6 ms·

Thanks for iTerm2. I've used it every day for years. I'm running 3.0.15 and it reports no updates available. On MacOS 10.9 (upgrading isn't really an option

Thanks for iTerm2. I've used it every day for years. I'm running 3.0.15 and it reports no updates available. On MacOS 10.9 (upgrading isn't really an option right now, it would break too many things). Is iTerm2 3.0.15 vulnerable? Thanks!

jlokier 7y ago
I'm puzzled by the downvote, as my question seems appropriate to me. Anyone care to provide feedback? Thanks.
- deleted 7y ago
  [deleted]
- kelnos 7y ago
  I would guess two things: 1) The linked article says the fix is available in version 3.3.6. If it had been backported to previous release series, the article would say that. 2) You are running an old version of macOS that no longer gets security updates. It's a bit weird to be worried about an unpatched vulnerability in your terminal emulator when you are running an OS that (presumably) has several unpatched vulnerabilities itself. Your focus should be on figuring out how to safely upgrade to a supported version of macOS; after you do that, you'll be able to run the latest iTerm2 and the point is moot.
- ffritz 7y ago
  Dude, you are running a version that came out 6 years ago, while macOS has a yearly release schedule. iTerm would be the least of my concerns. There is just nothing to say here other than go and upgrade it asap.
  - klmr 7y ago
    While you’re right, it’s unfortunately not that simple because macOS updates really do break a lot of stuff (especially for developers) and, on older hardware, degrade performance to the point of un-usability. I’ve got an MBP from 2012, and I’ve stopped updating macOS with Sierra (10.12) due to ever degrading performance. I’ll be forced to throw away the (perfectly functional!) laptop at some point once I stop receiving security updates.
    - dlivingston 7y ago
      > macOS updates really do break a lot of stuff (especially for developers) Weird example, as most of your users will be using a more recent version of macOS. So, while you're code isn't 'broken' for you, on your 6+ year old OS, it's broken for the vast majority of end users who will want to compile your code.
      - jlokier 7y ago
        Weird response. Probably most developers are not shipping code for end users to compile. Of those, most are probably developing websites and webapps, and the only thing about the end user that matters is which browser, not which OS, let alone version. But there are also developers writing apps that include older devices in their target. That means avoid the newest Mac tools because you can't compile for old enough targets on it. Then there are Mac app developers that include older versions of the OS in their target market, and have to use older tools to ensure the target range is covered. This gets harder over time because Apple makes it deliberately hard. Some of them even write mobile apps that target users of older devices. Shocking, I know, but there are a lot of users of older iOS devices these days, and sometimes you're tasked with making an app for them. Then there are developers whose work talks to dev hardware attached to the computer, which needs drivers, which stop being supported at some OS version. The end users get a lump of hardware, and all the developer needs is an OS that can talk to the dev kit. Then there are developers doing maintenance on older MacOS, iOS, or device firmware, and produce updates that are drop-in compatible to exactly the same set of target users as are already running the software. Not every consumer app will bother with this, but some business-critical things demand it. I think the use case of "end users who will want to compile your code" is almost negligably small in comparison, and Linux is probably a better OS for doing that sort of thing anyway :-) I've done all the above, on Mac, Windows, and Linux. VMs work great for Linux, and ok for Windows. Mac is a pain for this, because of Apple's policies to try to make it difficult.
        dlivingston 7y ago
        > most are probably developing websites and webapp And you can't port your NPM, React, etc. environment over to a new OS without breaking things? > the only thing about the end user that matters is which browser As a web dev, you want to use the latest ES/HTML/CSS specs while still targeting as many users as possible. How can you target modern users when the browsers on your 6-year old system isn't up-to-date enough to render what most users will see? > Then there are Mac app developers that include older versions of the OS in their target market, and have to use older tools to ensure the target range is covered. This gets harder over time because Apple makes it deliberately hard. This is a valid point. There are still people compiling on and for Windows XP and MS-DOS machines, after all. Hell, you can find hobbyists who only like writing Commodore 64 programs. Writing to target older platforms is hyper-niche and the computer you use to do that shouldn't be your main workstation. > Shocking, I know, but there are a lot of users of older iOS devices these days, and sometimes you're tasked with making an app for them. In which context? Given that 97% of devices are on iOS 11 or later (https://twitter.com/reneritchie/status/1159288325003460609 https://twitter.com/reneritchie/status/1159288325003460609), I can't imagine why you care about those users. > Then there are developers whose work talks to dev hardware attached to the computer, which needs drivers, which stop being supported at some OS version. The end users get a lump of hardware, and all the developer needs is an OS that can talk to the dev kit. This is a valid point. > Then there are developers doing maintenance on older MacOS, iOS, or device firmware, and produce updates that are drop-in compatible to exactly the same set of target users as are already running the software. Not every consumer app will bother with this, but some business-critical things demand it. A valid point as well - this is exactly the context in which COBOL is still used. > I think the use case of "end users who will want to compile your code" is almost negligably small in comparison, and Linux is probably a better OS for doing that sort of thing anyway :-) That's...not true. macOS developers exist, you know, and there's a reason that Macs ship with a strong tooling kit. Besides, if you distribute dynamically-linked binaries, you want an up-to-date OS so that the dylibs you're linking to actually exist... Just some thoughts from a junior dev :)
