Most active commenters

    ←back to thread

    Multiple security issues in GNU Screen

    (www.openwall.com)
    414 points st_goliath | 15 comments | 13 May 25 11:28 UTC | HN request time: 0.206s | source | bottom
    Show context
    mmsc ◴[13 May 25 12:05 UTC] No.43971967[source]▶
    It's surprising that upstream was involved in this. Around 5 years ago, I came to the (sad) conclusion that GNU screen development had completely halted. Is that still not the case?

    Does screen have the functionality to add a new window to an existing screen without attaching to the screen yet?

    replies(5): >>43972042 #>>43972071 #>>43972387 #>>43972604 #>>43972925 #
    1. jzb ◴[13 May 25 12:51 UTC] No.43972387[source]▶
    Upstream requested that the SUSE team take a look at it. It seems that development is understaffed and the upstream may not have the expertise to maintain it properly. Which, if true, is sad -- I know that tmux and others exist, but a lot of people have used Screen for many many years. It sucks when a tool bitrots.
    replies(1): >>43973007 #
    2. marcosdumay ◴[13 May 25 13:51 UTC] No.43973007[source]▶
    Looks like a tech-debt ridden large piece of software that new developers just can't understand.

    If that's the case, it's not really about it being "understaffed". Instead, it's doomed to rot until it's replaced of rewritten. There's no scenario where more maintainers will help, except for marginally delaying it.

    The good news is that there are almost perfect replacements out there, and most of them are leaner.

    replies(3): >>43973635 #>>43974787 #>>43975209 #
    3. megous ◴[13 May 25 14:53 UTC] No.43973635[source]▶
    It's not large:

    https://git.savannah.gnu.org/cgit/screen.git/tree/src

    A few 2kLOC files and the rest is rather small.

    4. doctoboggan ◴[13 May 25 16:36 UTC] No.43974787[source]▶
    What are the replacement tools I should be looking at as a casual user of screen?
    replies(2): >>43975021 #>>43975066 #
    5. nosrepa ◴[13 May 25 16:54 UTC] No.43975021{3}[source]▶
    Tmux
    replies(1): >>43979276 #
    6. kstrauser ◴[13 May 25 16:57 UTC] No.43975066{3}[source]▶
    If you want screen-but-better: tmux.

    If you want a rethinking of the idea: zellij.

    I prefer the latter. It matches my mental model of such things, and lots of people talk about enjoying switching to it. Many others happily use the former daily.

    replies(1): >>43975837 #
    7. narag ◴[13 May 25 17:09 UTC] No.43975209[source]▶
    Instead, it's doomed to rot until it's replaced of rewritten.

    I've seen how that mindset has ruined several companies. Not saying that you're wrong about that particular program that is, after all, free software replaced by other free software parts. But for business, it's lethal.

    Joel Spolsky had a nice piece about it:

    https://www.joelonsoftware.com/2000/04/06/things-you-should-...

    That and Fire and Motion seem to be forgotten wisdom already:

    https://www.joelonsoftware.com/2002/01/06/fire-and-motion/

    I feel old :-)

    8. bombcar ◴[13 May 25 18:03 UTC] No.43975837{4}[source]▶
    tmux is great but it's way too powerful for the 90% use case of screen - which is "let this process continue to run even if I disconnect or logout".

    I've had some luck with mosh, but that also seems kind of moribund.

    https://mosh.org

    For my use case it's fine.

    replies(5): >>43976434 #>>43977409 #>>43980022 #>>43982417 #>>43987484 #
    9. kstrauser ◴[13 May 25 19:05 UTC] No.43976434{5}[source]▶
    Along the lines of Mosh, I've migrated from it to Eternal Terminal (ET): https://eternalterminal.dev
    10. int_19h ◴[13 May 25 20:34 UTC] No.43977409{5}[source]▶
    If that is literally the only thing that you need, dtach is the ticket.
    11. jmholla ◴[14 May 25 00:05 UTC] No.43979276{4}[source]▶
    If there was a way to get rid of Tmux's persistent status bar, I'd be happy to switch over. But last time I checked, you can't, and I want that real estate.
    replies(1): >>43980017 #
    12. arp242 ◴[14 May 25 02:12 UTC] No.43980017{5}[source]▶
    Add "set -g status" to your tmux.conf. You can even bind it to a key to toggle if you want.
    13. arp242 ◴[14 May 25 02:14 UTC] No.43980022{5}[source]▶
    > tmux is great but it's way too powerful for the 90% use case of screen - which is "let this process continue to run even if I disconnect or logout".

    I guess, but does it really get in the way?

    I use tmux only for scrollback and having multiple "tabs" and sessions, and not much else. But the more advanced stuff like splits and whatnot never really get in my way.

    14. db48x ◴[14 May 25 08:59 UTC] No.43982417{5}[source]▶
    Even screen is too powerful for that use case. Just use nohup or dtach instead.
    15. lupusreal ◴[14 May 25 18:06 UTC] No.43987484{5}[source]▶
    Screen has some obscure functionality that tmux doesn't have. Handling serial port connections, whereas with tmux AFAIK you'd have to use minicom.