed by one thing in any given category.

Re: Déjà vu: Ghostly CVEs in my terminal title

#58

Post by hitekker »

remram wrote: post #43
sevg wrote: post #26

Earlier quoted context omitted.

And a lot of time to post only about kitty XD

aumerle is Kovid Goyal, the author of kitty.

Thanks for calling this out.

I'll remember his comments as an example of how much pettiness both drives and undermines OSS.

Re: Déjà vu: Ghostly CVEs in my terminal title

#59

Post by sevg »

aumerle wrote: post #54
sevg wrote: post #50

Earlier quoted context omitted.

> "It's impossible for me to be wrong" that right there tells us all we need to know about you. Actually, it doesn’t, as it’s very clear you still don’t understand what I’m saying XD If I was comparing ghostty to kitty, I can obviously be wrong. But I was just saying I’m impressed, which literally can’t be wrong unless I’m lying about being impressed. It’s like if I look across a lake and say “what a lovely view”. An…

[flagged]

I see you can’t answer voxtech’s question, because your entire position would crumble to dust ;)

I hope you’ve had a chance to reflect and learn from this. Your responses and logical reasoning here has only made you look foolish. HN seems to agree, though people have actually done you a favor by flagging ~8 of your comments to death!

Re: Déjà vu: Ghostly CVEs in my terminal title

#60

Post by throwawaykitten »

saagarjha wrote: post #42
throwawaykitten wrote: post #30

Earlier quoted context omitted.

FYI: aumerle is kitty's maintainer. i don't know why he is talking about the project as if unaffiliated.

Like, this is Kovid? This has to be a violation of the site guidelines.

yes: https://news.ycombinator.com/item?id=13342516
Post reply on HN