10 ms·

I'm confused by the comments saying "Just don't use iTerm2." The same class of issue can occur for any other project, and switching is not a very effective defe

I'm confused by the comments saying "Just don't use iTerm2." The same class of issue can occur for any other project, and switching is not a very effective defense against it. If anything, having an embarrassing issue like this is probably going to improve the iTerm2 project's security posture in the medium term. It's like that joke about firing the engineer who caused the incident, and the manager who retorts, "Why would I fire them? They just learned the hard way never to make this mistake again." (I'm paraphrasing.) I don't think that iTerm2 has had a notably high rate of critical security issues, and I suspect they won't make this class of mistake twice. (And if they do - then I will re-evaluate.) I suppose intuitively I would think that using the default MacOS Terminal app is a bit lower-risk than using iTerm2 or any other open source terminal emulator, as Terminal is a rather sparse piece of Apple-provided software with a low pace of change. But it's also closed source and impossible to audit, so there are tradeoffs there too.

zitterbewegung 2y ago
There was another issue where iTerm2 added AI functionality and then after some backlash allowed the ability to turn it off. If the additional features (which is why you would use iTerm2 in the first place) start making more and more problems it is starting to make more sense to use terminal.app or alternatives.
- ratorx 2y ago
  This is incorrect. iTerm2 never enabled any AI features by default (it always required an OpenAPI key, which the user had to provide). The backlash was for including an AI related feature in the default build at all. Following the backlash, I think they made it an optional plugin.
  - mattl 2y ago
    It should never have been anything other than an optional plugin but this doesn’t seem too harmful.
- jki275 2y ago
  Wow -- as already posted, this is absolutely false. This is not at all what happened, the iterm2 folks are way more sensitive to their users' feelings than that.
  - muppetman 2y ago
    You're right, but, as a user reading those release note for the first time, that's how it seemed. AI is being added? TO MY TERMINAL? Yes once I read it I understood it wasn't quite that bad, but the initial "Are you f*king kidding me?" feeling never left. AI. Next to my terminal. Please.
internet2000 2y ago
The built-in Terminal is a) simpler, smaller attack surface b) older c) supported by probably more than one person, in a more risk-averse org d) used by a lot more people so issues will get noticed and fixed sooner e) part of a pretty robust public beta OS program. Just don't use iTerm2.
- anon7000 2y ago
  And best of all, not as good, and not open source!
  - sixothree 2y ago
    Windows Terminal is though!
    - wkat4242 2y ago
      I really dislike that one. Not enough configurability. Unlike Apple terminal which is kinda surprising because normally Microsoft is the one with all the option settings and Apple makes the opinionated software where they decide everything and the user has to take it as it comes. But Microsoft is becoming similar unfortunately. You can see it in other software too, like them discontinuing the real Outlook and replacing it with a web one that has much fewer options, can't even be started up offline (!) and wastes more screen space. And they are moving more and more apps to electron or their own knockoff of it.
      - eigenvalue 2y ago
        Windows terminal is great. Very performant and looks really nice. I also have mobaxterm for doing work remote machines, but for local work using WSL Ubuntu it’s my preferred terminal by far.
        wkat4242 2y ago
        Oh I used it only when it first came out. I went back to PuTTY (i never use the console on windows for other stuff and I'm not allowed to use WSL at work). And at home i only have a windows box for gaming. So there was some assumption on my part sorry. But informed assumption because other stuff I work with (Teams, Outlook) have only become much worse since their release :)
mvdtnz 2y ago
Unfortunately the isn't the first very serious security oversight with iterm2. https://news.ycombinator.com/item?id=15286956 https://news.ycombinator.com/item?id=15286956
- JoBrad 2y ago
  Honestly that 7 year old thread makes me glad I use iterm2. George posted a fix in a short period of time (which he still does today), and added comments to that thread addressing the issues. Sounds like a decent person who cares about his users.
  - boomlinde 2y ago
    > George posted a fix in a short period of time No, the issue had been reported on their bug tracker twice (and closed twice) in the two years prior to their response in the thread. It took a loud enough crowd to convince them it was an issue, even though the original reports described the security implications. https://gitlab.com/gnachman/iterm2/-/issues/3688 https://gitlab.com/gnachman/iterm2/-/issues/3688 and then https://gitlab.com/gnachman/iterm2/-/issues/5303 https://gitlab.com/gnachman/iterm2/-/issues/5303 Still, > Sounds like a decent person who cares about his users. Agreed!
vlovich123 2y ago
Only if they actually communicate what they’ve learned from it and what changes they’re making to prevent such mistakes in the future / catch them before release. Until then you can assume that they’ll keep making similar classes of mistakes.
- jdwithit 2y ago
  I mean the patch notes for this issue literally do this, so they seem to be off to a good start.
  - vlovich123 2y ago
    No, all the patch notes say is “I learned from my mistake and ripped out all the logging code”. That’s not actually a postmortem of a list of process changes. Nothing about how WIP changes made it through into a code release nor in how such mistakes will be prevented in the future. There’s a much richer discussion of options in this thread of things people do to prevent things like this. For example, reading environment variables from a file that’s gitignored so that you never accidentally commit something and you don’t need to mutate code to do a config change. He may indeed have learned from his mistakes, but I’m pointing out the flaw of assuming every mistake was treated as a learning opportunity, especially when no real evidence exists to suggest that.
- soraminazuki 2y ago
