Comment by dust42

IMO Konsole does it right, it's a feature that's disabled by default, and there is an explicit warning next to the option to turn it on that says:

    WARNING: This has security implications as it allows malicious URLs
    to be shown as another URL or hidden.
    Make sure you understand the implications before turning this on.

Then it has an option for you to enter the link schemes you want to enable, like https://, file://, etc

Disaster is perhaps an exaggeration, but it does seem like this would be another environment, where users need to be aware of a different set of safety and usability measures than in the browser. Surely we will see interesting attempts at exploiting it.

Overall, I think the idea is super interesting, especially the ability to encode in the future other context than URLs with it. Whether actually useful, or just gimmicky, remains to be seen.

Seems like terminals should highlight in red and not link mismatches.

Alacritty shows me that it's http://evil.com when I hover over it.

Isn't this like any other hyperlink?

    <a href="http://evil.com">https://good.com</a>

Terminals should show a tooltip with the actual URL just like browsers do.

fwiw, in kitty you can configure it [1] to confirm opening a link:

    allow_hyperlinks ask

[1]

Most terminals already trust clipboard access and window titles in ways that can be abused, no scripting engine required. Embedding a web engine would just make the threat model explicit instead of the current half-baked mix of text UI plus unsanitized metadata channels. If your workflow includes pasting from a terminal or clicking strange links you've already lost unless your threat tolerance is set near zero. It's a decent reminder that the stuff we treat as just text keeps accumulating side channels faster than most users can keep up.

Yeeeeah, I made it as far as...

> It was, however, not possible until now for arbitrary text to point to URLs, just as on webpages

before saying "oh... no.... I hate this. Please don't."

I hate this too, but I would distinguish between the terminal and the shell. For most of us on Linux or OSX, they might as well be one and the same, but formally speaking, they are still separate. There are many places where VT terms are deployed -- especially in embedded -- where there is no shell, and thus no security issue.

What are you running in your terminal to be vulnerable to that threat model?