Comment by tjoff
15 hours ago
Yeah, because more complexity where you don't expect it doesn't cost anything?
Up until 5 hours ago this fix was not present:
> The displayed target is sanitized so invisible and line-breaking characters cannot conceal the effective destination.
https://github.com/ghostty-org/ghostty/security/advisories/G...
The sensible default is to have it turned off. And by the looks of it Ghostty versions before this you couldn't even turn it off.
"One implementation of a feature had a bug, therefore this feature should be turned off on all implementations by default" is probably not going to convince people who think the feature is good.
If you don't want to be able to have clickable hyperlinks, by all means use Konsole — no one is forcing you to use Ghostty. But if you want to know why people like Ghostty's approach vs Konsole's, it's because Ghostty pushes terminal emulator features forward and is low latency. Konsole is low latency and adopts some but not all features that other people invent. It's a noticeable difference and so people who like the feature part of the former like Ghostty/WezTerm/Kitty more than Konsole. If you don't care or dislike that part, and want a more conservative terminal (that is also low latency), Konsole and many others further on the conservative spectrum exist.
It’s not just one implementation. Browsers have been struggling to get this right for decades and now we are destined to repeat all the same problems all over again with an entirely new syntax of inlined markup.
Bugs are fine, but this wasn't really a bug. It was lack of foresight.
I haven't used Konsole, but I do like this "recent" focus on terminals and have used many of the newer ones. Dailydrived st,alacritty,wezterm,ghostty,kitty,foot (probably forgot some) and I live for the regex pattern matching copy shortcuts etc.
I learned about OSC8 because my terminal (whichever it was) used one of its features and I didn't know it was possible to do that. My immediate thought was, how is the security?
And it is very disappointing to see how little effort people have spent on that. That is really one part that I expect more from modern incarnations of the old terminals where I can sort of forgive them for the lack of security posture.
I like ghostty, I really do. But this is not a good look, and to be clear it isn't just ghostty. Without looking for it I've stumbled upon several OSC8 and OSC52 bugs (in other software) recently.