From: brian m. carlson Date: Mon, 19 Jan 2026 22:16:18 GMT Subject: Re: [PATCH v2 4/4] sideband: add options to allow more control sequences to be passed through Message-ID: In-Reply-To: On 2026-01-19 at 07:20:41, Patrick Steinhardt wrote: > I think what I strongly disagree with is that this is considered to be a > feature. I myself don't consider this to be a feature though, but rather > a security fix for a bug that can lead to arbitrary code execution on > the client-side, for example via title bar injection. I don't agree with that. Nobody still enables the functionality in a terminal that allows title bar injection. And, as I've pointed out, even connecting to an SSH remote allows exactly the same behaviour as this patch seems to try to fix, so there is no actual security benefit to enabling these patches there. Defaulting this series to on is like closing the barn door to prevent the horse from getting out when there's a giant hole in the barn wall. It should be pointed out that, in general, simply using SSH to connect to an untrusted remote system or using `cat` on an untrusted file can do exactly the same thing as this series tries to prevent by sending arbitrary terminal codes to the terminal. Nobody has sent patches for SSH to make it filter out terminal sequences. I have also found pre-receive hooks on GitHub that will be broken by these changes. Just because Dscho has not seen them doesn't mean that they don't exist and many users who are not on Windows do not run the latest Git (they run what's provided by their distro or vendor), so they won't notice that things are broken until we've shipped the feature being on by default. I'm not opposed to adding support for this as an opt-in feature for those people that want it, though, and I think that's the right path for including it. -- brian m. carlson (they/them) Toronto, Ontario, CA