5 ms·

Hyperlinks in terminal emulators

106 points by nvahalik 7mo ago

kristopolous 7mo ago
tl;dr here's coming from markdown LINK = ["\033]8;;", "\033]8;;\033\\"] re.sub(r"\[([^\]]+)\]\(([^\)]+)\)", process_links, line) def process_links(match): description = match.group(1) url = match.group(2) return f'{LINK[0]}{url}\033\\{UNDERLINE[0]}{description}{UNDERLINE[1]}{LINK[1]}'
tombert 7mo ago
On my second day when I worked at Reddit, I learned by accident that I do not want my terminal to have clickable links. I was working on image compression, and we had a script where we would render a column with the original image link, and a column with the new compressed image, and a column with the relative percentage of size to PNG, and there would be like 200 rows at a time. I managed to somehow accidentally click on a link in iTerm, my browser opened, and I discovered what "sounding" [1] is, on a company computer, in the company office. I saw it, whispered "oh fuck!", and quickly killed my browser. I don't think anyone saw me but I was extremely worried that I was going to get fired on my second day of work for viewing porn on a company computer in front of everyone, even though it was a legitimate accident. So now I don't want my links to be clickable. If there's a link I'll highlight it and paste it into Firefox manually. [1] If you do not know what sounding is, I do not recommend you look it up, just know that it's a weird sex thing that I wish I didn't know about and cannot unsee.
- deleted 7mo ago
  [deleted]
- deleted 7mo ago
  [deleted]
- derefr 7mo ago
  In every implementation I've seen, the link only becomes clickable if you hold down a modifier key. By default, the links are just text. Which should make intuitive sense, because otherwise it'd be breaking existing semantics, as it would e.g. make it impossible to highlight the underlying text to copy-and-paste. (Or to send a click event to the underlying PTY-controlling process-group leader when mouse reporting is active.) I presume your "somehow" happened to involve you holding whatever modifier key your terminal emulator required. Also, sounding isn't a weird sex thing per se; it's a mundane (and somewhat painful) medical procedure. One that some people happen to coincidentally have a kink for, mostly due to the discomfort involved. But "some weird people having a kink for medical procedure X" is true of many/most medical procedures.
  - tombert 7mo ago
    It was iTerm, and yeah I it did require a modifier key. I had gotten it in my head that the way that you highlight a line in iTerm (and I have no idea where I heard this or why I thought it) was holding command and clicking on the line. It was a mistake I made exactly once. I am afraid I didn't investigate sounding after I saw the horrifying image; I only learned the name for it after I described the image to someone and they told me what it was; I guess I assumed it was just a weird sex thing, I didn't realize that there was any practical medicine stuff to it.
  - knodi123 7mo ago
    > the link only becomes clickable if you hold down a modifier key. Fun trick not a lot of people know - In a web browser, links which are normally clickable become UN-clickable if you hold a modifier. On a mac, it's (option). It's helpful if you want to select text inside a large link (or in a button) so you can copy it.
    - sheept 7mo ago
      This might be operating system/browser-specific. On Windows Chrome, shift-click opens in new window, ctrl in new tab, and alt downloads the link.
    - dbdr 7mo ago
      Thanks, I did not know! On Firefox/Linux, it's Alt and dragging the mouse through the part of the text you want.
- westurner 7mo ago
  You probably could have just loudly explained to your reddit coworkers
dust42 7mo ago
I really think this is a security disaster waiting to happen, landing right in time for all the agentic terminal apps: printf '\e]8;;http://evil.com\e\\https://good.com\e]8;;\e\\\n' The next step would be to embedd a full javascript VM in the terminal and a CSS engine.
- poly2it 7mo ago
  What are you running in your terminal to be vulnerable to that threat model?
  - taneliv 7mo ago
    Trivially, `less` to see README.md of a malicious/compromised open source project. There are perhaps more plausible avenues of exploiting, but this one popped to mind immediately.
    - charcircuit 7mo ago
      Opening a URL should always be safe. It's a security bug if it isn't.
      - bigstrat2003 7mo ago
        And yet, it isn't always safe. Yes, that should be fixed, but defense in depth exists for a reason.
