3 ms·
You forget that tmux is a terminal emulator. Trusted programs can have untrusted/attacker-controlled terminal output. If the program running inside tmux (e.g. c
by remram 1y ago
You forget that tmux is a terminal emulator. Trusted programs can have untrusted/attacker-controlled terminal output. If the program running inside tmux (e.g. cat, curl -s, weechat) can output malformed unicode or escape commands that trigger crashes or code execution, it is actually a huge problem.
- hnlmorg 1y ago> You forget that tmux is a terminal emulator. No I don’t forget that. > can output malformed unicode or escape commands that trigger crashes or code execution, it is actually a huge problem. I agree. And to go back to an earlier point, when was the last time you experienced tmux crash? Because I’ve been using it 15 years and yet to see that happen to me. I get the need to protect against theoretical attacks, but what you’re advocating is throwing the baby out with the bathwater.
- remram 1y agoI don't use tmux. CVE-2020-27347 is exactly the kind of memory safety bug exploitable by terminal output that I was talking about.
- hnlmorg 1y agoI’m not going to deny that memory safety bugs are completely avoidable in C. However if the best example in tmux you can find is a bug that was patched promptly 5 years ago. That that’s does also say something favourable about tmux as well. As I said elsewhere, if memory safety is a major concern then there are Rust multiplexers too. But there’s plenty more lower hanging fruit to worry about before tmux.