Hacker News Reader

Comment by mattpavelle | Hacker News Reader

> A bug in the SSH integration feature caused input and output to be logged to a file on the remote host. This file, /tmp/framer.txt, may be readable by other users on the remote host.

Oof. This is nasty. Some folks may not have access to some machines that they've SSH'd into anymore where files like this may or may not exist.

View on HN

This seems relevant:

When does this occur? --------------------- The issue occurs if both of the following conditions are true:

1. Either: a) You used the it2ssh command, or b) In Settings > Profiles > General, the Command popup menu was set to "SSH" (not "Login Shell", "Command", or "Custom Command") AND "SSH Integration" was checked in the SSH configuration dialog. That dialog is shown when you click the Configure button next to the ssh arguments field in Settings.

2. The remote host has Python 3.7 or later installed in its default search path.

Yeah #1 reduces the surface area for sure, #2 maybe not so much :)

1B looks like a common situation

It seems incredibly uncommon to set your terminal emulator to run SSH rather than starting a shell.

It is not very common.

#1 greatly reduces the surface area, and #2 doesn't _increase_ the surface attack limited by #1, in case people are reading this incorrectly.

I have Python 3.7 or later installed on my default search path, but after checking none of my servers have a `/tmp/framer.txt` file.

you need both #1 and #2 to be true.

Long live EL8

This bug almost never occurs as it's a very esoteric feature that 99% of people here never heard or used. If you're, however, the type of user who decides not to use `bash` or `zsh` and instead wants `ssh` as their default terminal command there are probably other unusual features that you use in other apps exposing you to many other attack surfaces that you also need to worry about beyond just iTerm.

Reply on news.ycombinator.com