iTerm2 critical security release

https://iterm2.com/downloads/stable/iTerm2-3_5_11.changelog

by tjwds • 2 years ago

671 429 2 years ago

wk_end• 2 years ago

A bug in the SSH integration feature caused input and output to be logged to a file on the remote host. This file, /tmp/framer.txt, may be readable by other users on the remote host.

Curious about how this happens. What does "framer" mean, here?

formerly_proven• 2 years ago

Sounds like something dropped in the code for debugging purposes and accidentally released.

CameronBanga2• 2 years ago

Here's the commit where it was reversed, if you want to take a look and dive in. Looks like unfortunately a logging feature that he has was set to 1 instead of 0 and wasn't reset before compiling.

https://gitlab.com/gnachman/iterm2/-/commit/014ba7ec40fc790f...

jey2• 2 years ago

iTerm2 increasingly seems too complex and bloated to me, with too many security issues. I haven't shopped for a new terminal emulator on macOS in a long time, but perhaps it's now time.

I should also get around to switching to tmux, now that GNU Screen seems to be stagnant...

slavomirvojacek• 2 years ago

I switched to Warp, much snappier, some AI features, overall very good experience. Also Ghostty is apparently good.

baq• 2 years ago

I’ve been using tmux for over a decade because screen was a bit on the legacy side back then

retrofuturism• 2 years ago

I recently gave Ghostty a chance and have since switched over from iTerm2 completely. It's very familiar and polished.

hmeh• 2 years ago

Same. So far so good.

akerl_3• 2 years ago

Probably worth noting that Ghostty was very recently vulnerable to an old/familiar class of terminal vuln that bit a bunch of older terminal applications a while back: https://dgl.cx/2024/12/ghostty-terminal-title

So moving to a newer / less "bloated" terminal may also just wind the clock back and cause you to encounter a similar sequence of vulns again, like some kind of unfortunate real-world "New Game Plus".

woadwarrior01• 2 years ago

I did the same. Although, Ghostty doesn't seem to have support for Find (⌘-F), yet. Also, had some minor hiccups with it and tmux on remote hosts.

dave44202• 2 years ago

I tried Ghostty earlier in the week, but couldn’t get it set up to look the same as iterm2 (the colours are off and text looks different somehow with the same typeface at the same size). Which is just cosmetic but makes it feel wrong viscerally.

I’ll give it another go at the weekend.

crabique3• 2 years ago

Unfortunately, it's nowhere near close feature-wise just yet: proper quake mode, search, prompt navigation, line timestamps, tab output indicators, forced keyboard locales, customizable toolbar with user-defined variables/indicators, are all too useful to give up iTerm2 for anything.

rcpt• 2 years ago

I tried Ctrl+r while she'd and it didn't work. Otherwise ghosty looked great

kergonath3• 2 years ago

I am using both at the moment, but iTerm has many, many features missing in ghostty. Most of them are not huge, but overall that’s a lot of paper cuts. Ultimately I wish both will stick around. Both have good ideas and I’d like them to keep evolving.

tylersmith• 2 years ago

Ghostty hasn't had to put out a critical update since before 1.0 launched.

segasaturn• 2 years ago

I tried Ghostty but the configuration file seems to be flakey. For example I wasn't able to turn off the cursor blinking in it (huge distraction for me) despite there being a configuration flag for it, it just wouldn't take it.

throwaway314155• 2 years ago

It's very familiar...

It is? Because as far as I can tell it is deliberately quite different from iTerm2. No GUI for preferences, for instance.

Not knocking it, it's a great terminal. I wouldn't describe it as "familiar" though, unless you're switching from, say, WezTerm or Alacritty.

FreePalestine13• 2 years ago

Does Ghostty support natural text editing like iTerm2 does?

dsego3• 2 years ago

I also switched over to Ghostty, but now can't do Cmd+F to search for strings, I think it's on the roadmap though. Also, there are no scroll bars on the Mac version, which I guess is not that important for a terminal.

2OEH8eoCRo0• 2 years ago

I don't use Mac but what's wrong with the default?

GNU Screen seems to be stagnant

Is it stagnant or mostly complete?

betaby• 2 years ago

Complete I would say. However Mac uses GNU software from around 2006, since around that time a lot of GNU software switched from GPLv2 to GPLv3. That means Mac ships GNU screen version 4 from 2006, while latest version is 5.

brabel• 2 years ago

I don't use Mac but what's wrong with the default?

Nothing, it works great. As someone who tried a bunch of alternatives: sorry but it's a waste of time unless you look at the long list of iterm2 features (terminal.app has many of them anyway) and think you might use those often (I don't, quite happy with my other apps covering for most of the features missing from the terminal.app): https://iterm2.com/features.html

lelandfe• 2 years ago

I try out the new apps each year and always go back to Terminal.app. My one gripe with it was that Opt-Del didn't delete words, which I learned last year can be fixed by Preferences > Profiles > Keyboard > Use Option as Meta key

Long live Terminal.app

Klonoar• 2 years ago

“Too complex” and “bloated” are catch-all that you should consider expanding further on.

I don’t personally iTerm2 to be be either of those.

kergonath3• 2 years ago

It is a bit slow, though.

zenapollo• 2 years ago

Would xpipe be a candidate? It’s also quite feature packed, but i was pleasantly surprised how nicely it got out of my way

paulddraper2• 2 years ago

now that GNU Screen seems to be stagnant...

That's not a new thing...

Aloha2• 2 years ago

What else does it need?

I get old code smell, and why folks might want something architecturally different, whatever - but screen is functionally feature complete.

icedchai• 2 years ago

I've considered "screen" complete since I started using it over 30 years ago.

Aloha2• 2 years ago

Same - I'm at about 20 years give or take.

It also has every feature known to exist in this space.

I agree though that the world is moving in the way of tmux - I'll get around to switching occasionally.

jey2• 2 years ago

I recently ran into a bunch of problems running neovim under GNU Screen with `TERM=screen.xterm-256color`. There was some kind of problem relating to GNU Screen's parsing and re-transmit of certain full-color terminal escape codes. I don't remember the details right now, but what I know is that building the latest from source didn't help. (I wish I could remember the specific issues)

JohnBooty• 2 years ago

I haven't looked super hard, but an iTerm feature I "gotta have" is triggers - regexps that match lines of text in the terminal and do an action.

You can do some complex stuff with them, but I "just" use them to highlight specific things when tailing output. Some of it might be possible with grep, but probably not

mhink2• 2 years ago

I really like alacritty + tmux, personally.

dylan6042• 2 years ago

I have used Terminal.app since 10.0, and have never felt like it needed replacing. What is lacking in Terminal that would improve my day to day by using a different app?

Vegenoid• 2 years ago

In my opinion, the most notable feature missing from Terminal.app is 24-bit color support. This is a standard feature in modern terminal emulators, and is one that I enjoy very much. But for many people, that is not a feature that makes a big difference.

tom_2• 2 years ago

That's a question that only you can answer. We have no idea what your average terminal activity involves.

(I can't remember why I switched. It must have been 10 years ago now, maybe more, and I've stuck with iTerm2 ever since (even though it annoys me with a new beta update practically every time I launch it). It could have been nothing fancier than the vertical window split. But there was definitely something that persuaded me to change!)