  What did George ever do to you that warrants this level of contempt and condescension? Am I missing something, because there are so many activists like you having an inexplicable vendetta against iTerm2 all over this thread. This is sad because iTerm2 is one of the best terminal emulators out there. It's the first terminal emulator that popularized shell integration. Newer terminal emulators are still catching up, a decade later. tmux integration is another popular feature that's still unique to iTerm2. George has been working tirelessly on iTerm2 pretty much solo for 15 years [1]. To this day, he continuously brings new improvements to the terminal experience that keeps being copied by other terminal emulators. Developers benefit from his work, iTerm2 users and non-users alike. We should be expressing our gratitude instead of doing whatever people are doing in this thread. George found this security issue the day after New Year's day and immediately released a fix [2]. That's commitment. And while the effects of this bug can be severe, most people wouldn't have triggered the bug. > 1. Either: > a) You used the it2ssh command, or > b) In Settings > Profiles > General, the > Command popup menu was set to "SSH" (not > "Login Shell", "Command", or "Custom > Command") AND "SSH Integration" was checked > in the SSH configuration dialog. That dialog > is shown when you click the Configure button > next to the ssh arguments field in Settings. It's almost as if some people are jumping at any chance of retribution, justified or not. This all sure intensified after iTerm2 at one point introduced an AI-related feature into the default build that one can just safely forget exists by not actively enabling and engaging with it. Some in the Mastodon community even went as far as openly fantasizing about inflicting violence on the poor dev [3]. I just can't understand the morality of some of the people you see online. [1]: https://github.com/gnachman/iTerm2/graphs/contributors https://github.com/gnachman/iTerm2/graphs/contributors [2]: https://github.com/gnachman/iTerm2/commits/master/?since=2025-01-01&until=2025-01-03 https://github.com/gnachman/iTerm2/commits/master/?since=202... [3]: https://web.archive.org/web/20240613170001/https://archive.is/BDmKU https://web.archive.org/web/20240613170001/https://archive.i...
godelski 2y ago
> The same class of issue can occur for any other project This class of issues sounds like the prolific class of DON'T WRITE TO /tmp Which is why systemd has a private tmp option https://salvatoresecurity.com/the-many-perils-of-tmp/ https://salvatoresecurity.com/the-many-perils-of-tmp/ https://systemd.io/TEMPORARY_DIRECTORIES/ https://systemd.io/TEMPORARY_DIRECTORIES/
- 0xbadcafebee 2y ago
  Safely writing to /tmp/ was solved in 1986. Personally I would consider this class of bug the "idiot software developer" class (or to be more charitable: "security-illiterate software developer"). My evidence? There are (at least) six different OS primitives that will avoid this bug.
  - godelski 2y ago
    > Safely writing to /tmp/ was solved in 1986 If you RTFA you'll read (under "What is the issue?") > This file, /tmp/framer.txt, may be readable by other users on the remote host. This is EXACTLY a non-safe writing to /tmp Yes, there are safe ways to write to /tmp, as described in the systemd link I provided, but no, it is not safe to naively write to /tmp. Same issue as the "Many Perils of /tmp" link I provided. A solution that no one uses is not a solution. If you're gonna be arrogant, you better also be right.
boomlinde 2y ago
I am inclined to say that a low pace of change isn't necessarily a problem for something that at its core emulates 70s hardware. It can easily become a problem if you don't leave it at that and add everything and the kitchen sink to it. Not having used the feature I have a hard time imagining why a terminal emulator should have SSH integration to begin with.
- saagarjha 2y ago
  Hardware in the 70s was full of security issues. Designing a secure terminal emulator is actually quite difficult.
  - boomlinde 2y ago
    > Hardware in the 70s was full of security issues. It's however clearly not in the "70s hardware portion" of iTerm that this issue arises. Also not in the features we've come to expect of the most bare bones terminal emulators since, like Unicode support, scrollback buffers and font rendering, or even the somewhat gratuitous features like escape sequences for RGB colors, setting the window title or sixel rendering. This is very clearly one of the kitchen sink features, and playing the devil's advocate I should say that it reflects poorly on the kitchen sink design ethos.
- kmacdough 2y ago
  The comment puts the slow pace of change as an advantage. Pretty standard security principle. Ssh integration brings lots of other "local" iterm features based on command history, etc. to the ssh environment. If you do lots of ssh work and use a lot of relevant iterm features then it's nice. Otherwise not. Obviously, these features can be recreated with traditional tools. But these tools take time and experience to setup, and aren't naturally intuitive, despite the insistence of emacs elitists. For those who don't want to invest significant effort learning tmux, it's really nice to just check/uncheck a few boxes.
wkat4242 2y ago
I don't think Apple terminal is sparse at all. Try to dig through the preferences, there's surprisingly much choice for an opinionated software vendor like Apple. I love it, I've tried iTerm2 in the past but I just saw no reason to keep using it. The only feature that slightly appealed to me was the tmux integration but I found that i preferred to just have tmux inside the terminal instead. I know some people that use the game-like rolldown interface (quake mode?) but I also don't like/need that one. There's a few niche things like that which make it interesting. But overall I just don't see the need. If there's something that's sparse in options, it's Windows Terminal. Don't like that one at all (though it's better than the previous command prompt window).
- Kwpolska 2y ago
  Windows Terminal has a ton of options these days. Last time I used Apple's, it had very US-centric handling of Alt/Option, unlike iTerm2.
- vouaobrasil 2y ago
  > I've tried iTerm2 in the past but I just saw no reason to keep using it. One feature that's cool in iTerm2 is that you can define the left and right margins so using Vim full-screen looks nicer (I hate narrow margins). But I've switched to Sublime text for everything so I stopped using iTerm2.
- frizlab 2y ago
  I love Terminal. I tried iTerm2 but never got the appeal and switched back to Terminal.
- johncoltrane 2y ago
  I used iTerm2.app for a while, back when Terminal.app didn't support 256 colors. That was literally the only reason and I ditched it the day Terminal.app got 256c, many years ago, now.
  - joshka 2y ago
    It however doesn't have 24bit color still
sedatk 2y ago
> having an embarrassing issue like this is probably going to improve LastPass disagrees.
eptcyka 2y ago
What do you mean by saying that the same class of issue can happen to any other terminal emulator?
deleted 2y ago
[deleted]

