4 ms·
Let me quote the original issue report on Github: > What happened: iTerm sent various things (including passwords) in plain text to my ISP's DNS server iTerm
by jakobegger 9y ago
Let me quote the original issue report on Github:
> What happened: iTerm sent various things (including passwords) in plain text to my ISP's DNS server
iTerm was accidentally transmitting passwords in plain text via the network.
I'm pretty sure transmitting passwords in plain text isn't "working as intended".
Sure, you can go blame the user for not knowing that iTerm makes DNS queries when you hold down the command key.
But if you want to make secure software, you can't just tell the user it's their fault. You need to make sure that accidentally disclosing private information is not something that easily happens.
- burnte 9y agoYou're purposefully putting intent on software. It didn't send passwords, it sent strings that looked like a domain to a regex. It did not send a message to a DNS server "Hey DNS server, this is a password!" The user happened to want to use that string for a password.
- jakobegger 9y agoOK, you win. I can’t follow your arguments anymore. I must be too young and unexperienced.