EDIT: this did get me wondering, and I noticed two things it does have that it looks like Terminal still doesn't: configurable mouse selection word boundary chars, and implicit copy-to-clipboard on selection. As an inveterate mouse selector, I wonder if it was these. I might well actually have the word boundary chars still set to the default ("/-+\~_." is what I've got), but I do use the click-to-copy a lot.

jonstewart• 2 years ago

There's a mini-renaissance going on with new terminal tools, like tmux, neovim (which has an ecosystem of plugins itself), htop, and many more (https://github.com/rothgar/awesome-tuis). They take greater advantage of 24-bit color, "nerd" fonts (that have icons for glyphs), some graphics capability, and so on.

I used Terminal for many years, too, but switched to iTerm2 a little over a year ago as I wanted to learn neovim.

charrondev• 2 years ago

For me it’s 3 major things:

- split pane support - profile switching (I have my colors change for different environments I ssh into). - tmux integration

lolpanda• 2 years ago

I'm a heavy use of tmux integration in iterm2. this allows seamless mouse scroll in a tmux window. I haven't seen any other terminals that provide the same tmux support.

jitl• 2 years ago

Wezterm doesn’t have tmux integration but instead implements multiplexing natively, meaning if you install it on a remote, it will host a mux server you can attach to over ssh. Pretty cool, and much faster/lower latency than tmux.

Fnoord• 2 years ago

Still use GNU Screen? Both GNU Screen and tmux had security issues in past, but GNU Screen had worse ones and that is why I switched. Zellij is a Rust terminal multiplexer, might wanna look into that. What I especially love about it, is tge discoverability of the keybinds. TUI wet dream.

waynesonfire2• 2 years ago

GNU Screen seems to be stagnant...

Not at all, it just had a release a few months ago,

GNU Screen v.5.0.0 is released posted by anaumov, Wed 28 Aug 2024 09:41:30 PM UTC

mattpavelle2• 2 years ago

A bug in the SSH integration feature caused input and output to be logged to a file on the remote host. This file, /tmp/framer.txt, may be readable by other users on the remote host.

Oof. This is nasty. Some folks may not have access to some machines that they've SSH'd into anymore where files like this may or may not exist.

rad_gruchalski• 2 years ago

This seems relevant:

When does this occur? --------------------- The issue occurs if both of the following conditions are true:

1. Either: a) You used the it2ssh command, or b) In Settings > Profiles > General, the Command popup menu was set to "SSH" (not "Login Shell", "Command", or "Custom Command") AND "SSH Integration" was checked in the SSH configuration dialog. That dialog is shown when you click the Configure button next to the ssh arguments field in Settings.

2. The remote host has Python 3.7 or later installed in its default search path.

mattpavelle2• 2 years ago

Yeah #1 reduces the surface area for sure, #2 maybe not so much :)

soheil6• 2 years ago

This bug almost never occurs as it's a very esoteric feature that 99% of people here never heard or used. If you're, however, the type of user who decides not to use `bash` or `zsh` and instead wants `ssh` as their default terminal command there are probably other unusual features that you use in other apps exposing you to many other attack surfaces that you also need to worry about beyond just iTerm.

Kwpolska3• 2 years ago

Looks like a case of print() debugging making it into production:

https://github.com/gnachman/iTerm2/commit/63ec2bb0b95078a97a... https://github.com/gnachman/iTerm2/blame/5db0f74bf647f6d53ea...

mulhoon• 2 years ago

It’s been around for 3 years?

CameronBanga2• 2 years ago

About six months. File was originally authored a few years back, but looks like this slipped in here: https://gitlab.com/gnachman/iterm2/-/commit/5db0f74bf647f6d5...

Kwpolska3• 2 years ago

Disabled by default until 7 months ago.

Waterluvian2• 2 years ago

In typescript dev I made “console.log” a linting error that cannot be merged. The occasional legitimate need uses console.info

I think print debugging is fine. It has a time and place. But ideally find a way to protect yourself from accidentally leaving it in. It’s such an easy mistake to make.

mort963• 2 years ago

Well this is an instance of writing to a file, so the JS equivalent would be calling .write on a file stream. Not exactly comparable, it wasn't literally a debug print() that someone had forgotten to delete but a log file that was enabled when verbose logging was enabled.

theamk• 2 years ago

in similar situations, instead of saying "VERBOSE=1", I say "VERBOSE=getenv("MY_NAME_MY_APP_VERBOSE") == '1'", and set this env variable in my terminal when needed. This way there is zero chance I commit verbose-enabled debug code.

orliesaurus• 2 years ago

not a typescript dev here: what do you use instead of console.log for debugging?

mort963• 2 years ago

That's not unreasonable code in itself, it's writing to the file only if verbose mode is enabled.

This is the commit which disabled verbose mode, just before the code which removed verbose framer logging entirely: https://github.com/gnachman/iTerm2/commit/014ba7ec40fc790f65...

This is the commit which enabled VERBOSE mode: https://github.com/gnachman/iTerm2/commit/5db0f74bf647f6d53e... (from Jul 3, 2024)

That is probably just from having set VERBOSE=1 while implementing or debugging something and forgetting to revert it to VERBOSE=0 before committing.

lupire3• 2 years ago

This is why all "temporary" settings go in .gitignored files or equivalent,

or on no-merge testing branches,

and we have test on the release branch that asserts for each config value that it is set to a safe value,

and we have a test that reflectively asserts that every config key has a value assertion test.

CGamesPlay• 2 years ago

This variable might have been better named LOG_ALL_STDIO_TO_TMP. Would have made it more obvious during self-review that it shouldn't be shipped.

nothrabannosir• 2 years ago

This happened to me so often that I made a git pre-commit hook to catch it: https://github.com/nobssoftware/nocommit for the word NOCOMMIT

Includes a GitHub CI action to prevent merging it in to master

It has caught so many of these mistakes for me…

MiscIdeaMaker99• 2 years ago

I would love to know more about how this got discovered and figured out. I can imagine some sysadmin pull their hair out, thinking they've got some infected system, but then find out it was some bug with their terminal emulator.

walterbell3• 2 years ago

got discovered and figured out

Unapproved usage of the exploit?

jcalx• 2 years ago

I know it's largely personal preference but are there any strongly compelling reasons to use iTerm2 over stock Terminal on macOS in 2025? Despite recommendations, I've been wary of security and privacy issues much like this SSH bug.

billowycoat• 2 years ago

There are reasons. Whether they are compelling or not, largely depends on what software you want to run.

https://textual.textualize.io/FAQ/#why-doesnt-textual-look-g...

BoingBoomTschak• 2 years ago

Two main reasons I switched is that iTerm can actually display bitmap fonts without mangling them (Terminal has anti-aliasing always on) and that it handles the difference between left and right Alt (needed because AZERTY layout + emacs).

ibejoeb• 2 years ago

Terminal has anti-aliasing always on

There's a setting under Profiles/Text in the Text section. It's the first checkbox. Does that work, or is there a bug?

eschatology• 2 years ago

I am using bitmap font with AA off in Terminal.app so this is incorrect

biwills• 2 years ago

Kitty (https://sw.kovidgoyal.net/kitty) has been my go to for many years and with tmux it's fantastic.