zitterbewegung 2y ago

There was another issue where iTerm2 added AI functionality and then after some backlash allowed the ability to turn it off. If the additional features (which is why you would use iTerm2 in the first place) start making more and more problems it is starting to make more sense to use terminal.app or alternatives.

ratorx 2y ago
This is incorrect. iTerm2 never enabled any AI features by default (it always required an OpenAPI key, which the user had to provide). The backlash was for including an AI related feature in the default build at all. Following the backlash, I think they made it an optional plugin.
- mattl 2y ago
  It should never have been anything other than an optional plugin but this doesn’t seem too harmful.
jki275 2y ago
Wow -- as already posted, this is absolutely false. This is not at all what happened, the iterm2 folks are way more sensitive to their users' feelings than that.
- muppetman 2y ago
  You're right, but, as a user reading those release note for the first time, that's how it seemed. AI is being added? TO MY TERMINAL? Yes once I read it I understood it wasn't quite that bad, but the initial "Are you f*king kidding me?" feeling never left. AI. Next to my terminal. Please.

internet2000 2y ago

The built-in Terminal is a) simpler, smaller attack surface b) older c) supported by probably more than one person, in a more risk-averse org d) used by a lot more people so issues will get noticed and fixed sooner e) part of a pretty robust public beta OS program. Just don't use iTerm2.

