Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

iTerm2 Shell Integration

iterm2.com

Post reply on HN
Print view View original

61–70 of 102 posts

Re: iTerm2 Shell Integration

#61

Post by sneak »

gnachman wrote: post #49
sneak wrote: post #39

Earlier quoted context omitted.

I also use a smartcard with gpg-agent speaking the ssh-agent protocol. OpenSSH commandline supports it fine. What's the harm in shelling out?

I don't get to control the UI if I shell out. I want to prompt you for your password in a native window and display a native progress bar. I want to know exactly why it failed. I want to estimate the time remaining.

Things you don't get if you don't shell out:

- reusing ControlMaster bg connections

- smartcard auth

- agent support

- ssh_config support, including

- proxycommand

- Cipher selection

- KDF advances for on-disk key encryption

The list is long and expansive. You'd do better to submit a patch upstream for machine-readable progress output in OpenSSH's 'scp', and bundling that.

Re: iTerm2 Shell Integration

#62

Post by ryenus »

kzhahou wrote: post #14

Congrats, team! iTerm2 (esp in fullscreen mode) is THE reason I could never go back to windows development.

+1

I used to use cygwin on windows with screen, it kinda works, just everything is so slow. Every time I create a new screen window I had to peek HN for latest posts. LoL

Re: iTerm2 Shell Integration

#63

Post by gnachman »

sneak wrote: post #61
gnachman wrote: post #49

Earlier quoted context omitted.

I don't get to control the UI if I shell out. I want to prompt you for your password in a native window and display a native progress bar. I want to know exactly why it failed. I want to estimate the time remaining.

Things you don't get if you don't shell out: - reusing ControlMaster bg connections - smartcard auth - agent support - ssh_config support, including - proxycommand - Cipher selection - KDF advances for on-disk key encryption The list is long and expansive. You'd do better to submit a patch upstream for machine-readable progress output in OpenSSH's 'scp', and bundling that.

That's a fair point. We do support agents and much of ssh_config. I'll look into what it would take to patch scp when I get the chance.

For folks who have setups where iTerm2's scp implementation can't connect, you can always download files over an existing ssh connection with this script:

https://raw.githubusercontent.com/gnachman/iTerm2/master/tes...

Upload is a little trickier, but you can copy a file to the pasteboard (e.g., in Finder) and then paste it base64-encoded (Edit > Paste Special > Paste File Base64-Encoded) into base64 -D >> filename.

Re: iTerm2 Shell Integration

#64

Post by gnachman »

geofft wrote: post #60
gnachman wrote: post #45

Earlier quoted context omitted.

Great question! When installing, especially on an untrusted host, follow the manual installation instructions. The menu item will just output a curl|bash command (currently; this will likely change in the future). If the host is really untrusted you're screwed, of course. Bad guys could modify your ~/.iterm2_shell_integration.bash and you'd never know. But this script is not special in any way (except that it's kinda…

Is there a risk of the untrusted host injecting things into the shell output without permission? It looks like there's no authentication, so if I SSH somewhere untrusted that can output raw characters to my shell (which, I believe, includes git pushing over SSH, etc.), it can output the right escape sequence and insert false things into my shell history. With further cleverness, it could almost certainly inject thing…

Yeah, it's possible they could do that if you're on a shared machine with a world-writable tty, or if a program blindly outputs info from an evil server. There's a good chance you'd notice something hinky going on, and of course there's no guarantee you'd run a command in history. Also, when you double-click on a command in history, you still need to press enter to execute it, so you'd have a chance to review the evil command. And if you're using a terminal that doesn't swallow unrecognized sequences (like Gnome terminal) you'd see the guts of the escape sequence.

Your password idea would work. It would be nearly impossible to establish a shared secret, unfortunately. It's really hard to do any kind of authentication over a one-way channel, which you almost always have to assume is what you've got in the world of terminal emulation. Key management retains its title as the worst part of crypto. The socket thing doesn't work (at least as the default mode) because nobody knows how to forward sockets and 99% of users would choose to forego the feature over learning a new ssh flag and making it work everywhere. There are gnarly race conditions there, too. How do you correlate prompts with messages on the socket?

I'm open to suggestions, but I don't see a way to make it both convenient enough to be generally useful and bulletproof.

I do plan to nuke the curl|bash thing. It was a shortcut to ship faster and to make it easy to update scripts in the field quickly when bugs were found. I did imagine everyone on hacker news scowling at me when I wrote that code, FWIW.

Re: iTerm2 Shell Integration

#65

Post by hiroprot »

I really like this, but am wondering if something like ZModem over SSH would make the file transfer stuff more convenient...I feel like some things have become more complicated since the BBS days.

Re: iTerm2 Shell Integration

#66

Post by tracker1 »

pi-rat wrote: post #40
kawsper wrote: post #38

Earlier quoted context omitted.