I have heard a lot of great things about https://ghostty.org/ but haven't had a chance to check it out

edit: oops, I misread your question as "what alternatives are there"

ilrwbwrkhv• 2 years ago

Kitty is really the only superior editor beyond ghostty terminal iterm weztwrm alacritty foot and others and the only one worth recommending.

clwg• 2 years ago

My only issue with kitty and tmux is that I always have to copy over my terminfo files manually or else I get a 'xterm-kitty': unknown terminal type error.

lr1970• 2 years ago

Instead, I would recommend Ghostty [1] terminal recently released v1.0 by one and only Mitchell Hashimoto of Hashicorp fame. It is OSS native cross-platform application (not an Electron one). I have been using it for the last year (private beta) on Mac and Linux and it rocks.

[1] https://github.com/ghostty-org/ghostty

klaushardt• 2 years ago

Could you post your config for inspiration? I dont like starting with a blank canvas.

screcth• 2 years ago

It implements tmux control mode. It's very useful when working with a remote server.

No other terminal implements it AFAIK.

mbreese• 2 years ago

What does tmux control mode do in practice? I use both (iterm2 and tmux), but not for this specific reason. I have just used both as a default for a long time.

So, what magic am I using without realizing it?

paulddraper2• 2 years ago

Tmux

otterley• 2 years ago

tmux runs just fine in Terminal.app. What else, then?

dgacmu• 2 years ago

I use the graphics support for making quick & dirty scrips for managing images (mostly for checking labeling and things like that where I don't want to bother creating a full web UI).

I tried Ghostty for this but couldn't get the images to display as quickly or in full resolution, but it's very possible I was holding it wrong. I'd love to switch, honestly, if anyone has a recommendation for how to make it work as well as the iterm2-tools Python package.

I also use multi-pane mirroring for managing some machines at home that I haven't bothered making more automated.

walterbell3• 2 years ago

strongly compelling reasons to use [3rd-party terminal]

Deniable ("popular app") increase in attack surface?

kergonath3• 2 years ago

Both are very competent terminal emulators. Just use either and you won’t miss much. I started using iTerm before the Terminal.app redesign (which was very much needed) and kept using it mostly for the tmux integration (which is a strong reason to use it). Nowadays, I would be happy using either. Ghostty is fine as well, though not as polished yet.

cduzz• 2 years ago

I got tired of weird sketchy seeming behavior in iterm2 (it'd hang randomly when accidentally sending binary streams to stdout; it'd take forever if I asked it to search my many tb of buffer, etc). I switched to xquartz and xterm, which was fine; I had to retrain my fingers back to whatever they'd been trained to do in 1998, but they got there.

But probably that's terrible advice for 99.8% of people out there, probably more like 99.998, or even more 9s.

liveoneggs• 2 years ago

native Terminal.app doesn't have true color support (24 bit colors). I was happy using it but wanted to try some fancy vim themes.

I stopped using iterm after it did the chatgpt integration, which was a bridge too far for my tastes and landed on wezterm. All of the alternatives have nits.

xyst2• 2 years ago

Same. I switched to Alacritty and later Ghostty.

jamesgeck0• 2 years ago

It's dumb, but Terminal.app is about eight years behind every other macOS terminal in supporting true color mode. Feels like sort of a table stakes feature in a modern terminal, and makes me suspect Terminal.app is not a high priority for Apple. The people want pretty editor themes!

dmd2• 2 years ago

The killer feature for me is Edit>Selection Respects Soft Boundaries, which lets you copy text from inside windows defined INSIDE the terminal - like tmux or emacs splits - where iTerm figures out that, e.g., a pipe character is a window boundary.

Two more:

2) if you accidentally close a tab/window, you have a few seconds to hit ⌘z and the window will reappear as if you never closed it!

3) Minimum color contrast. If your terminal color scheme and what you're running's color scheme interact poorly to create something that would be unreadable, iterm notices and you can have it override those colors to be something of higher contrast, automatically.

But that's just my killer features. iTerm is like Word - it is a bloated monster with thousands of features. Nobody needs them all, but nobody agrees on which ones they need.

olyjohn• 2 years ago

Being able to SSH into multiple machines, and mirror your keyboard across all of them is my favorite feature.

wkat42429• 2 years ago

Ok those things are interesting though not killer level for me. But I moved away from Mac now because I found their stuff too opinionated. I use KDE now. I wonder if iTerm2 also exists on Linux if it's open source?

nox1013• 2 years ago

So the only reason I switched to iTerm2 was because I wanted my terminal to change color when I ssh into different hosts. If I ssh into my work machine the terminal turns blue. If I ssh into my home machine the terminal turns purple. I'd tried to do this with the default terminal but ran into issues with it getting confused depending on how a session ended. People suggested iTerm2 because it supposedly solves this. And it does, at least for me.

FreePalestine13• 2 years ago

How do you do this? Didn't know about this feature.

_morgs_• 2 years ago

This! I've played with wezterm and ghostty but haven't been able to get this working there, so I keep coming back to iTerm2 for this exact feature - so that prod servers have a red background, etc.

xyst2• 2 years ago

Mitchell Hashimoto and group of contributors released a native terminal app recently - ghostty.org

Well suited replacement for iterm2 and terminal.app, imo

fastball3• 2 years ago

I like the highly configurable quake mode in iTerm2.

ggregoire• 2 years ago

I was gonna ask if Terminal never had any security issues, then tried to find a page with its release notes, and unfortunately couldn't find anything.

I also tried different macOS release notes [1][2][3][4], doing ctrl F "terminal" and could't find anything either.

Does anyone know where this is published? Is it not publicly available?

[1] https://developer.apple.com/documentation/macos-release-note...

[2] https://support.apple.com/en-us/120283

[3] https://support.apple.com/en-in/109035

[4] https://support.apple.com/en-us/106337

dgl• 2 years ago

There definitely have been CVEs in Terminal.app, over many years:

- https://www.cve.org/CVERecord?id=CVE-2008-0042

- https://www.cve.org/CVERecord?id=CVE-2002-1898

- https://infocon.org/cons/Disobey/Disobey%202017/Mikko%20Kent... [video, I can't find a reference to that in Apple's release notes]

- There is also https://seclists.org/oss-sec/2018/q1/216 -- which led to a vague credit for Federico Bento in https://support.apple.com/en-ng/103758 proving they don't give everything CVEs (fine, but when the issue is public already it would be helpful to have a bit more detail).

I reported https://dgl.cx/2023/09/ansi-terminal-security#apple-terminal... to Apple ~2 years ago and they still haven't fixed it. It's not as serious as some vulnerabilities though and likely doesn't deserve a CVE, would be nice if they fixed it though.

(Finding this can be hard because Apple only link to release notes for currently supported versions, the pages are still around if you know the URL or you can find them via searches if they happen to be indexed still.)

pathartl• 2 years ago

I stepped back into macOS for the first time in ~8 years and was disappointed by Terminal. To be honest, I think Windows Terminal is much better, which feels a bit weird to say.

mr_toad• 2 years ago

Terminal came out 23 years ago, Windows Terminal in 2019. The old Windows terminal was garbage.