      - hnlmorg 7mo ago
        Yet such security bugs exist in their multitude. Plenty of internal-only systems are not locked down securely and only thing preventing mass exploitation is browsers CORS settings. But if request is originating from inside the network (as it would from a terminal emulator), then all bets are off. Granted, on its own, this should be safe. But attacks are usually composed from multiple bugs and/or weaknesses in design. Hence why security folk keep talking about “defence in depth” — ie not to rely on the security of any single facet but instead layering your security just in case any one particular layer does prove to be insufficient. This is why in my own terminal emulator I implemented hyperlinks via user defined RegEx. The terminal user gets to decide what text becomes click-actionable rather than the attacker. I actually voiced some concerns with this original hyperlink proposal several years back. In fact lots of developers and security researchers did. And the gist authors response was to delete the replies and turn off comments. Which adds additional concern about this proposal. It follows no process, no feedback, nothing. Just one persons mission to dictate how everyone else’s terminal, and security model, should operate.
oldestofsports 7mo ago
Browsers are great at hyperlinks, like really great. How about using browsers for hyperlinks instead?
- charcircuit 7mo ago
  Opening links is an operating system feature that any program can use and pass a link to.
  - hnlmorg 7mo ago
    Yeah, but it’s only browsers that render hyperlinks from untrusted sources…unless you’re saying you often download random executables and then click their hyperlinks?
    - charcircuit 7mo ago
      For http / https links the OS would open the browser for it. For other protocol browsers would not understand it.
      - pibaker 7mo ago
        This is not true. Browsers can and do delegate handling non HTTP URLs to the OS just like any other software. The most common ones are mailto URLs which usually launches your system's email client. And if you click on a tel URL on your phone it usually asks if you want to call the number linked to.
- ernesth 7mo ago
  You never opened a README.md that contained links in something else than a browser?
  - oldestofsports 7mo ago
    That's for the editor to handle, not the terminal.
olejorgenb 7mo ago
I think CLI code agents (eg. Claude Code) should render the line numbers in their diff view as links, opening that line in your editor of choice. You can also make your own scheme-handler easily (on Linux at least). I have a `niri://` handler enabling linking to a specific Wayland window. (it has niche usecases :D) This guy build a pty "proxy" to linkify Claude Code output: https://www.youtube.com/watch?v=GP5TwKnCzhQ https://www.youtube.com/watch?v=GP5TwKnCzhQ
- darkwater 7mo ago
  > I think CLI code agents (eg. Claude Code) should render the line numbers in their diff view as links, opening that line in your editor of choice. CC already does this with PR/MR/etc links for example (i.e. #123 is clickable and brings you to issue 123 in the repo it's working on)
  - olejorgenb 7mo ago
    Yes, they do it with the paths inside the `Edit(path/to/file)` tool calls as well. But I have not seen any links using the capability to link to line numbers. https://github.com/anthropics/claude-code/issues/13008 https://github.com/anthropics/claude-code/issues/13008
VorpalWay 7mo ago
I have found this really useful together with file:// links. If properly set up, you can use this to go to a specific file, line and column in your IDE/editor even. Very useful with custom lint and debug tooling that I have written for my dayjob.
diath 7mo ago
I love these and wish they were used more by command line applications. For instance in GCC, when your terminal supports them, compiler diagnostic flags are clickable and something like "warning: address of local variable ‘a’ returned [-Wreturn-local-addr]" can be clicked to open the GCC documentation for that flag.
- piekvorst 7mo ago
  This is a basic copy-paste and search function. I admit that your approach is fast but counter that it highlights a failure to make basic functions like copy-paste and search efficient and introduces a whole class of complexity into software design. Edit: the same applies to diffs generated by /bin/diff. Most of the time, diff strings are unique enough to locate them by plain text searching.
piekvorst 7mo ago