  - jlokier 7y ago
    Upgrading MacOS all the way to present would break things that I need to use daily for work, without obvious or easy solutions, so it's not as straightforward as you're making out. It can be done, but probably involves a VM to keep the old MacOS running inside.
    - ixtli 7y ago
      I've dealt with this problem my whole life and tbh it's a cost/benefit trade off. Assuming your employer isn't being flexible enough to upgrade they are simply saying that the risk of exploitation of employee machines is a lower risk than the cost of upgrading. If all parties are ok with that trade off I'd say don't worry about this iterm update and also don't do anything involving PII on that computer.
      - jlokier 7y ago
        Thanks for the advice. The principle of their risk vs their cost doesn't work in this case. Terminals vulnerabilities are a bit more serious: It means don't anything involving PII on any remote computer either, from "that computer". (If you take that seriously, that means don't access email too.) Haha, "employee machines", chuckles :-) I haven't had (or been offered) one of those in many years - except for cloud machines. Plenty of cloud machines, but I'm nearly always expected to use my own devices to access them, at my own cost. I do work with PII, for a variety of companies. About a quarter of the work I do involves direct use of PII, and another third interacts with it indirectly (such as grepping operational logs), so it has to be treated as pervasive. The non-profits I currently handle PII for do not have spare cash to buy new kit at this level, or pay for my time fiddling around. It's not so much that they don't value it. I value it after all, and I'm responsible for deciding how to handle it. So another solution will need to be found. For-profits I handle PII for (as a freelance/consultant) can of course afford machines, but it's still a problem to go cap in hand, when the expectation is that bringing an adequate terminal is my problem not theirs. Which is fine, it's just how things are done. Meanwhile, I still have physical devices that need an older MacOS for other work. And there's a problem with serious MacOS SMBFS bugs that change on each version - and have themselves caused PII issues, for real (google "delete random files once in a blue moon"). I'm not looking forward to wierdness like that all over again, and I know that later MacOS has new SMBFS bugs. So, upgrading MacOS, sadly, has known data access risks too. It's not something I should do casually, nor treat it as an unambiguous improvement from a security-of-data perspective. To a responsible person, this combination of requirements sucks. I will deal with it responsibly of course, somehow. But there's no quick and straightforward answer that meets all the requirements, and contrary to what I think some are saying, "just update" does not meet them, nor is it an unambiguous improvement.
- ixtli 7y ago
  I have to assume that people are reacting to the fact that your OS isn't supported anymore. Check the top reply to your question.
  - jlokier 7y ago
    Thanks. Well, yes, it's not supported, but I think it's still a legitimate question, not a troll or some negative remark, so I wanted to know what was objectionable. I think I can intuit the answer to that from other replies - some people think "just upgrade OS FFS" is automatically correct no matter the circumstances. Anyway, the author answered really helpfully, for which I'm grateful.
gnachman 7y ago
Sorry, I can’t provide updates for 10.9 :( 3.0.15 is vulnerable.
- jlokier 7y ago
  Thanks, I completely understand.
- rurban 7y ago
  So I'll have to backport it then by myself. No macOS upgrades for me beyond 10.15
  - rurban 7y ago
    See my github fork, with branches for the latest released 3.1.7 with Yosemite and El Capitan support, and the latest beta (3.2.0beta5). https://github.com/rurban/iTerm2 https://github.com/rurban/iTerm2
amdavidson 7y ago
Your OS hasnt received a security patch in 3 years. Your iTerm hasn't been updated in 2 years. I wouldn't worry so much about iTerm and would start working harder on those issues that are preventing you from updating.
- chooseaname 7y ago
  Not OP, but with Apple it's a trade-off between having the latest and having worse battery life and slightly less performance. Edit: I guess I touched a nerve...
  - nrki 7y ago
    It's also a trade-off between a functional computer and a brick. (I upgraded someone's MBP to Lion(?) and the graphic accelerated GUI elements of that version caused it to crash hard, often. Turns out it had a desoldered GPU for which a recall was issued, but Apple still refused to fix it.)
- jlokier 7y ago
  Upvoted by me because that is a sensible answer. However, I don't know of good answers to the issues that prevent me from updating. For most of my work, Linux is used in VMs and remotely (Linux in a VM on a Macbook uses much less power than Linux running natively, and side-swiping between Linux and Mac is really great). But I don't use the Linux GUI much. My open windows are virtually all iTerm2 or Firefox, and almost everything that isn't a GUI is on a Linux command line somewhere. So there isn't a strong imperative to update the host OS of my laptop. However, what I lose from updating is significant. There are things that can't be done with much more recent MacOS, or which work significantly differently, or where the bugs have changed so introducing risks (SMBFS random file deletion, thanks Apple!). And Apple has a very annoying habit of making it next to impossible to build things for old devices on new Macs. (Unlike, say, Linux, where you can at least cross-compile or use chroot/containers to run old build systems.) The real answer for the things I want to do is to buy a new machine and keep the old one around to support older devices that it is currently doing. But I'm in the same dilemma as other people hoping for a great new Macbook Pro (after 2015) to come on the market at a sensible price some day. Besides, they have become very expensive, and my current one still works very well. So in practice, I don't have much in the way of security risks (Firefox and Linux are updated after all), but iTerm2 is probably the only vulnerable tool I use daily on the Mac side which is exposed to data from the net. And so it made sense to ask, just in case. I completely respect the author's reply.
mister_hn 7y ago
Running 10.9 today is like running Windows Xp. You are putting yourself and your data at risk

