11–20 of 58 posts
> Any links using those schemes when clicked, would open the MacOS terminal to perform the corresponding action. I'm unclear which of these are being described: 1: when printed and clicked, they may be handled by the terminal, and the terminal's handling allows more behaviors than it should, allowing code execution 2: when printed, these urls are automatically executed by the shell, allowing code execution Neither ar…
Earlier quoted context omitted.
It sure is a good thing we never run anything in our terminals without fully vetting all output. curl -s -L https://raw.githubusercontent.com/Groxx/rickrollrc/master/roll.sh | bash
I can't believe curl | sh is still the recommended way to install oh-my-zsh
And if you're facing an attacker sophisticated enough to send different contents to a browser and to curl, then you're probably not going to find their backdoor in the first place. And it would be stupid of them to depend on that trick, so this becomes an extremely niche case not worth worrying about.
And multiply that sophistication by a hundred times because this is on github servers.
The "what if the file is truncated" issue is the only realistic one, and competent installers like this one define functions and don't run them until the last line.
> Any links using those schemes when clicked, would open the MacOS terminal to perform the corresponding action. I'm unclear which of these are being described: 1: when printed and clicked, they may be handled by the terminal, and the terminal's handling allows more behaviors than it should, allowing code execution 2: when printed, these urls are automatically executed by the shell, allowing code execution Neither ar…
Earlier quoted context omitted.
I can't believe curl | sh is still the recommended way to install oh-my-zsh
Getting it out of a repository wouldn't make any more vetting appear as if by magic. And if you're facing an attacker sophisticated enough to send different contents to a browser and to curl, then you're probably not going to find their backdoor in the first place. And it would be stupid of them to depend on that trick, so this becomes an extremely niche case not worth worrying about. And multiply that sophistication…
Checking the Accept header (or User-Agent or a bunch of other things) is very difficult :)
> Upgrade to iTerm2 3.5.0
I had just gotten the upgrade notification for 3.5.0 a few minutes ago. I scrolled through the release notes a bit and got to the "AI" section and I would like very much to get off this ride. I am grumpy and a terminal should be a terminal.
Features of iTerm2 I don't use and don't think belong in a terminal emulator:
- tmux integration
- shell integration
- ssh integration
- password manager integration
- hooks
- syntax highlighting *that's baked into the terminal*
- installing its own python runtimes (?!)
- ~blindly~ opening URLs when rendering a certain escape sequence [0]
Features of iTerm2 I use:
- fullscreen without using MacOS's spaces implementation of fullscreen
Edit: tried to cross out "blindly" above, it does ask you whether you want to open the URL, though it offers to always allow it for that host which seems like it might be iffy, but at least if I never click "always allow", I'll be notified if anything tries to inject this OSC sequence.
At the very end of the article, > Upgrade to iTerm2 3.5.0 I had just gotten the upgrade notification for 3.5.0 a few minutes ago. I scrolled through the release notes a bit and got to the "AI" section and I would like very much to get off this ride. I am grumpy and a terminal should be a terminal. Features of iTerm2 I don't use and don't think belong in a terminal emulator: - tmux integration - shell integration - ss…
It is cross OS (learn once and use the same terminal in Windows, macOS and Linux), actively developed and written in rust
At the very end of the article, > Upgrade to iTerm2 3.5.0 I had just gotten the upgrade notification for 3.5.0 a few minutes ago. I scrolled through the release notes a bit and got to the "AI" section and I would like very much to get off this ride. I am grumpy and a terminal should be a terminal. Features of iTerm2 I don't use and don't think belong in a terminal emulator: - tmux integration - shell integration - ss…
Give wezterm a try: https://wezfurlong.org/wezterm/index.html It is cross OS (learn once and use the same terminal in Windows, macOS and Linux), actively developed and written in rust
1. https://blog.mozilla.org/security/2019/10/09/iterm2-critical...
At the very end of the article, > Upgrade to iTerm2 3.5.0 I had just gotten the upgrade notification for 3.5.0 a few minutes ago. I scrolled through the release notes a bit and got to the "AI" section and I would like very much to get off this ride. I am grumpy and a terminal should be a terminal. Features of iTerm2 I don't use and don't think belong in a terminal emulator: - tmux integration - shell integration - ss…
Earlier quoted context omitted.
Getting it out of a repository wouldn't make any more vetting appear as if by magic. And if you're facing an attacker sophisticated enough to send different contents to a browser and to curl, then you're probably not going to find their backdoor in the first place. And it would be stupid of them to depend on that trick, so this becomes an extremely niche case not worth worrying about. And multiply that sophistication…
> sophisticated enough to send different contents to a browser and to curl Checking the Accept header (or User-Agent or a bunch of other things) is very difficult :)
https://web.archive.org/web/20240520142212/https://www.idont...