So, the approach is identical to <a href="example.com">example</a>. In contrast, in Plumber [1], we have things like !98—this text opens pull request no. 98 by passing "!98" to the local server, which knows how to interpret it. Both approaches go one step beyond plain text. However, Plumber’s approach, at least, doesn’t compromise the plain text itself by embedding invisible elements. This eliminates an entire category of risks by design. With no hidden metadata, accidental clicks are less probable and social engineering attacks, such as UI deception, are impossible. [1]: https://p9f.org/sys/doc/plumb.html https://p9f.org/sys/doc/plumb.html
- quesera 7mo ago
  What is the reference to Plan9 here? !x has been a shell history expansion since at least csh (1978?).
_flux 7mo ago
I've found it nice to have the terminal emulator be able to match text with regexp and upon a click convert it to an external action. For example, I can click Python traceback in terminal and have Emacs go into that exact line in code, or the JIRA issue id and go to the web page. I wonder though if this is a popular feature. Tilix is under minimal maintenance at the moment, so alternatives would be good to have..
- piekvorst 7mo ago
  Not sure about popularity but Plan 9 has had this for decades, thanks to Plumber [1]. [1]: https://p9f.org/sys/doc/plumb.html https://p9f.org/sys/doc/plumb.html
- scoops_ 7mo ago
  Regarding the jira link example, are you using hyperbole buttons for this, or some other way? I’d like to do it without using hyperbole, it’s a nice package and all but the ‘buttons’ are the only (of the many) feature(s) I would use from it
  - skydhash 7mo ago
    If you're in emacs, you can use `bug-reference-mode` https://www.gnu.org/software//emacs/manual/html_node/emacs/Bug-Reference.html https://www.gnu.org/software//emacs/manual/html_node/emacs/B... As for the python backtrace, what you need is to set `compilation-error-regexp-alist` and use `compilation-minor-mode`. https://www.gnu.org/software//emacs/manual/html_node/emacs/Compilation-Mode.html https://www.gnu.org/software//emacs/manual/html_node/emacs/C...
    - scoops_ 7mo ago
      Wow, thank you, that’ll work perfectly! Of course bug reference mode is built-in, I had no clue (I need to stop being surprised by emacs’ built-in functionalities)
spreadem 7mo ago
The archived comments are an interesting read. Here is the snapshot just before the page owner removed them: https://web.archive.org/web/20250324071822/https://gist.github.com/egmontkob/eb114294efbcd5adb1944c9f3cb5feda https://web.archive.org/web/20250324071822/https://gist.gith...
rrr_oh_man 7mo ago
Yeah.. I was thinking of whether adding link parsing to itter [0], but decided against it. Somehow it didn't feel right. [0] https://news.ycombinator.com/item?id=43936884 https://news.ycombinator.com/item?id=43936884
krautburglar 7mo ago
This is barbarianism. This is Babel. Too many dunces trying to turn VT220 into Google Chrome. The long-term effect: the ruination of terminals. You can already see it. Try to run newer terminal apps on classic hardware terminals. Most of the time, you just get garbage, since nobody seems to bother to even check termcap anymore. They just directly shit out whatever bleeding-edge escapes that vte/iterm2/ghostty or other barbarianisms support as of the last five minutes. If you want something half-way between VT220 and Google Chrome, please be original and make something new, rather than wiping your butt on a standard that is still somewhat functioning.
- piekvorst 7mo ago
  Isn't VT220 meant to be extensible? Just the hardware stopped at a certain point.
  - krautburglar 7mo ago
    That's the point. The hardware stopped at a certain point, which has gifted us with a de-facto standard. I would prefer if our "woo look at me" attention-whore graffiti artists would actually create something positive and original instead of riding someone else's gift into oblivion for attention.
deleted 7mo ago
[deleted]
ladax72707 7mo ago
> Mom, we can get Plumber[1]? > We have Plumber at home. > [Plumber at home]... [1]: http://p9f.org/sys/doc/plumb.html http://p9f.org/sys/doc/plumb.html
alpaca128 7mo ago
> This feature doesn't introduce anything that's not already present while browsing the web. Therefore we believe this feature doesn't have security aspects to worry about. Am I reading it wrong or is this seriously saying "this is secure because it's like web browsing"?
stuaxo 7mo ago
This is good and we need more of this sort of thing. I don't want things to be silo'd just because I run them in the GUI Vs the terminal.