jlokier 7y ago

I'm puzzled by the downvote, as my question seems appropriate to me. Anyone care to provide feedback? Thanks.

deleted 7y ago
[deleted]
kelnos 7y ago
I would guess two things: 1) The linked article says the fix is available in version 3.3.6. If it had been backported to previous release series, the article would say that. 2) You are running an old version of macOS that no longer gets security updates. It's a bit weird to be worried about an unpatched vulnerability in your terminal emulator when you are running an OS that (presumably) has several unpatched vulnerabilities itself. Your focus should be on figuring out how to safely upgrade to a supported version of macOS; after you do that, you'll be able to run the latest iTerm2 and the point is moot.
ffritz 7y ago
Dude, you are running a version that came out 6 years ago, while macOS has a yearly release schedule. iTerm would be the least of my concerns. There is just nothing to say here other than go and upgrade it asap.
- klmr 7y ago
  While you’re right, it’s unfortunately not that simple because macOS updates really do break a lot of stuff (especially for developers) and, on older hardware, degrade performance to the point of un-usability. I’ve got an MBP from 2012, and I’ve stopped updating macOS with Sierra (10.12) due to ever degrading performance. I’ll be forced to throw away the (perfectly functional!) laptop at some point once I stop receiving security updates.
  - dlivingston 7y ago
    > macOS updates really do break a lot of stuff (especially for developers) Weird example, as most of your users will be using a more recent version of macOS. So, while you're code isn't 'broken' for you, on your 6+ year old OS, it's broken for the vast majority of end users who will want to compile your code.
    - jlokier 7y ago
      Weird response. Probably most developers are not shipping code for end users to compile. Of those, most are probably developing websites and webapps, and the only thing about the end user that matters is which browser, not which OS, let alone version. But there are also developers writing apps that include older devices in their target. That means avoid the newest Mac tools because you can't compile for old enough targets on it. Then there are Mac app developers that include older versions of the OS in their target market, and have to use older tools to ensure the target range is covered. This gets harder over time because Apple makes it deliberately hard. Some of them even write mobile apps that target users of older devices. Shocking, I know, but there are a lot of users of older iOS devices these days, and sometimes you're tasked with making an app for them. Then there are developers whose work talks to dev hardware attached to the computer, which needs drivers, which stop being supported at some OS version. The end users get a lump of hardware, and all the developer needs is an OS that can talk to the dev kit. Then there are developers doing maintenance on older MacOS, iOS, or device firmware, and produce updates that are drop-in compatible to exactly the same set of target users as are already running the software. Not every consumer app will bother with this, but some business-critical things demand it. I think the use case of "end users who will want to compile your code" is almost negligably small in comparison, and Linux is probably a better OS for doing that sort of thing anyway :-) I've done all the above, on Mac, Windows, and Linux. VMs work great for Linux, and ok for Windows. Mac is a pain for this, because of Apple's policies to try to make it difficult.
      - dlivingston 7y ago
        > most are probably developing websites and webapp And you can't port your NPM, React, etc. environment over to a new OS without breaking things? > the only thing about the end user that matters is which browser As a web dev, you want to use the latest ES/HTML/CSS specs while still targeting as many users as possible. How can you target modern users when the browsers on your 6-year old system isn't up-to-date enough to render what most users will see? > Then there are Mac app developers that include older versions of the OS in their target market, and have to use older tools to ensure the target range is covered. This gets harder over time because Apple makes it deliberately hard. This is a valid point. There are still people compiling on and for Windows XP and MS-DOS machines, after all. Hell, you can find hobbyists who only like writing Commodore 64 programs. Writing to target older platforms is hyper-niche and the computer you use to do that shouldn't be your main workstation. > Shocking, I know, but there are a lot of users of older iOS devices these days, and sometimes you're tasked with making an app for them. In which context? Given that 97% of