Comment by adrian_b
16 hours ago
I believe that the default behavior should be to never open a link without a confirmation from the user that this may be done.
This should be enough to avoid malicious links. I do not believe that completely disabling links is a good default, because they are very frequently useful when you read some text file in the terminal window.
Yes, I agree. Ghostty et al don't open-on-click, but on hover they'll show you the URL and there's a keyboard shortcut + click to open. This is much better UX than disabling OSC8.
Yeah, because more complexity where you don't expect it doesn't cost anything?
Up until 5 hours ago this fix was not present:
> The displayed target is sanitized so invisible and line-breaking characters cannot conceal the effective destination.
https://github.com/ghostty-org/ghostty/security/advisories/G...
The sensible default is to have it turned off. And by the looks of it Ghostty versions before this you couldn't even turn it off.
"One implementation of a feature had a bug, therefore this feature should be turned off on all implementations by default" is probably not going to convince people who think the feature is good.
If you don't want to be able to have clickable hyperlinks, by all means use Konsole — no one is forcing you to use Ghostty. But if you want to know why people like Ghostty's approach vs Konsole's, it's because Ghostty pushes terminal emulator features forward and is low latency. Konsole is low latency and adopts some but not all features that other people invent. It's a noticeable difference and so people who like the feature part of the former like Ghostty/WezTerm/Kitty more than Konsole. If you don't care or dislike that part, and want a more conservative terminal (that is also low latency), Konsole and many others further on the conservative spectrum exist.
2 replies →
I don’t want random text in my terminal to be a link. I do not find that useful.
If people want it enabled, they can enable it. It shouldn’t be the default.
Surely you realize most people would disagree?
Most? Probably not
Someone? Almost certainly
Congratulations, don’t use Ghostty or terminals built on top of libghostty and you don’t have to!
I don’t. But the problem with OSC8 is it opens up whole new vectors for security vulnerabilities in an application that is, by intent, used for some of the most security sensitive work in our jobs.
I wouldn’t mind OSC8 so much if it had proper security auditing but it doesn’t. The whole thing was pushed by one guy on a GitHub gist who blocked anyone who dared discuss security issues.
At least with browsers, you have masses of people testing these things. But there’s no rigour to any of the tests that happen with terminal emulation. Let alone independent security audits.
And at this rate, it’ll only be a matter of time until we see “don’t cat untrusted READMEs” advice because they might contain boobytrapped escape codes. Which is an absurdly bad place to end up.
1 reply →