106 points by nvahalik 7mo ago

tl;dr here's coming from markdown LINK = ["\033]8;;", "\033]8;;\033\\"] re.sub(r"\[([^\]]+)\]\(([^\)]+)\)", process_links, line) def process_links(match): description = match.group(1) url = match.group(2) return f'{LINK[0]}{url}\033\\{UNDERLINE[0]}{description}{UNDERLINE[1]}{LINK[1]}'

tombert 7mo ago

On my second day when I worked at Reddit, I learned by accident that I do not want my terminal to have clickable links. I was working on image compression, and we had a script where we would render a column with the original image link, and a column with the new compressed image, and a column with the relative percentage of size to PNG, and there would be like 200 rows at a time. I managed to somehow accidentally click on a link in iTerm, my browser opened, and I discovered what "sounding" [1] is, on a company computer, in the company office. I saw it, whispered "oh fuck!", and quickly killed my browser. I don't think anyone saw me but I was extremely worried that I was going to get fired on my second day of work for viewing porn on a company computer in front of everyone, even though it was a legitimate accident. So now I don't want my links to be clickable. If there's a link I'll highlight it and paste it into Firefox manually. [1] If you do not know what sounding is, I do not recommend you look it up, just know that it's a weird sex thing that I wish I didn't know about and cannot unsee.

deleted 7mo ago
[deleted]
deleted 7mo ago
[deleted]
derefr 7mo ago
In every implementation I've seen, the link only becomes clickable if you hold down a modifier key. By default, the links are just text. Which should make intuitive sense, because otherwise it'd be breaking existing semantics, as it would e.g. make it impossible to highlight the underlying text to copy-and-paste. (Or to send a click event to the underlying PTY-controlling process-group leader when mouse reporting is active.) I presume your "somehow" happened to involve you holding whatever modifier key your terminal emulator required. Also, sounding isn't a weird sex thing per se; it's a mundane (and somewhat painful) medical procedure. One that some people happen to coincidentally have a kink for, mostly due to the discomfort involved. But "some weird people having a kink for medical procedure X" is true of many/most medical procedures.
- tombert 7mo ago
  It was iTerm, and yeah I it did require a modifier key. I had gotten it in my head that the way that you highlight a line in iTerm (and I have no idea where I heard this or why I thought it) was holding command and clicking on the line. It was a mistake I made exactly once. I am afraid I didn't investigate sounding after I saw the horrifying image; I only learned the name for it after I described the image to someone and they told me what it was; I guess I assumed it was just a weird sex thing, I didn't realize that there was any practical medicine stuff to it.
- knodi123 7mo ago
  > the link only becomes clickable if you hold down a modifier key. Fun trick not a lot of people know - In a web browser, links which are normally clickable become UN-clickable if you hold a modifier. On a mac, it's (option). It's helpful if you want to select text inside a large link (or in a button) so you can copy it.
  - sheept 7mo ago
    This might be operating system/browser-specific. On Windows Chrome, shift-click opens in new window, ctrl in new tab, and alt downloads the link.
  - dbdr 7mo ago
    Thanks, I did not know! On Firefox/Linux, it's Alt and dragging the mouse through the part of the text you want.
westurner 7mo ago
You probably could have just loudly explained to your reddit coworkers

dust42 7mo ago

I really think this is a security disaster waiting to happen, landing right in time for all the agentic terminal apps: printf '\e]8;;http://evil.com\e\\https://good.com\e]8;;\e\\\n' The next step would be to embedd a full javascript VM in the terminal and a CSS engine.