devices are on iOS 11 or later (https://twitter.com/reneritchie/status/1159288325003460609 https://twitter.com/reneritchie/status/1159288325003460609), I can't imagine why you care about those users. > Then there are developers whose work talks to dev hardware attached to the computer, which needs drivers, which stop being supported at some OS version. The end users get a lump of hardware, and all the developer needs is an OS that can talk to the dev kit. This is a valid point. > Then there are developers doing maintenance on older MacOS, iOS, or device firmware, and produce updates that are drop-in compatible to exactly the same set of target users as are already running the software. Not every consumer app will bother with this, but some business-critical things demand it. A valid point as well - this is exactly the context in which COBOL is still used. > I think the use case of "end users who will want to compile your code" is almost negligably small in comparison, and Linux is probably a better OS for doing that sort of thing anyway :-) That's...not true. macOS developers exist, you know, and there's a reason that Macs ship with a strong tooling kit. Besides, if you distribute dynamically-linked binaries, you want an up-to-date OS so that the dylibs you're linking to actually exist... Just some thoughts from a junior dev :)
- jlokier 7y ago
  Upgrading MacOS all the way to present would break things that I need to use daily for work, without obvious or easy solutions, so it's not as straightforward as you're making out. It can be done, but probably involves a VM to keep the old MacOS running inside.
  - ixtli 7y ago
    I've dealt with this problem my whole life and tbh it's a cost/benefit trade off. Assuming your employer isn't being flexible enough to upgrade they are simply saying that the risk of exploitation of employee machines is a lower risk than the cost of upgrading. If all parties are ok with that trade off I'd say don't worry about this iterm update and also don't do anything involving PII on that computer.
    - jlokier 7y ago
      Thanks for the advice. The principle of their risk vs their cost doesn't work in this case. Terminals vulnerabilities are a bit more serious: It means don't anything involving PII on any remote computer either, from "that computer". (If you take that seriously, that means don't access email too.) Haha, "employee machines", chuckles :-) I haven't had (or been offered) one of those in many years - except for cloud machines. Plenty of cloud machines, but I'm nearly always expected to use my own devices to access them, at my own cost. I do work with PII, for a variety of companies. About a quarter of the work I do involves direct use of PII, and another third interacts with it indirectly (such as grepping operational logs), so it has to be treated as pervasive. The non-profits I currently handle PII for do not have spare cash to buy new kit at this level, or pay for my time fiddling around. It's not so much that they don't value it. I value it after all, and I'm responsible for deciding how to handle it. So another solution will need to be found. For-profits I handle PII for (as a freelance/consultant) can of course afford machines, but it's still a problem to go cap in hand, when the expectation is that bringing an adequate terminal is my problem not theirs. Which is fine, it's just how things are done. Meanwhile, I still have physical devices that need an older MacOS for other work. And there's a problem with serious MacOS SMBFS bugs that change on each version - and have themselves caused PII issues, for real (google "delete random files once in a blue moon"). I'm not looking forward to wierdness like that all over again, and I know that later MacOS has new SMBFS bugs. So, upgrading MacOS, sadly, has known data access risks too. It's not something I should do casually, nor treat it as an unambiguous improvement from a security-of-data perspective. To a responsible person, this combination of requirements sucks. I will deal with it responsibly of course, somehow. But there's no quick and straightforward answer that meets all the requirements, and contrary to what I think some are saying, "just update" does not meet them, nor is it an unambiguous improvement.
ixtli 7y ago
I have to assume that people are reacting to the fact that your OS isn't supported anymore. Check the top reply to your question.
- jlokier 7y ago
  Thanks. Well, yes, it's not supported, but I think it's still a legitimate question, not a troll or some negative remark, so I wanted to know what was objectionable. I think I can intuit the answer to that from other replies - some people think "just upgrade OS FFS" is automatically correct no matter the circumstances. Anyway, the author answered really helpfully, for which I'm grateful.

