←back to thread

Multiple security issues in GNU Screen

(www.openwall.com)
414 points st_goliath | 3 comments | 13 May 25 11:28 UTC | HN request time: 0.006s | source
Show context
mmsc ◴[13 May 25 12:05 UTC] No.43971967[source]▶
It's surprising that upstream was involved in this. Around 5 years ago, I came to the (sad) conclusion that GNU screen development had completely halted. Is that still not the case?

Does screen have the functionality to add a new window to an existing screen without attaching to the screen yet?

replies(5): >>43972042 #>>43972071 #>>43972387 #>>43972604 #>>43972925 #
immibis ◴[13 May 25 13:16 UTC] No.43972604[source]▶
Open source does have a problem with inertia whenever one piece of software ends and another piece is created to replace it, but there's no immediate incentive to switch, because it is a switch, not an update.

Though conversely, when someone buys the trademark for an existing piece of software, and replaces it with something entirely different, like what happened with Audacity, that's also bad. So there's no good solution.

replies(3): >>43972716 #>>43973459 #>>43974235 #
Wowfunhappy ◴[13 May 25 13:27 UTC] No.43972716[source]▶
Isn't this what distros are for? So e.g. Debian could decide to replace screen with tmux, possibly with some sort of compatibility package that takes all the same command line arguments as screen but uses tmux under the hood. (I've used screen very little and have never used tmux so I'm not sure if that would make sense in this context).
replies(4): >>43972924 #>>43973023 #>>43974844 #>>43975292 #
layer8 ◴[13 May 25 17:15 UTC] No.43975292{3}[source]▶
You generally can’t transparently replace a tool by a different one like that, siblings are giving examples of where there would be incompatibilities. There would also be much upheaval among users if a distribution would try to underhandedly perform such a replacement. If anything, a package “tmux-as-screen” could be provided for those who want that.
replies(1): >>43979196 #
1. Wowfunhappy ◴[13 May 25 23:53 UTC] No.43979196{4}[source]▶
> If anything, a package “tmux-as-screen” could be provided for those who want that.

To be clear, that's what I was imagining. If you had a shell script that called screen, it would now work via tmux, but no one would be "tricked".

replies(1): >>43979282 #
2. layer8 ◴[14 May 25 00:06 UTC] No.43979282[source]▶
In that case, nobody would be tricked because they would have to explicitly select that package. Those already having screen installed, or selecting screen for installation, wouldn’t automatically be upgraded to tmux-as-screen. So what the comment you replied to mentioned as a problem of inertia and there being “no immediate incentive to switch” would remain largely unaddressed.
replies(1): >>43979335 #
3. Wowfunhappy ◴[14 May 25 00:13 UTC] No.43979335[source]▶
Well, I guess the other part would be removing screen from the official repo. So the original utility is gone, but we have a compatibility package you can install that should make things work like they used to. (Of course, if you really still want screen you can build from source or some such.)