poly2it 7mo ago
What are you running in your terminal to be vulnerable to that threat model?
- taneliv 7mo ago
  Trivially, `less` to see README.md of a malicious/compromised open source project. There are perhaps more plausible avenues of exploiting, but this one popped to mind immediately.
  - charcircuit 7mo ago
    Opening a URL should always be safe. It's a security bug if it isn't.
    - bigstrat2003 7mo ago
      And yet, it isn't always safe. Yes, that should be fixed, but defense in depth exists for a reason.
    - hnlmorg 7mo ago
      Yet such security bugs exist in their multitude. Plenty of internal-only systems are not locked down securely and only thing preventing mass exploitation is browsers CORS settings. But if request is originating from inside the network (as it would from a terminal emulator), then all bets are off. Granted, on its own, this should be safe. But attacks are usually composed from multiple bugs and/or weaknesses in design. Hence why security folk keep talking about “defence in depth” — ie not to rely on the security of any single facet but instead layering your security just in case any one particular layer does prove to be insufficient. This is why in my own terminal emulator I implemented hyperlinks via user defined RegEx. The terminal user gets to decide what text becomes click-actionable rather than the attacker. I actually voiced some concerns with this original hyperlink proposal several years back. In fact lots of developers and security researchers did. And the gist authors response was to delete the replies and turn off comments. Which adds additional concern about this proposal. It follows no process, no feedback, nothing. Just one persons mission to dictate how everyone else’s terminal, and security model, should operate.

oldestofsports 7mo ago

Browsers are great at hyperlinks, like really great. How about using browsers for hyperlinks instead?

charcircuit 7mo ago
Opening links is an operating system feature that any program can use and pass a link to.
- hnlmorg 7mo ago
  Yeah, but it’s only browsers that render hyperlinks from untrusted sources…unless you’re saying you often download random executables and then click their hyperlinks?
  - charcircuit 7mo ago
    For http / https links the OS would open the browser for it. For other protocol browsers would not understand it.
    - pibaker 7mo ago
      This is not true. Browsers can and do delegate handling non HTTP URLs to the OS just like any other software. The most common ones are mailto URLs which usually launches your system's email client. And if you click on a tel URL on your phone it usually asks if you want to call the number linked to.
ernesth 7mo ago
You never opened a README.md that contained links in something else than a browser?
- oldestofsports 7mo ago
  That's for the editor to handle, not the terminal.

olejorgenb 7mo ago

I think CLI code agents (eg. Claude Code) should render the line numbers in their diff view as links, opening that line in your editor of choice. You can also make your own scheme-handler easily (on Linux at least). I have a `niri://` handler enabling linking to a specific Wayland window. (it has niche usecases :D) This guy build a pty "proxy" to linkify Claude Code output: https://www.youtube.com/watch?v=GP5TwKnCzhQ https://www.youtube.com/watch?v=GP5TwKnCzhQ

darkwater 7mo ago
> I think CLI code agents (eg. Claude Code) should render the line numbers in their diff view as links, opening that line in your editor of choice. CC already does this with PR/MR/etc links for example (i.e. #123 is clickable and brings you to issue 123 in the repo it's working on)
- olejorgenb 7mo ago
  Yes, they do it with the paths inside the `Edit(path/to/file)` tool calls as well. But I have not seen any links using the capability to link to line numbers. https://github.com/anthropics/claude-code/issues/13008 https://github.com/anthropics/claude-code/issues/13008

VorpalWay 7mo ago

I have found this really useful together with file:// links. If properly set up, you can use this to go to a specific file, line and column in your IDE/editor even. Very useful with custom lint and debug tooling that I have written for my dayjob.

diath 7mo ago

I love these and wish they were used more by command line applications. For instance in GCC, when your terminal supports them, compiler diagnostic flags are clickable and something like "warning: address of local variable ‘a’ returned [-Wreturn-local-addr]" can be clicked to open the GCC documentation for that flag.

piekvorst 7mo ago
This is a basic copy-paste and search function. I admit that your approach is fast but counter that it highlights a failure to make basic functions like copy-paste and search efficient and introduces a whole class of complexity into software design. Edit: the same applies to diffs generated by /bin/diff. Most of the time, diff strings are unique enough to locate them by plain text searching.

piekvorst 7mo ago

So, the approach is identical to <a href="example.com">example</a>. In contrast, in Plumber [1], we have things like !98—this text opens pull request no. 98 by passing "!98" to the local server, which knows how to interpret it. Both approaches go one step beyond plain text. However, Plumber’s approach, at least, doesn’t compromise the plain text itself by embedding invisible elements. This eliminates an entire category of risks by design. With no hidden metadata, accidental clicks are less probable and social engineering attacks, such as UI deception, are impossible. [1]: https://p9f.org/sys/doc/plumb.html https://p9f.org/sys/doc/plumb.html

quesera 7mo ago
What is the reference to Plan9 here? !x has been a shell history expansion since at least csh (1978?).