gnachman 7y ago

Sorry, I can’t provide updates for 10.9 :( 3.0.15 is vulnerable.

jlokier 7y ago
Thanks, I completely understand.
rurban 7y ago
So I'll have to backport it then by myself. No macOS upgrades for me beyond 10.15
- rurban 7y ago
  See my github fork, with branches for the latest released 3.1.7 with Yosemite and El Capitan support, and the latest beta (3.2.0beta5). https://github.com/rurban/iTerm2 https://github.com/rurban/iTerm2

amdavidson 7y ago

Your OS hasnt received a security patch in 3 years. Your iTerm hasn't been updated in 2 years. I wouldn't worry so much about iTerm and would start working harder on those issues that are preventing you from updating.

chooseaname 7y ago
Not OP, but with Apple it's a trade-off between having the latest and having worse battery life and slightly less performance. Edit: I guess I touched a nerve...
- nrki 7y ago
  It's also a trade-off between a functional computer and a brick. (I upgraded someone's MBP to Lion(?) and the graphic accelerated GUI elements of that version caused it to crash hard, often. Turns out it had a desoldered GPU for which a recall was issued, but Apple still refused to fix it.)
jlokier 7y ago
Upvoted by me because that is a sensible answer. However, I don't know of good answers to the issues that prevent me from updating. For most of my work, Linux is used in VMs and remotely (Linux in a VM on a Macbook uses much less power than Linux running natively, and side-swiping between Linux and Mac is really great). But I don't use the Linux GUI much. My open windows are virtually all iTerm2 or Firefox, and almost everything that isn't a GUI is on a Linux command line somewhere. So there isn't a strong imperative to update the host OS of my laptop. However, what I lose from updating is significant. There are things that can't be done with much more recent MacOS, or which work significantly differently, or where the bugs have changed so introducing risks (SMBFS random file deletion, thanks Apple!). And Apple has a very annoying habit of making it next to impossible to build things for old devices on new Macs. (Unlike, say, Linux, where you can at least cross-compile or use chroot/containers to run old build systems.) The real answer for the things I want to do is to buy a new machine and keep the old one around to support older devices that it is currently doing. But I'm in the same dilemma as other people hoping for a great new Macbook Pro (after 2015) to come on the market at a sensible price some day. Besides, they have become very expensive, and my current one still works very well. So in practice, I don't have much in the way of security risks (Firefox and Linux are updated after all), but iTerm2 is probably the only vulnerable tool I use daily on the Mac side which is exposed to data from the net. And so it made sense to ask, just in case. I completely respect the author's reply.

mister_hn 7y ago

Running 10.9 today is like running Windows Xp. You are putting yourself and your data at risk