I still prefer the blurred transparency of Terminal over the too transparent Windows Terminal, but that’s a matter of taste.

freehorse3• 2 years ago

Pretty sure if it gets upgraded to become more modern somebody somewhere will also complain about it losing its simplicity.

klausa2• 2 years ago

This, of course, depends on how long you’ve been using macOS and what long list of quirks you’ve acquired.

For me, „just” being able to use a full-screen-mode-that-is-different-than-native-macOS-full-screen is worth it; but I imagine there are maybe like seven other people out there for whom it matters.

thuanao• 2 years ago

This is the only reason I use iTerm2. I can view the terminal full screen while also instantly switching to the browser or other windows, without the animation.

oneeyedpigeon2• 2 years ago

full-screen-mode-that-is-different-than-native-macOS-full-screen

Thank you for reminding me why I should just return to iTerm! It might seem minor to some, but this is such an essential 'feature' that it probably overrides all other differences, for me.

One small question, though: are you aware of anything that 'native' full-screen does that 'bespoke' full-screen misses out on? Any disadvantages whatsoever?

elgenie• 2 years ago

Full-screen-but-not-native is useful enough that it's handy to have around for all windows in all programs.

So the move there is to install Rectangle.app (https://rectangleapp.com/), the successor to Spectacle, and then choose your terminal independently.

sweezyjeezy2• 2 years ago

I use it primarily for its split pane functionality. Invaluable if you need to see multiple things happening on the same machine at once. I work in data science and often have several long running jobs on a single server, a notebook server, htop/iotop, nvidia-smi, or simply just having different panes cd'd to different directories - with iterm you can organise to a single terminal tab for each machine (including local), or group tabs across machines if they are for related work.

fletchowns• 2 years ago

Have you tried using tmux?

nickysielicki• 2 years ago

When I’m forced to use something else, I miss eternal-terminal atop tmux control mode and iterm. It’s total bliss and there’s no other terminal emulator on any platform that can compare.

chamomeal• 2 years ago

If the stock terminal app supported more colors (idk what the official term is lol) I’d be fine using it. I don’t use any fancy iterm features anyway. Fish + zellij is all I need!

citrin_ru• 2 years ago

Copy on select is the feature I used to over the years (on BSD/Linux) and stock Terminal lacks it.

chikere232• 2 years ago

Control-tab can be set to cycle through tabs in recency order rather than the bad apple default of "go to the next tab to the right".

It has far too much feature bloat though to the point that it's somewhat brittle, and I'd imagine there are many more lurking security issues

chedabob• 2 years ago

I just like having it docked to the top of my screen, and accessible via a global shortcut.

I'm sure there's a thousand others that do both of those things, but I adopted iTerm2 about 10 years ago, and it hasn't given me cause to investigate others.

st3fan• 2 years ago

I'm done with iTerm2.

This was a great terminal when it was basically Terminal.app + missing features but over the past years it has grown into the proveribal "Kitchen Sink" and now does SO MANY things that I just don't care about.

iTerm2 has become a huge app with many many knobs and levers and all kinds of functionality and integrations. I am not surprised at all that (security) bugs are found. More code, features, integrations means more potential for security issues.

I switched to Ghostty, yes which had a security issue last week!, but at least it is a pretty minimal app with so far no intent to meet iTerm2 in terms of functionality.

lucasoshiro• 2 years ago

does SO MANY things that I just don't care about.

The integration of iTerm2 with Fish was so buggy that I needed to disable, then I lost some features like imgcat... These bugs persisted while they were introducing AI features that I really don't care (it's a terminal, why would we need AI???).

I think it's time for me to move on... I don't need too much, just something that works as good as Konsole does on Linux distros. The comments here (yours included) made me consider using Ghostty.

Philpax2• 2 years ago

These bugs persisted while they were introducing AI features that I really don't care (it's a terminal, why would we need AI???).

Many terminal programs, especially older ones, are known for having confusing or unintuitive interfaces, especially if you use them sparingly and you need to do something specific that can't immediately be gleaned from search results or from the man page.

I've personally found Claude to be tremendously helpful for these cases; I am now much more confident in my use of ffmpeg, as Claude can often zero-shot the invocation for my particular need, or give me the opportunity to follow up and narrow the details of the problem.

Given that, I'd happily welcome the iTerm2 integration, which I'm led to believe was optional, as I could readily specify the behaviour / action I want in natural language and have the AI produce the correct invocation without having to leave the terminal.

This could also be addressed through a CLI application to invoke a LLM (i.e. simonw's `llm`), but that's not as convenient as having the terminal itself insert the LLM's response for evaluation and execution.

mtoner23• 2 years ago

tried out ghostty but its still missing some key features like cmd+F for searching. sadly sticking with iterm for now

paxys• 2 years ago

That sound you hear is IT admins worldwide scrambling to delete /tmp/framer.txt from all their servers.

NelsonMinar• 2 years ago

How does a bug like this last for so many months without being noticed? Did no one notice a weird file in /tmp and wonder where it came from? The one with their ssh session history in it?

zamadatix• 2 years ago

Given the purpose of the /tmp directory it seems an unlikely source for one's afternoon reading. I wonder what % of iTerm2 users use this integration feature as well. I didn't even know it existed.

runlevel1• 2 years ago

Perhaps not that many people were using `itssh` or replaced the initial profile command with SSH + SSH integration.

kccqzy2• 2 years ago

It sounds like a rarely used feature of iTerm2. I have not even heard of it despite using iTerm2's shell integration and tmux integration for a long time until I switched to Linux.

kelnos• 2 years ago

I deeply regret this mistake and will take steps to ensure it never happens again.

I always get a little... sigh-y when I read statements like these. What steps? I'm not even sure what I would do to ensure something like that wouldn't happen again. Build some automated tooling to run the software that exercises every single feature it has, and capture system calls to ensure that it never opens or writes to files? That sounds like a very difficult thing to do (to the point that I wouldn't even try, especially for a GUI app), but anything less doesn't feel like you can ensure it won't happen again.

mhink2• 2 years ago

Given the brevity of the security report, I figure the author wanted to get the relevant details about the *incident* posted as fast as humanly possible. However, it does seem appropriate to acknowledge that just because they're being terse doesn't mean they don't understand how big of a mistake it was.

That being said, I would also strongly expect a more in-depth blog post following up, with details about just the sort of thing you're mentioning.

smallnix• 2 years ago

I understand the interest about this bug, but to my understanding this is an unpaid hobby project?

If that's true I don't feel entitled to expect anything here.

refulgentis• 2 years ago

Right, you get it in toto IMHO: this is the least worst thing they can say, and also the best thing they can say.

If they don't apologize, that'd be worse.

If they don't indicate they'll take steps to prevent this from happening in the future, that'd be worse.

If they had all the steps ready right now, I'd be confused because they should have A) fixed the bug B) deployed the fix C) communicated the bug exists and a fix was deployed. Blending that with D) postmortem would show an undisciplined approach.

