Up until 5 hours ago this fix was not present:
> The displayed target is sanitized so invisible and line-breaking characters cannot conceal the effective destination.
https://github.com/ghostty-org/ghostty/security/advisories/G...
The sensible default is to have it turned off. And by the looks of it Ghostty versions before this you couldn't even turn it off.
If you don't want to be able to have clickable hyperlinks, by all means use Konsole — no one is forcing you to use Ghostty. But if you want to know why people like Ghostty's approach vs Konsole's, it's because Ghostty pushes terminal emulator features forward and is low latency. Konsole is low latency and adopts some but not all features that other people invent. It's a noticeable difference and so people who like the feature part of the former like Ghostty/WezTerm/Kitty more than Konsole. If you don't care or dislike that part, and want a more conservative terminal (that is also low latency), Konsole and many others further on the conservative spectrum exist.
I haven't used Konsole, but I do like this "recent" focus on terminals and have used many of the newer ones. Dailydrived st,alacritty,wezterm,ghostty,kitty,foot (probably forgot some) and I live for the regex pattern matching copy shortcuts etc.
I learned about OSC8 because my terminal (whichever it was) used one of its features and I didn't know it was possible to do that. My immediate thought was, how is the security?
And it is very disappointing to see how little effort people have spent on that. That is really one part that I expect more from modern incarnations of the old terminals where I can sort of forgive them for the lack of security posture.
I like ghostty, I really do. But this is not a good look, and to be clear it isn't just ghostty. Without looking for it I've stumbled upon several OSC8 and OSC52 bugs (in other software) recently.
If people want it enabled, they can enable it. It shouldn’t be the default.
Someone? Almost certainly
I wouldn’t mind OSC8 so much if it had proper security auditing but it doesn’t. The whole thing was pushed by one guy on a GitHub gist who blocked anyone who dared discuss security issues.
At least with browsers, you have masses of people testing these things. But there’s no rigour to any of the tests that happen with terminal emulation. Let alone independent security audits.
And at this rate, it’ll only be a matter of time until we see “don’t cat untrusted READMEs” advice because they might contain boobytrapped escape codes. Which is an absurdly bad place to end up.