SSH can do port forwards. Why does the conductor/iTerm2 interaction have to run over the normal shell at all?
"cat readme.txt" is not safe if you use iTerm2
131–140 of 197 posts
Re: "cat readme.txt" is not safe if you use iTerm2
#132One reason I still prefer iTerm2 or Ghostty over Terminal.app is that it has way saner settings for what the word boundaries are, and it lets me select whole paths by double clicking on them. If there was a way to change it for the default terminal, I would just be using it.
Re: "cat readme.txt" is not safe if you use iTerm2
#133Earlier quoted context omitted.
What you’re describing would be a completely unusable terminal. You’d lose things as basic as the backspace key. And what’s wrong with Terminal.app indicating when it’s suppressing output?
Terminal.app does not suppress output in my example. The ssh command switches the terminal into no-echo mode with termios flags. Terminal.app, being clever, watches for disabled echo (among other things) and assumes a password is being entered and displays the key icon and enables Secure Event Input. I don't want Terminal.app to be clever.
Why not?
Re: "cat readme.txt" is not safe if you use iTerm2
#134Earlier quoted context omitted.
What you’re describing would be a completely unusable terminal. You’d lose things as basic as the backspace key. And what’s wrong with Terminal.app indicating when it’s suppressing output?
You're talking nonsense. Backspace worked entirely fine on dumb terminals
[deleted]
Re: "cat readme.txt" is not safe if you use iTerm2
#135Earlier quoted context omitted.
From your previous post: >It's user data in JSON in an HTTP stream in a TLS record in a TCP stream in an IP packet in an ethernet frame. Then it goes into a SQL query which goes into a B-tree node which goes into a filesystem extent which goes into a RAID stripe which goes into a logical block mapped to a physical block etc. All of those have control data in the same stream under the hood. It's true that a lot of cod…
I distinctly remember bugs with non-Hayes modems where they would treat `+++ATH0` coming over the wire as a control, leading to BBS messages which could forcibly disconnect the unlucky user who read it. In this particular case, IIRC Hayes had patented the known approach for detecting this and avoiding the disconnect, so rival modem makers were somewhat powerless to do anything better. I wonder if such a patent would…
https://en.wikipedia.org/wiki/+++ATH0#Hayes'_solution
What was patented was the technique of checking for a delay of about a second to separate the command from any data. It still had to be sent from the local side of the connection, so the exploit needed some way to get it echoed back (like ICMP).
More relevant to this bug: https://en.wikipedia.org/wiki/ANSI_bomb#Keyboard_remapping
DOS had a driver ANSI.SYS for interpreting terminal escape sequences, and it included a non-standard one for redefining keys. So if that driver was installed, 'type'ing a text file could potentially remap any key to something like "format C: Y ".
Re: "cat readme.txt" is not safe if you use iTerm2
#136An almost identical security issue in iterm2 reported 6 years ago: https://blog.mozilla.org/security/2019/10/09/iterm2-critical...
So they learned nothing
"They" is 1 guy (George Nachman) who has tirelessly maintained this app in his spare time for 15 years. This is an arms race that's simply impossible for solo devs or even small teams to win. It's going to have a real chilling effect. I've seen a few popular open source projects take themselves private recently (eg cal.com) due to this.
Re: "cat readme.txt" is not safe if you use iTerm2
#137Barely anyone mentioned the "AI agent angle", I mean the situation when an AI agent runs "cat readme.txt" a file with embedded instructions becomes a prompt injection attack. It is the same vulnerability class out-of-band data smuggled through an in-band channel, just targeting the different parser.
Terminal security guys have been fighting this for decades and the AI guys are about to rediscover it
Re: "cat readme.txt" is not safe if you use iTerm2
#138Earlier quoted context omitted.
I think the problem is that 1) You want to be able to write arbitrary bytes, including shell escape sequences into files. 2) You don't want to accidentally write terminal escape sequences to stdout. 3) Stdout is modeled as a file. Consider cat. It's short for concatenate. It concatenates the files based to it as arguments and writes them to stdout, that may or may not be redirected to a file. If it didn't pass along…
> that may or may not be redirected to a file This is usually knowable. It's a different question whether cat should be doing that, though – it's an extremely low level tool. What's wrong with `less`? (Other than the fact that some Docker images seem to not include it, which is pretty annoying and raises the question as to whether `docker exec` should be filtering escape sequences...)
Docker images usually have "more" installed. Not quite as useful as "less", but usable enough.
Re: "cat readme.txt" is not safe if you use iTerm2
#139Earlier quoted context omitted.
This could be fixed with an extension to the kernel pty subsystem Allow a process to send control instructions out-of-band (e.g. via custom ioctls) and then allow the pty master to read them, maybe through some extension of packet mode (TIOCPKT) Actually, some of the BSDs already have this… TIOCUCNTL exists on FreeBSD and (I believe) macOS too. But as long as Linux doesn’t have it, few will ever use it Plus the FreeB…
For this use case, there would also have to be an extension to the SSH protocol to send such out-of-band information. Maybe this already exists and isn't used? The broader problem with terminal control sequences didn't exist on Windows (until very recently at least), or before that DOS and OS/2. You had API calls to position the cursor, set color/background, etc. Or just write directly to a buffer of 80x25 characters…
The Unix way died with Plan9/9front and there are no teletypes, period. Just windows with shells running inside as any other program. You can run a browser under a window(1) instead of rc(1) which is the shell.
Re: "cat readme.txt" is not safe if you use iTerm2
#140Earlier quoted context omitted.
plan9 and 9term solved this decades ago, right? https://utcc.utoronto.ca/~cks/space/blog/sysadmin/OnTerminal...
seems they removed the dangers, but didn't provide an alternative to write safe terminal apps.
We have namespaces from the day one. Proper namespaces.