anon7000 2y ago
And best of all, not as good, and not open source!
- sixothree 2y ago
  Windows Terminal is though!
  - wkat4242 2y ago
    I really dislike that one. Not enough configurability. Unlike Apple terminal which is kinda surprising because normally Microsoft is the one with all the option settings and Apple makes the opinionated software where they decide everything and the user has to take it as it comes. But Microsoft is becoming similar unfortunately. You can see it in other software too, like them discontinuing the real Outlook and replacing it with a web one that has much fewer options, can't even be started up offline (!) and wastes more screen space. And they are moving more and more apps to electron or their own knockoff of it.
    - eigenvalue 2y ago
      Windows terminal is great. Very performant and looks really nice. I also have mobaxterm for doing work remote machines, but for local work using WSL Ubuntu it’s my preferred terminal by far.
      - wkat4242 2y ago
        Oh I used it only when it first came out. I went back to PuTTY (i never use the console on windows for other stuff and I'm not allowed to use WSL at work). And at home i only have a windows box for gaming. So there was some assumption on my part sorry. But informed assumption because other stuff I work with (Teams, Outlook) have only become much worse since their release :)

mvdtnz 2y ago

Unfortunately the isn't the first very serious security oversight with iterm2. https://news.ycombinator.com/item?id=15286956 https://news.ycombinator.com/item?id=15286956

JoBrad 2y ago
Honestly that 7 year old thread makes me glad I use iterm2. George posted a fix in a short period of time (which he still does today), and added comments to that thread addressing the issues. Sounds like a decent person who cares about his users.
- boomlinde 2y ago
  > George posted a fix in a short period of time No, the issue had been reported on their bug tracker twice (and closed twice) in the two years prior to their response in the thread. It took a loud enough crowd to convince them it was an issue, even though the original reports described the security implications. https://gitlab.com/gnachman/iterm2/-/issues/3688 https://gitlab.com/gnachman/iterm2/-/issues/3688 and then https://gitlab.com/gnachman/iterm2/-/issues/5303 https://gitlab.com/gnachman/iterm2/-/issues/5303 Still, > Sounds like a decent person who cares about his users. Agreed!

vlovich123 2y ago

Only if they actually communicate what they’ve learned from it and what changes they’re making to prevent such mistakes in the future / catch them before release. Until then you can assume that they’ll keep making similar classes of mistakes.

jdwithit 2y ago
I mean the patch notes for this issue literally do this, so they seem to be off to a good start.
- vlovich123 2y ago
  No, all the patch notes say is “I learned from my mistake and ripped out all the logging code”. That’s not actually a postmortem of a list of process changes. Nothing about how WIP changes made it through into a code release nor in how such mistakes will be prevented in the future. There’s a much richer discussion of options in this thread of things people do to prevent things like this. For example, reading environment variables from a file that’s gitignored so that you never accidentally commit something and you don’t need to mutate code to do a config change. He may indeed have learned from his mistakes, but I’m pointing out the flaw of assuming every mistake was treated as a learning opportunity, especially when no real evidence exists to suggest that.
soraminazuki 2y ago
What did George ever do to you that warrants this level of contempt and condescension? Am I missing something, because there are so many activists like you having an inexplicable vendetta against iTerm2 all over this thread. This is sad because iTerm2 is one of the best terminal emulators out there. It's the first terminal emulator that popularized shell integration. Newer terminal emulators are still catching up, a decade later. tmux integration is another popular feature that's still unique to iTerm2. George has been working tirelessly on iTerm2 pretty much solo for 15 years [1]. To this day, he continuously brings new improvements to the terminal experience that keeps being copied by other terminal emulators. Developers benefit from his work, iTerm2 users and non-users alike. We should be expressing our gratitude instead of doing whatever people are doing in this thread. George found this security issue the day after New Year's day and immediately released a fix [2]. That's commitment. And while the effects of this bug can be severe, most people wouldn't have triggered the bug. > 1. Either: > a) You used the it2ssh command, or > b) In Settings > Profiles > General, the > Command popup menu was set to "SSH" (not > "Login Shell", "Command", or "Custom > Command") AND "SSH Integration" was checked > in the SSH configuration dialog. That dialog > is shown when you click the Configure button > next to the ssh arguments field in Settings. It's almost as if some people are jumping at any chance of retribution, justified or not. This all sure intensified after iTerm2 at one point introduced an AI-related feature into the default build that one can just safely forget exists by not actively enabling and engaging with it. Some in the Mastodon community even went as far as openly fantasizing about inflicting violence on the poor dev [3]. I just can't understand the morality of some of the people you see online. [1]: https://github.com/gnachman/iTerm2/graphs/contributors https://github.com/gnachman/iTerm2/graphs/contributors [2]: https://github.com/gnachman/iTerm2/commits/master/?since=2025-01-01&until=2025-01-03 https://github.com/gnachman/iTerm2/commits/master/?since=202... [3]: https://web.archive.org/web/20240613170001/https://archive.is/BDmKU https://web.archive.org/web/20240613170001/https://archive.i...

