OSC8 is the terminal sequence for linking arbitrary text (similar to `a` tags in HTML). It is mandatory for a modern terminal experience but prone to malicious use. The next version of Ghostty contains the strongest protections for malicious OSC8 short of disabling it entirely. In the next version of Ghostty, we've added a classifier for OSC8 URLs (any hidden URL, really) that classifies a URL as: trusted, requires-confirmation, or deny. The screenshots below show the separate requires-confirmation and deny alerts. We also now show hidden characters in the URL preview in the bottom of the window (previously we interpreted the Unicode directly which allowed maliciously crafted URLs to hide themselves). Hidden characters immediately trigger the `deny` classification, too. These are the strongest, most comprehensive protections for OSC8 across terminals. As a comparison: * Alacritty, Kitty, iTerm2, WezTerm: enabled by default with zero filtering at all. Can directly open executables or maliciously crafted schemes without any filter. Can hide the real URL through Unicode tricks. * Gnome Terminal: enables all OSC8, no configuration I could find to disable. Only rejects remote-host `file://` URLs. No other sanitization, confirmation, etc. * VS Code Terminal: Allowlist of safe protocols, prompts for unknown, silently replaces whitespace characters. Very good! * Windows Terminal: Allowlist, prompts for anything executable, prompts for any custom schemes. Very good!

Oscar: 29p | 17r | 3a Ace: 15p | 3r | 1a | 1b Brice: 15p | 2r | 1a | 1s Bez: 14p | 4r | 9a | 5s Cody: 14p | 3r | 6a | 2s Blake: 10p | 6r | 2a | 1s #TakeNote# presented by @ZionsBank