lobsters score: 4 · tags: release
Ghostty is so impressive to me. Definitely one of the better pieces of software that I have the joy to use.
I’m happy there’s a new release. There’s a bug that’s really been annoying me (global keybinds stop working on macOS after a little) and it’s supposed to be fixed now. (I haven’t had a chance to test it yet, but can’t wait!)
score 1 · canonical
This may be a bit off-topic, so feel free to ignore it, but these release notes made me think about how security fixes get shipped.
As far as I can tell, 1.3.1 (March 13) was the last patch release before this one, and its notes don’t mention any security fixes. The advisories listed here seem to have been disclosed just before 1.4.0, so I’m not suggesting they sat unpatched for months. I don’t know when they were reported, and coordinated disclosure would look exactly like this.
What bothers me a little is the delivery path. Getting these fixes means taking 1.4.0 as a whole, including the new
copy-on-selectdefault on macOS and the GTK 4.18 requirement, which rules out Ubuntu 24.04 LTS. The notes point those users to an older version or the Flatpak, but there doesn’t seem to be a 1.3.2, so I couldn’t tell where the fixes would come from for them. If I’ve missed a backport, I’d be glad to be corrected.I understand a small team can’t maintain several release lines, and I use Ghostty and like it a lot. Still, security fixes have costs that fall on people other than the maintainers, and I wonder whether a patch release for the previous minor, even just one, might be worth the effort. I may well be underestimating what that takes.
score 1 · canonical
Still, security fixes have costs that fall on people other than the maintainers, and I wonder whether a patch release for the previous minor, even just one, might be worth the effort
Then why don’t you do it?
score 1 · canonical
Fair enough, and I realize it’s easy to ask for this from the outside. I didn’t mean that I should be the one to do it, though, and I’m not sure I could. The fixes are public once the advisories go out, so anyone can backport them. But a signed and notarized build, an auto-update, a version number that scanners and distro trackers recognize: those only come from the project itself. A patched fork wouldn’t reach most users.
I maintain a few much smaller projects (Fedify and LogTape, for instance) and try to ship patch releases for older minors, so I do have some sense of what it costs. It’s far more manageable at that scale. I’d guess Ghostty’s situation is harder, with more platforms, more packaging, and many more users. Please read my comment as a wish rather than a criticism of how the team spends its time.
score 1 · canonical