If they claimed the ability to prevent all bugs ever, or at least, all unintentional file writes, I'd be confused because it's impossible to prove it never writes to a file.

A good start is to do what he did (delete the ssh logging altogether), and start investigating automated ways to validate if/when files are accessed. The cool thing about macOS dev is there's a ton of tooling that leaps and bounds beyond cross-ecosystem tooling. I wouldn't be very surprised if someone linked an obscure mid-1990s technical note that lets you set an NSArray of paths that are allowed access, or if Instruments had some built-in dtrace integration that could pull this off. Couple running that in CI, make sure you got test coverage, and you've done the best you can.

(n.b. a lot of it seems to hinge on "I deeply regret this mistake and will take steps to ensure it never happens again." being read as "I deeply regret this mistake. I will do things until I can, absolutely, 100%, foreever, guarantee it'll never ever happen again." For the young and impressionable: the blog post is great, there's ~0 you could do better here)

lupire3• 2 years ago

Better would say "After the immediate problem is patched, I will post more details about future plans for security, probably within X days. I welcome suggestions on the feature tracker."

Empty vague promises aren't really better than being quiet. They rely entirely on the reader's good faith, but if that good faith exists (which it likely does for this excellent product and excellent developer), then the promise adds no information.

Kevcmk• 2 years ago

Just a reminder that iTerm is FOSS: https://github.com/gnachman/iTerm2

waynesonfire2• 2 years ago

whats the paid alternative?

dymk• 2 years ago

Seriously? It’s free and open source, give the guy a break. He’s a human being.

ed_mercer• 2 years ago

Isn't that his/her point?

kortilla• 2 years ago

He’s saying that statement is unnecessary over-commitment. Not that he’s not doing enough

kureikain• 2 years ago

such a bad take. as a software engineer thing like this happen all the time. no matter scale we will screw it.

what steps we can take is that it's now a lesson to make it more caution when we went into that path.

dylan6042• 2 years ago

there's lots of things you can do with deploy scripts to help prevent bozo errors from devs. Just like the code looking for credentials uploaded to github, you can do whatever type of searches that you as a developer is prone to making. it's a cya type of thing.

twh270• 2 years ago

Another comment mentioned using a linter to prevent 'console.log' from being mergeable in a PR, and this is exactly the kind of approach I'd take. Preventing an invalid state from existing is a pretty useful principle.

Meekro• 2 years ago

Gazillions of dollars have been spent on fuzzing Chrome/Chromium, and they're still finding dozens of serious issues per year. Same with every other major product. The reality seems to be that we, as programmers, can't do any better than this. If that's the case, it's unfair to lay it all at the feet of this one guy.

blinded• 2 years ago

Exactly. Anyone complaining should donate time or money.

jessekv• 2 years ago

The code to write to log files in SSH integration has been deleted

Seems like a good first step.

dd_xplore• 2 years ago

Talk is cheap, send patches

ijustlovemath• 2 years ago

Coming from medical device background: procedures. Documents that explicitly lay out the things you have checked, how you checked it, date of check, and your signature on it at the end.

When you learn or anticipate a new failure mode, thats a new step in the corresponding procedure. Sometimes you'll be able to automate this stuff, but when the impact is this deep, it will not kill you to add some manual workload to your release process.

SamuelAdams• 2 years ago

Delete /tmp/framer.txt on affected hosts.

Isn’t the correct fix to assume compromise and rotate all SSH keys? I imagine there will be scripts created very quickly to grab this file from any servers, so even if it is deleted soon there is no guarantee someone else has not read it.

saghm2• 2 years ago

I'm not sure I follow. From what I understand, the issue is that literally all of stdin and stdout is potentially leaked to a globally-readable text file. ssh-keys wouldn't normally be part that leaked information (other than if you `cat` your private key, but by that logic, literally any credentials ever stored in a file or potentially even an env var would be equally susceptible). Yes, anyone with ssh access would have access, but nothing about this vulnerability seems to imply it would allow an unauthorized user to gain ssh access. It doesn't sound like this is something with a specific risk of leveraging into ssh access because the only ones who can read the file are the ones with access in the first place, so there's no more reason to suspect that now compared to any other point in time.

varenc• 2 years ago

Agreed. I believe this means just means that the entire contents of your ssh session is available in /tmp/framer.txt. But as long as credentials aren't part of your STDIN/STDOUT, then they shouldn't be leaked.

Your ssh private key definitely would never be in there. The server you're connecting to doesn't even know your private key, just the public one.

isatty• 2 years ago

On the bright side this made me realize the stock terminal app has improved. I do use iTerm2 for its better rendering of text and color (and easier configuration of those things) but I don't really make use of any other features. Time to switch, perhaps.

eximius• 2 years ago

hah! Clicking "Remind Me Later" for the update prompts works again!

ryanmccullagh• 2 years ago

Why does a terminal need an SSH integration. Answer: it doesn’t and you shouldn’t use this because it is unsafe.

ldjb• 2 years ago

A terminal doesn't need SSH integration, but it's convenient if it does, to allow you to easily start and manage connections. Is there something inherently unsafe about such an integration?

Xelynega2• 2 years ago

There's something inherently unsafe with replacing an industry-standard security tool with anything.

I don't think it's inconvenient enough to type `ssh -i key_file name@host` that we need to be creating more security risk to skip typing it.

nerdponx• 2 years ago

Nobody needs anything ever but sometimes things are useful.

noisy_boy• 2 years ago

Surely a few bash aliases for the same purpose are equally useful and more portable?

decasia• 2 years ago

I'm confused by the comments saying "Just don't use iTerm2." The same class of issue can occur for any other project, and switching is not a very effective defense against it.

If anything, having an embarrassing issue like this is probably going to improve the iTerm2 project's security posture in the medium term. It's like that joke about firing the engineer who caused the incident, and the manager who retorts, "Why would I fire them? They just learned the hard way never to make this mistake again." (I'm paraphrasing.) I don't think that iTerm2 has had a notably high rate of critical security issues, and I suspect they won't make this class of mistake twice. (And if they do - then I will re-evaluate.)

I suppose intuitively I would think that using the default MacOS Terminal app is a bit lower-risk than using iTerm2 or any other open source terminal emulator, as Terminal is a rather sparse piece of Apple-provided software with a low pace of change. But it's also closed source and impossible to audit, so there are tradeoffs there too.

zitterbewegung• 2 years ago

There was another issue where iTerm2 added AI functionality and then after some backlash allowed the ability to turn it off. If the additional features (which is why you would use iTerm2 in the first place) start making more and more problems it is starting to make more sense to use terminal.app or alternatives.

ratorx• 2 years ago

This is incorrect.

iTerm2 never enabled any AI features by default (it always required an OpenAPI key, which the user had to provide). The backlash was for including an AI related feature in the default build at all.

Following the backlash, I think they made it an optional plugin.

jki275• 2 years ago

Wow -- as already posted, this is absolutely false. This is not at all what happened, the iterm2 folks are way more sensitive to their users' feelings than that.

internet2000• 2 years ago

The built-in Terminal is a) simpler, smaller attack surface b) older c) supported by probably more than one person, in a more risk-averse org d) used by a lot more people so issues will get noticed and fixed sooner e) part of a pretty robust public beta OS program.

