3 ms·

It seems to me that terminals are one of those things that handles the most sensitive of details on a server. No offense to the project (which looks very nice),

It seems to me that terminals are one of those things that handles the most sensitive of details on a server. No offense to the project (which looks very nice), but shouldn't we prefer a terminal emulator that has been well audited for security issues?

jethro_tell 9y ago
Probably, are you going to start on that? It's not like someone's holding a gun to your head and telling you to use it. You can do it yourself, wait, or not use it. There's so many options for this situation. Here's the code: https://github.com/gnunn1/tilix/ https://github.com/gnunn1/tilix/ Another cool trick is to use zero trust mentality and get the secrets to the box without having to copy/paste/type/view them through your terminal emulator.
placeybordeaux 9y ago
What attack vector are you thinking of that makes a terminal emulator more vulnerable than any other piece of GUI software?
- SubiculumCode 9y ago
  idk, perhaps passwords?
  - Tom4hawk 9y ago
    So which one (from those audited) do you recommend? It's using fairly well known library (VTE), it's open source so it's not that easy to sneak something in. Situations when your terminal emulator (it's not a program facing Internet) can be compromised: 1. you have something malicious on your computer, 2. you have something malicious on you server. But imho in both situations you already have bigger problems than your terminal emulator...
    - SubiculumCode 9y ago
      You know, I am no security expert. I was posing a question. I frequently see HN comments question security of a number of applications, none of which are as critical an interface with production servers as the lowly terminal. For example, a recent replacement for ls was highlighted on HN, and there were questions of whether one would want to install use an untested application due to security concerns. In the case a terminal, it seems to be even a bigger potential issue since it is what one frequently types passwords in for sudo. I am quite surprised at the tone of comments.
gnunn 9y ago
Has any terminal emulator had a formal security audit done for it as I'm not aware of any that have. If there has let me know, would love to read the report and recommendations as I imagine some of them would be broadly applicable.

jethro_tell 9y ago

Probably, are you going to start on that? It's not like someone's holding a gun to your head and telling you to use it. You can do it yourself, wait, or not use it. There's so many options for this situation. Here's the code: https://github.com/gnunn1/tilix/ https://github.com/gnunn1/tilix/ Another cool trick is to use zero trust mentality and get the secrets to the box without having to copy/paste/type/view them through your terminal emulator.

placeybordeaux 9y ago

What attack vector are you thinking of that makes a terminal emulator more vulnerable than any other piece of GUI software?

SubiculumCode 9y ago
idk, perhaps passwords?
- Tom4hawk 9y ago
  So which one (from those audited) do you recommend? It's using fairly well known library (VTE), it's open source so it's not that easy to sneak something in. Situations when your terminal emulator (it's not a program facing Internet) can be compromised: 1. you have something malicious on your computer, 2. you have something malicious on you server. But imho in both situations you already have bigger problems than your terminal emulator...
  - SubiculumCode 9y ago
    You know, I am no security expert. I was posing a question. I frequently see HN comments question security of a number of applications, none of which are as critical an interface with production servers as the lowly terminal. For example, a recent replacement for ls was highlighted on HN, and there were questions of whether one would want to install use an untested application due to security concerns. In the case a terminal, it seems to be even a bigger potential issue since it is what one frequently types passwords in for sudo. I am quite surprised at the tone of comments.

gnunn 9y ago

Has any terminal emulator had a formal security audit done for it as I'm not aware of any that have. If there has let me know, would love to read the report and recommendations as I imagine some of them would be broadly applicable.