godelski 2y ago

> The same class of issue can occur for any other project This class of issues sounds like the prolific class of DON'T WRITE TO /tmp Which is why systemd has a private tmp option https://salvatoresecurity.com/the-many-perils-of-tmp/ https://salvatoresecurity.com/the-many-perils-of-tmp/ https://systemd.io/TEMPORARY_DIRECTORIES/ https://systemd.io/TEMPORARY_DIRECTORIES/

0xbadcafebee 2y ago
Safely writing to /tmp/ was solved in 1986. Personally I would consider this class of bug the "idiot software developer" class (or to be more charitable: "security-illiterate software developer"). My evidence? There are (at least) six different OS primitives that will avoid this bug.
- godelski 2y ago
  > Safely writing to /tmp/ was solved in 1986 If you RTFA you'll read (under "What is the issue?") > This file, /tmp/framer.txt, may be readable by other users on the remote host. This is EXACTLY a non-safe writing to /tmp Yes, there are safe ways to write to /tmp, as described in the systemd link I provided, but no, it is not safe to naively write to /tmp. Same issue as the "Many Perils of /tmp" link I provided. A solution that no one uses is not a solution. If you're gonna be arrogant, you better also be right.

boomlinde 2y ago

I am inclined to say that a low pace of change isn't necessarily a problem for something that at its core emulates 70s hardware. It can easily become a problem if you don't leave it at that and add everything and the kitchen sink to it. Not having used the feature I have a hard time imagining why a terminal emulator should have SSH integration to begin with.

saagarjha 2y ago
Hardware in the 70s was full of security issues. Designing a secure terminal emulator is actually quite difficult.
- boomlinde 2y ago
  > Hardware in the 70s was full of security issues. It's however clearly not in the "70s hardware portion" of iTerm that this issue arises. Also not in the features we've come to expect of the most bare bones terminal emulators since, like Unicode support, scrollback buffers and font rendering, or even the somewhat gratuitous features like escape sequences for RGB colors, setting the window title or sixel rendering. This is very clearly one of the kitchen sink features, and playing the devil's advocate I should say that it reflects poorly on the kitchen sink design ethos.
kmacdough 2y ago
The comment puts the slow pace of change as an advantage. Pretty standard security principle. Ssh integration brings lots of other "local" iterm features based on command history, etc. to the ssh environment. If you do lots of ssh work and use a lot of relevant iterm features then it's nice. Otherwise not. Obviously, these features can be recreated with traditional tools. But these tools take time and experience to setup, and aren't naturally intuitive, despite the insistence of emacs elitists. For those who don't want to invest significant effort learning tmux, it's really nice to just check/uncheck a few boxes.

wkat4242 2y ago

I don't think Apple terminal is sparse at all. Try to dig through the preferences, there's surprisingly much choice for an opinionated software vendor like Apple. I love it, I've tried iTerm2 in the past but I just saw no reason to keep using it. The only feature that slightly appealed to me was the tmux integration but I found that i preferred to just have tmux inside the terminal instead. I know some people that use the game-like rolldown interface (quake mode?) but I also don't like/need that one. There's a few niche things like that which make it interesting. But overall I just don't see the need. If there's something that's sparse in options, it's Windows Terminal. Don't like that one at all (though it's better than the previous command prompt window).

Kwpolska 2y ago
Windows Terminal has a ton of options these days. Last time I used Apple's, it had very US-centric handling of Alt/Option, unlike iTerm2.
vouaobrasil 2y ago
> I've tried iTerm2 in the past but I just saw no reason to keep using it. One feature that's cool in iTerm2 is that you can define the left and right margins so using Vim full-screen looks nicer (I hate narrow margins). But I've switched to Sublime text for everything so I stopped using iTerm2.
frizlab 2y ago
I love Terminal. I tried iTerm2 but never got the appeal and switched back to Terminal.
johncoltrane 2y ago
I used iTerm2.app for a while, back when Terminal.app didn't support 256 colors. That was literally the only reason and I ditched it the day Terminal.app got 256c, many years ago, now.
- joshka 2y ago
  It however doesn't have 24bit color still

sedatk 2y ago

> having an embarrassing issue like this is probably going to improve LastPass disagrees.

eptcyka 2y ago

What do you mean by saying that the same class of issue can happen to any other terminal emulator?

deleted 2y ago

[deleted]