Just don't use iTerm2.

anon7000• 2 years ago

And best of all, not as good, and not open source!

azinman22• 2 years ago

I don’t have the stats, but I wouldn’t be surprised if iterm 2 is more popular than Terminal.app. Only power users are using this, and they tend towards power user tools.

stonogo• 2 years ago

You forgot f) doesn't support tmux control mode.

Patrick_Devine• 2 years ago

It also doesn't render unicode characters correctly (specifically unicode block chars). And they refuse to fix is, so d. is kinda a moot point.

nikau• 2 years ago

You forgot f) so lacking in features that it's a productivity roadblock

hombre_fatal• 2 years ago

Point D is a thing we assume about software but over time you realize it's not the case. You'll see a native macOS app like Terminal and assume it's blessed by Apple, has its own dedicated team with daily standup and meetings, but it's actually just propped up by random tickets in a larger issue tracker, doesn't have a dedicated team, and depends on what amounts to begrudged work or charity work by whoever happens to work on a ticket in passing.

A random rockstar will come in and move the code forward 5 years never to be seen again.

shlomo_z• 2 years ago

I would argue that opinions such as this stifle innovation

saagarjha4• 2 years ago

supported by probably more than one person

lol. lmao. When I was at Apple it was one guy to like 4 apps

dangus8• 2 years ago

It’s fine if you don’t want features in your terminal, but telling people who do like having software that has features not to use an alternative just because “more features equals complexity equals security risk” in the way you’re doing it is pretty condescending.

Let’s not forget that basically every graphical IDE on the planet has an integrated terminal emulator, and for good reason

I’d have a smaller attack surface if I turned my computer off and did all my work for my employer with pen and paper. I’d have a smaller attack surface if I didn’t buy a Mac at all and only used a security-hardened distro.

And here you are acting like Apple is God’s gift to stability and security when every single fall season Apple’s major dot zero version updates ship with visible bugs all over the place.

And to nitpick you, the assumption that more than one person is actively working on the default macOS terminal is laughable. I doubt it even has a full time employee dedicating 100% of their time to it. The yearly release notes look like less than one person’s annual output of work.

I remember that thread on here where the person who worked on Rosetta 2 said it was a solo project for years until closer to release when the team expanded to around 10.

mvdtnz• 2 years ago

Unfortunately the isn't the first very serious security oversight with iterm2.

https://news.ycombinator.com/item?id=15286956

JoBrad• 2 years ago

Honestly that 7 year old thread makes me glad I use iterm2. George posted a fix in a short period of time (which he still does today), and added comments to that thread addressing the issues. Sounds like a decent person who cares about his users.

vlovich12310• 2 years ago

Only if they actually communicate what they’ve learned from it and what changes they’re making to prevent such mistakes in the future / catch them before release. Until then you can assume that they’ll keep making similar classes of mistakes.

jdwithit• 2 years ago

I mean the patch notes for this issue literally do this, so they seem to be off to a good start.

soraminazuki11• 2 years ago

What did George ever do to you that warrants this level of contempt and condescension? Am I missing something, because there are so many activists like you having an inexplicable vendetta against iTerm2 all over this thread.

This is sad because iTerm2 is one of the best terminal emulators out there. It's the first terminal emulator that popularized shell integration. Newer terminal emulators are still catching up, a decade later. tmux integration is another popular feature that's still unique to iTerm2. George has been working tirelessly on iTerm2 pretty much solo for 15 years [1]. To this day, he continuously brings new improvements to the terminal experience that keeps being copied by other terminal emulators. Developers benefit from his work, iTerm2 users and non-users alike. We should be expressing our gratitude instead of doing whatever people are doing in this thread.

George found this security issue the day after New Year's day and immediately released a fix [2]. That's commitment. And while the effects of this bug can be severe, most people wouldn't have triggered the bug.

    > 1. Either:
    >   a) You used the it2ssh command, or
    >   b) In Settings > Profiles > General, the
    >      Command popup menu was set to "SSH" (not
    >      "Login Shell", "Command", or "Custom
    >      Command") AND "SSH Integration" was checked
    >      in the SSH configuration dialog. That dialog
    >      is shown when you click the Configure button
    >      next to the ssh arguments field in Settings.

It's almost as if some people are jumping at any chance of retribution, justified or not. This all sure intensified after iTerm2 at one point introduced an AI-related feature into the default build that one can just safely forget exists by not actively enabling and engaging with it. Some in the Mastodon community even went as far as openly fantasizing about inflicting violence on the poor dev [3]. I just can't understand the morality of some of the people you see online.

[1] https://github.com/gnachman/iTerm2/graphs/contributors

[2] https://github.com/gnachman/iTerm2/commits/master/?since=202...

[3] https://web.archive.org/web/20240613170001/https://archive.i...

godelski2• 2 years ago

  > The same class of issue can occur for any other project

This class of issues sounds like the prolific class of

  DON'T WRITE TO /tmp

Which is why systemd has a private tmp option

https://salvatoresecurity.com/the-many-perils-of-tmp/

https://systemd.io/TEMPORARY_DIRECTORIES/

0xbadcafebee3• 2 years ago

Safely writing to /tmp/ was solved in 1986. Personally I would consider this class of bug the "idiot software developer" class (or to be more charitable: "security-illiterate software developer"). My evidence? There are (at least) six different OS primitives that will avoid this bug.

boomlinde6• 2 years ago

I am inclined to say that a low pace of change isn't necessarily a problem for something that at its core emulates 70s hardware.

It can easily become a problem if you don't leave it at that and add everything and the kitchen sink to it. Not having used the feature I have a hard time imagining why a terminal emulator should have SSH integration to begin with.

saagarjha4• 2 years ago

Hardware in the 70s was full of security issues. Designing a secure terminal emulator is actually quite difficult.

kmacdough• 2 years ago

The comment puts the slow pace of change as an advantage. Pretty standard security principle.

Ssh integration brings lots of other "local" iterm features based on command history, etc. to the ssh environment. If you do lots of ssh work and use a lot of relevant iterm features then it's nice. Otherwise not.

Obviously, these features can be recreated with traditional tools. But these tools take time and experience to setup, and aren't naturally intuitive, despite the insistence of emacs elitists. For those who don't want to invest significant effort learning tmux, it's really nice to just check/uncheck a few boxes.

wkat42429• 2 years ago

I don't think Apple terminal is sparse at all. Try to dig through the preferences, there's surprisingly much choice for an opinionated software vendor like Apple. I love it, I've tried iTerm2 in the past but I just saw no reason to keep using it. The only feature that slightly appealed to me was the tmux integration but I found that i preferred to just have tmux inside the terminal instead.

I know some people that use the game-like rolldown interface (quake mode?) but I also don't like/need that one. There's a few niche things like that which make it interesting. But overall I just don't see the need.

If there's something that's sparse in options, it's Windows Terminal. Don't like that one at all (though it's better than the previous command prompt window).

Kwpolska3• 2 years ago

Windows Terminal has a ton of options these days. Last time I used Apple's, it had very US-centric handling of Alt/Option, unlike iTerm2.

vouaobrasil• 2 years ago

I've tried iTerm2 in the past but I just saw no reason to keep using it.

