81–90 of 114 posts
Earlier quoted context omitted.
Not necessarily slow, DNS Lookups are generally pretty fast: ~ dig somerandomurlimadeup.com | grep 'Query time: ' ;; Query time: 23 msec
Er, that's just saying "you got lucky and the root nameserver you hit was fast". Looking up any valid .com requires that plus a 2nd level lookup.
What's more interesting to me is that some people are okay with a lookup on click but not a lookup on hover. It seems a difference in affirmative intent exists between hover and click; and more generally perhaps categories of user actions should be formalized into degrees of affirmation that could mitigate errors like this.
Hovering can be a part of the everyday copy-n-paste action though, for selecting the text to copy.
Given the level of concern, I will change the default and release a new version right away.
This is done. A summary of the issue and apology can be found here: https://gitlab.com/gnachman/iterm2/wikis/dnslookupissue
Was it really all about the “level of concern”, as you say, and you wouldn’t have changed this without the exposure?
Earlier quoted context omitted.
This is done. A summary of the issue and apology can be found here: https://gitlab.com/gnachman/iterm2/wikis/dnslookupissue
Why didn’t you do this two years ago, when the first bug report about this was made? ( https://gitlab.com/gnachman/iterm2/issues/3688 ) Or a year ago, when a second report was made? ( https://gitlab.com/gnachman/iterm2/issues/5303 ) Note that the first bug report explicitly mentions the leaking of passwords. Was it really all about the “ level of concern ”, as you say, and you wouldn’t have changed this without the e…
Given the level of concern, I will change the default and release a new version right away.
This is done. A summary of the issue and apology can be found here: https://gitlab.com/gnachman/iterm2/wikis/dnslookupissue
It never ceases to amaze me how otherwise intelligent people think it‘s a good idea to send unencrypted user data to random servers on the internet in the background.
Come on, it's doing domain lookups, it's not sending social security numbers to Russia. The amount of hyperbole regarding this misfeature is absurd. It was something that maybe should have been better expressed but this is not some kind of massive security failure.
But it means that every string that looks like a domain is transmitted unencrypted over the internet.
If your software deals with private user data, you must consider the side effects of every API you are calling. You can’t just transmit data somewhere and hope that everyone will do the right thing. Network traffic is monitored on lots of networks. Unless the data is encrypted and you have reason to trust the receiver, don’t send it.
And whatever you do, don’t send private data without user action. Users expect web requests to be made when clicking a link. They do not expect data to be transmitted when hovering the mouse over URLs.
Given the level of concern, I will change the default and release a new version right away.
This is done. A summary of the issue and apology can be found here: https://gitlab.com/gnachman/iterm2/wikis/dnslookupissue