_flux 7mo ago

I've found it nice to have the terminal emulator be able to match text with regexp and upon a click convert it to an external action. For example, I can click Python traceback in terminal and have Emacs go into that exact line in code, or the JIRA issue id and go to the web page. I wonder though if this is a popular feature. Tilix is under minimal maintenance at the moment, so alternatives would be good to have..

piekvorst 7mo ago
Not sure about popularity but Plan 9 has had this for decades, thanks to Plumber [1]. [1]: https://p9f.org/sys/doc/plumb.html https://p9f.org/sys/doc/plumb.html
scoops_ 7mo ago
Regarding the jira link example, are you using hyperbole buttons for this, or some other way? I’d like to do it without using hyperbole, it’s a nice package and all but the ‘buttons’ are the only (of the many) feature(s) I would use from it
- skydhash 7mo ago
  If you're in emacs, you can use `bug-reference-mode` https://www.gnu.org/software//emacs/manual/html_node/emacs/Bug-Reference.html https://www.gnu.org/software//emacs/manual/html_node/emacs/B... As for the python backtrace, what you need is to set `compilation-error-regexp-alist` and use `compilation-minor-mode`. https://www.gnu.org/software//emacs/manual/html_node/emacs/Compilation-Mode.html https://www.gnu.org/software//emacs/manual/html_node/emacs/C...
  - scoops_ 7mo ago
    Wow, thank you, that’ll work perfectly! Of course bug reference mode is built-in, I had no clue (I need to stop being surprised by emacs’ built-in functionalities)

spreadem 7mo ago

The archived comments are an interesting read. Here is the snapshot just before the page owner removed them: https://web.archive.org/web/20250324071822/https://gist.github.com/egmontkob/eb114294efbcd5adb1944c9f3cb5feda https://web.archive.org/web/20250324071822/https://gist.gith...

rrr_oh_man 7mo ago

Yeah.. I was thinking of whether adding link parsing to itter [0], but decided against it. Somehow it didn't feel right. [0] https://news.ycombinator.com/item?id=43936884 https://news.ycombinator.com/item?id=43936884

krautburglar 7mo ago

This is barbarianism. This is Babel. Too many dunces trying to turn VT220 into Google Chrome. The long-term effect: the ruination of terminals. You can already see it. Try to run newer terminal apps on classic hardware terminals. Most of the time, you just get garbage, since nobody seems to bother to even check termcap anymore. They just directly shit out whatever bleeding-edge escapes that vte/iterm2/ghostty or other barbarianisms support as of the last five minutes. If you want something half-way between VT220 and Google Chrome, please be original and make something new, rather than wiping your butt on a standard that is still somewhat functioning.

piekvorst 7mo ago
Isn't VT220 meant to be extensible? Just the hardware stopped at a certain point.
- krautburglar 7mo ago
  That's the point. The hardware stopped at a certain point, which has gifted us with a de-facto standard. I would prefer if our "woo look at me" attention-whore graffiti artists would actually create something positive and original instead of riding someone else's gift into oblivion for attention.

deleted 7mo ago

[deleted]

ladax72707 7mo ago

> Mom, we can get Plumber[1]? > We have Plumber at home. > [Plumber at home]... [1]: http://p9f.org/sys/doc/plumb.html http://p9f.org/sys/doc/plumb.html

alpaca128 7mo ago

> This feature doesn't introduce anything that's not already present while browsing the web. Therefore we believe this feature doesn't have security aspects to worry about. Am I reading it wrong or is this seriously saying "this is secure because it's like web browsing"?

stuaxo 7mo ago

This is good and we need more of this sort of thing. I don't want things to be silo'd just because I run them in the GUI Vs the terminal.