One feature that's cool in iTerm2 is that you can define the left and right margins so using Vim full-screen looks nicer (I hate narrow margins). But I've switched to Sublime text for everything so I stopped using iTerm2.

frizlab3• 2 years ago

I love Terminal. I tried iTerm2 but never got the appeal and switched back to Terminal.

johncoltrane3• 2 years ago

I used iTerm2.app for a while, back when Terminal.app didn't support 256 colors. That was literally the only reason and I ditched it the day Terminal.app got 256c, many years ago, now.

danyala• 2 years ago

Ghostty has the quake mode interface and has allowed me to overcome my shame for never graduating to iTerm. I can't remember much about the game except the giblets but hopefully I've understood.

alwyn• 2 years ago

The majority of configuration options in Windows Terminal are hidden in JSON. The GUI only exposes a fraction. They are doing work to expose more options in the GUI though.

Having tried various alternatives for prolonged periods, it is currently IMHO the best option when you have to work on Windows.

Mac and Linux options are just vastly ahead.

sedatk• 2 years ago

having an embarrassing issue like this is probably going to improve

LastPass disagrees.

eptcyka7• 2 years ago

What do you mean by saying that the same class of issue can happen to any other terminal emulator?

loeg• 2 years ago

This was only for the SSH integration, not if you just ran "ssh" in iTerm? I don't see these /tmp/framer.txt files on any of the hosts I sshed to (plain ssh).

teruakohatu2• 2 years ago

From the release notes it seems only if the in-built SSH integration was used and the server that a more recent (5ish year old or later) version of Python. The latter condition is probably going to exist even on enterprise dists (RHEL 9 for example will have Python 3.9 installed by default)

welder2• 2 years ago

The latter condition must not always trigger... I have Python 3.7 or later and none of my servers have a `/tmp/framer.txt` file.

mrichman• 2 years ago

Glad I switched to Ghostty this week.

teruakohatu2• 2 years ago

I feel deeply for the developer who develops iTerm for relatively very little money, and already took a lot of criticism for the AI integration, far more than was warranted.

I am also also deeply concerned about my use of iTerm now.

I access HPC environments where I may have access for a short period of time. I am expected to take responsibility to clear out my data after use and don't expect there to be any data leakage. If I had been manipulating PII research data in the past year and using iTerm's SSH integration I would be in a bit of a bind and have to send some really embarrassing emails asking sysadmins to see if these logs exist, and if they belong to me, followed by disclosing data had been leaked.

I use some of the more advanced features but at this point wonder if I should be using any features beyond the basic, and then I may as well be using another terminal. I haven't found a cross-platform editor that feels as native on MacOS as iTerm, ghostty included.

shwouchk3• 2 years ago

I highly recommend wezterm.

rcruzeiro2• 2 years ago

I tried WezTerm recently but I unfortunately could not type backslashes on an ISO keyboard. There were other minor annoyances such as new tabs always opening on the last directory I was at and not my home directory (this was something that could be configured, but I never managed to do it). Ultimately, it was the problem with the backslashes that drove me back to iTerm.

https://github.com/wez/wezterm/issues/4051

soheil6• 2 years ago

Based on what? How do you know it's not riddled with major security bugs?

At least iTerm has been around for over a decade and loved by many hardcore power users.

VeejayRampay• 2 years ago

Ghostty, Alacritty and Kitty are also very good options

mattl2• 2 years ago

I use Prompt by Panic.

keyle2• 2 years ago

from the App store, the only place where you can get this app...

    Location
    This app may use your location even when it isn't open, ...

just... why would a terminal emulator need my location...

Not to mention the exorbitant price for a lifetime license.

0xbadcafebee3• 2 years ago

Fwiw, it's not your responsibility to maintain a secure computing environment (assuming you're a researcher). If you, personally, have to vet the whole system and all the software you use for security, then they have none.

A competent system administrator with a knowledge of system security can easily configure a host so that when you SSH in, files you create are not given world-readable permissions by default. They can add other lock-down mechanisms that isolates all the users' files entirely. And they can simply disable all world-writeable folders like /tmp/.

So in case anyone gives you (or anyone else) a load of crap about using insecure software, ask them why their systems are so insecure.

faust2012• 2 years ago

I assume you never worked in academia. Sometimes hpc are installed by researchers (incl myself) as there is no budget for IT staff.

DavideNL• 2 years ago

Why switch to another terminal, after 1 issue, in all this time since it exists?

It’s like throwing away your car after having a flat tire… perhaps iTerm is still the best option available, considering all the plus points / features it has.

xucheng• 2 years ago

Many years ago, I reported an issue where iTerm2 leaks sensitive search history to preference files [1]. The issue was quickly fixed. But until this day, I can still find people unintentionally leak their search history in public dotfiles repos [2].

[1] https://gitlab.com/gnachman/iterm2/-/issues/8491

[2] https://github.com/search?q=NoSyncSearchHistory+path%3A*.pli...

hbbio• 2 years ago

I always preferred alacritty which is faster and hopefully safer.

Tha macOS part uses the rust `objc2` crates which I find high quality and the codebase is a joy to read.

johnsonalpha• 2 years ago

I’m a bit confused by the suggestion to "Just don’t use iTerm2." The reality is that this type of issue could happen with any project, and switching tools doesn’t provide meaningful protection. If anything, incidents like this often lead to stronger security practices. It’s like the old joke about firing an engineer after a mistake, and the manager responding, "Why would I fire them? They’ve just learned a lesson they won’t forget." Based on iTerm2’s track record, it doesn’t seem like they’ve had frequent critical security issues, and I doubt they’ll repeat this mistake. If they do, then it’s fair to reassess.

As for the MacOS Terminal app, it might seem like a lower-risk option because it’s simpler and updates less frequently. However, being closed-source makes it impossible to audit, which brings its own risks. Ultimately, every tool has tradeoffs, and choosing the right one depends on balancing your needs with the potential risks.

epistasis• 2 years ago

could happen with any project, and switching tools doesn’t provide meaningful protection

Do you believe that developments practiced have an impact on security bug rate? Second, do you believe that past track record is reflective of that security bug rate?

These are two reasonable beliefs that many people hold. It's a far more nuanced view than "every project could have bugs" which is a black-and-white view that does not assess risk in a useful way.

locusofself• 2 years ago

I just want to sing some praises for iterm2. I've been using it for work and fun for many years now and will continue to use it and send a donation again as I did once before.

Upvoter33• 2 years ago

Agree. It's one of the best things I use all the time.

coolgoose• 2 years ago

Looking at the replies here, I am not even sure how to react, it seems this community overall is going into a sad direction that just blames instead of trying to think of solutions.

Most of them are just entitled and aggressive for absolutely no reason.

It's perfectly fine to want to switch, or try something else, but to think other projects couldn't have issues is just naive to say it gently.

lpapez• 2 years ago

I think that goes for society as a whole. We should all be more emphatic and considerate. Especially around things like this - it's not the end of the world. Software is difficult and shit happens all of the time, give the maintainers a break...

nozzlegear• 2 years ago

We should all be more emphatic and considerate.