Lots of stuff seems broken by default if you are on an exotic layout. I am on a Macbook with a Danish-layout, and ALT+ARROW_LEFT/ARROW_RIGHT doesn't work out of the box in iterm2, however it seems to work if you rebind, or type this into .inputrc: "\e\e[D": backward-word "\e\e[C": forward-word I'd love to switch to an american keyboard, because lots of Unix things seems impossible to type with my current keyboard, bu…

I switched from a Norwegian keyboard to a UK keyboard with intl. English map on my MacBook. Default keyboard shortcuts suddenly made so much more sense - and I can code without having to use my nose when I run out of fingers for modifier keys. ()[]{}\|/:;' are all available using at most a single modifier (many of them without). Scandinavian characters are available using a single modifier for when I don't code, ex a…

On the one hand, I appreciate that English is as pervasive as it is in software engineering, being an American... on the flip side, it's a bit disappointing how little effort is often made to make sites and applications less friendly to foreign inputs and layouts (including inputting names).

Re: iTerm2 Shell Integration

#67

Post by tracker1 »

RoboSeldon wrote: post #10
tonyedgecombe wrote: post #7

I'd love to see something like iTerm for Windows.

Not exactly an iTerm2 clone but pretty close conemu https://code.google.com/p/conemu-maximus5/

I love conemu, with a git-bash prompt it's about priceless. In case anyone is looking for something similar for Explorer, I've been using a program called Clover for a while.

Linking to the alternativeto page for it, since it's free, but closed source...

http://alternativeto.net/software/clover/?platform=windows

Re: iTerm2 Shell Integration

#68

Post by geofft »

gnachman wrote: post #64
geofft wrote: post #60

Earlier quoted context omitted.

Is there a risk of the untrusted host injecting things into the shell output without permission? It looks like there's no authentication, so if I SSH somewhere untrusted that can output raw characters to my shell (which, I believe, includes git pushing over SSH, etc.), it can output the right escape sequence and insert false things into my shell history. With further cleverness, it could almost certainly inject thing…

Yeah, it's possible they could do that if you're on a shared machine with a world-writable tty, or if a program blindly outputs info from an evil server. There's a good chance you'd notice something hinky going on, and of course there's no guarantee you'd run a command in history. Also, when you double-click on a command in history, you still need to press enter to execute it, so you'd have a chance to review the evi…

> The socket thing doesn't work (at least as the default mode) because nobody knows how to forward sockets

I suspect that you can do this with SSH configuration (LocalForward ~/.something:~/.something), but I haven't tested it. It mostly depends on whether you're willing to configure this, but perhaps the installer can put that at the top of ~/.ssh/config, so it's global, with a comment saying "If you don't want this globally, delete it or put it after a `Host example.com` line". Even if you trusted all SSH hosts, this would protect you from the git-clone attack.

You could probably also abuse X11 forwarding for this, which has the advantage that trusted X11 forwarding is basically the right security boundary and is just `ssh -Y`, and the disadvantage that now you're relying on X11 (or worse, a custom X11-speaking proxy so you can avoid requiring the server or client) on both sides.

> There are gnarly race conditions there, too. How do you correlate prompts with messages on the socket?

Send a token or hash in-band, and send the actual command out-of-band. If you receive an unknown token, ignore it.

> I do plan to nuke the curl|bash thing. It was a shortcut to ship faster and to make it easy to update scripts in the field quickly when bugs were found. I did imagine everyone on hacker news scowling at me when I wrote that code, FWIW.

:-)

curl https:// | sh is IMO a perfectly reasonable way to install software (at least in a world where ./configure && make install is reasonable; I don't know any humans who can audit the output of GNU autoconf). It just has this one weird problem. I sort of dislike the stigmatization of it precisely because it's hard to talk about how to do it well.

Re: iTerm2 Shell Integration

#69

Post by jrcii »

Speaking of shell integration, I use this Automator app with "Open with" to open Finder files in a new tmux vim window http://pastebin.com/rxyB8c8k

I use a similar script/Automator app to "Open this directory in iterm" by dragging it into the Finder toolbar http://pastebin.com/1at3CXvP http://i.imgur.com/QGqQSOJ.png

Re: iTerm2 Shell Integration

#70

Post by x0054 »

I use iTerm2 a lot in the "visor" (pop up from the top) mode. I have my iTerm2 plist file edited so that it displays no bar icon and pops up even over the full screen apps. It would be really nice to have a feature where instead of a popup alert, the visor window would just slide out, to let me know that it's done.

But all in all, sounds like an awesome set of features, will have to try tonight. Thanks!

PS: On an unrelated note, if later on you could add native support for pop out window to appear in full screen apps, and maybe do a check, so that if you are in full screen app mode, it pops over with 0 y offset, but if it's in a norma screen, it pops up with offset to accommodate the menu bar, that would be awesome. But no rush :), thanks for all the awesome work!

Post reply on HN