I'm sure it was just autocorrect being a nuisance, but you probably mean empathic.

kevingadd4• 2 years ago

The developer of iTerm2 has a thankless job to be sure, but the reality is that when you build this kind of software you have a certain responsibility to be thoughtful and cautious and not indirectly cause harm to others. Security vulnerabilities like this can cause actual harm, so it's understandable that people see someone fail to live up to the responsibility and they get mad.

There aren't easy solutions to having responsibility. All you can do is live up to it, which sometimes means you need to apply rigor and processes that make hacking less fun, or that you need to make compromises you don't like.

"to think other projects couldn't have issues is just naive" is the wrong way to look at it. You should evaluate the processes that lead to the binary (or source tarball) that you're running on your machine. Is every commit/PR being reviewed by someone other than the author? By multiple someones, ideally? Do they run automated test suites before shipping?

rswail6• 2 years ago

I can tell you that the commercial software that you use is unlikely to be living up to the unachievable standards that are being demanded in this thread.

In this case, the person is a solo developer, so who exactly should be reviewing the PRs?

I trust this developer because they have a long history of delivering quality software, with quick turnaround on bugs in general, and even faster on security related bugs like this one.

His "responsibility" is to maintain the trust that he will develop to the best of his ability and will react quickly to issues.

The so-called "rigor and processes" in current SW engineering are nonsense and busy work. Not once in my 40 years of SW development has a code review revealed a major bug that wasn't some sort of developer brain fart.

Maybe the actual security issue here is that a) /tmp is world read/writeable on many Unix/Linux VMs/machines, and b) you should lock down your SSH connections so that they don't have access to it.

Stop blaming the other person's software and look at your own security "rigor and processes".

watermelon0• 2 years ago

when you build this kind of software you have a certain responsibility to be thoughtful and cautious and not indirectly cause harm to others

I think the only responsibility maintainers of an open source project have is to not intentionally cause harm, and even that might not be absolute (e.g. would it really be that wrong for maintainer(s) to remove a package/source code, if they so decide, like with the left-pad debacle).

Is every commit/PR being reviewed by someone other than the author? By multiple someones, ideally?

There is a good chance that they would welcome additional maintainers, so you can try volunteering to do that.

soheil6• 2 years ago

How are you the arbiter of what responsibilities the developer of one the the most incredible open source projects should have when you're happy collecting your Microsoft and Google paychecks literally spreading cancer on the internet in the form of AMP pages and straight-up closed-source trash?

mardifoufs• 2 years ago

I agree that this isn't really something I'd switch over on its own, but what entitlement are you talking about? How is discussing not using an app or switching to something else... entitlement? I reread the whole thread and I couldn't find anything that felt like entitlement tbh...

freehorse3• 2 years ago

I think it is fair to realise that the risks that come with using a third party terminal emulator do not outweight the pros of having some of its features for your usecase. But a lot of comments here are outright aggressive for no real reason.

trymas• 2 years ago

Firstly, iterm2 is open source software (free as in beer and as in speech) and comes with no warranties.

Secondly, solo developer of iterm has excellent reputation from my point of view. History of his work on this project is something to strive for any developer and seems that always acts in (very) good faith while releasing software and replying to issues in threads.

https://news.ycombinator.com/item?id=42582206 - entitled for what features should exist or not in open source software. Also that feature was opt-in as far as I am aware. (EDIT: this user is also new and commented only on this post, with karma in the negative)

https://news.ycombinator.com/item?id=42581350 - entitled to how solo FOSS developer should act and write a critical update release response, with hints that said developer may not act in good faith.

https://news.ycombinator.com/item?id=42579595 - again entitled to what (or how many) features FOSS application should or shouldn’t have. Ironically also complains with entitled attitude that another FOSS software doesn’t have enough feature development.

There’s more, but obviously it’s subjective to reader’s interpretation. There were couple comments with attitude - that the developer shouldn’t be allowed to touch software ever again, but either I have missed them or they have deleted their comments.

soheil6• 2 years ago

Nailed it - entitled captures it accurately.

I've been on HN since 2011 and it has never been this hostile, unhelpful and flat out arrogant.

rswail6• 2 years ago

I've used iTerm2 for as long as I've known about it, which would be maybe 10 years?

I don't use much of the various SSH/mux features, 'cos I don't use multiple buffers, just multiple tabs.

I like the scrollback and the footer and the integration with the shell, don;t care about scrolling speed very much, and it's sort of the "ain't broke, so why change".

I'll take a look at ghostty, but not sure it gives me much.

As for this security issue, it's a bug, the author found it, fixed it, announced what it was, and how to ameliorate the effects of the issue.

He did that in a very reasonable timeframe and has been entirely open about it.

The pile-on of moralists and what appear to be purists (and possibly early stage devs if they think process is the answer) is sorta pathetic.

This entire thread is more twitter/reddit than what I've come to expect on HN.

rswail6• 2 years ago

This thread reminded me to make my annual donation to iTerm2's developer, who does a pretty amazing job keeping iTerm MacOS compliant and up to date.

nose-wuzzy-pad• 2 years ago

This thread reminded me to make a donation as well!

_0xdd• 2 years ago

Just did the same. I've used this app for years and benefitted from its features. It's a shame to see some of the comments in this thread.

mdaniel• 2 years ago

If one is already in the GitHub sponsors ecosystem, he accepts those too https://github.com/sponsors/gnachman

soheil6• 2 years ago

I would advice anyone using iTerm not to willy-nilly switch their terminal to one recommended by a random user here.

Terminals can have a huge attack surface and many "open-source" ones are maintained by less than trustworthy developers who very easily could inject a backdoor.

Sticking with time-proven projects like iTerm provides the advantage of added trust, security and basic common sense.

It also seems like a huge coincidence that there are a lot of green accounts here "highly" recommending all sorts of random terminal alternatives.

lionkor2• 2 years ago

Not sure what the replies here are on about. This is NOT a "whoopsie, can happen to any project" bug. There was code in the project that EXPLICITLY leaked stuff into the remote host. Am I missing something?

Not only would switching to a different project with more eyes on it probably never do this, it would also probably never let that through PR reviews.

thih92• 2 years ago

Are you offering to review PRs of a different project? That’s actually very beneficial. Which project are you planning to support like this?

lionkor2• 2 years ago

Not sure what to make of this snarky ass reply, I do plenty of open source work, not sure why that would be warranted as a reply.

Just because I like open source, doesnt mean I need to do literally all the work.

cdeevgtg2• 2 years ago

Only when verbose logging is enabled, which seems fine to me

What's not fine is verbose logging being turned on by default, most likely by mistake

muppetman2• 2 years ago

I thought we were all losing our mind over Ghostty anyway and iterm2 wasn't cool anymore because it's, apparently, slow?

egorfine• 2 years ago

iTerm2 is the app I spend the most time for like a decade or so.

I feel bad for the developer. This is embarrassing and it totally could and probably will at some point happen to the best of us.

So I have immediately donated and subscribed to monthly donations and I encourage everyone to do so. There should be zero doubt that the author deserves our support.

iTerm2 critical security release

Related Stories