bug: ghostty phones home to check for updates immediately upon launch without user consent

[sneak]

My terminal emulator should not be making network requests without my explicitly indicating that I wish it to do so.

Do one thing and do it well.

[Integralist]

I believe this can be disabled via configuration but I think your concern is more with it being enabled by default.

I actually like this feature being enabled by default as it's beneficial to me to have software automatically let me know there are new features/updates available.

I imagine this is the feeling most people have and along with the "zero config" ethos (and the fact this isn't telemetry data being phoned home) this has led the developers to make this the default behaviour.

[mitchellh]

It is very idiomatic for Sparkle-based macOS apps to do this. You can disable this with auto-update. I think the risks of not getting an update far outweigh the philosophical argument of not making a request.

I don't know the exact definition of a "phone home", but for what it's worth we don't track or log any of these requests. We don't use Sparkle's analytics feature at all. This is grabbing a static XML file on blob storage: https://release.files.ghostty.org/appcast.xml.

[mitchellh]

I would argue the security risks of not getting an update outweigh the small information leakage. The same reason for example software like Chrome just auto update fully (Ghostty doesn’t go this far).

[sneak]

Shouldn’t it be user choice, though? The risk isn’t so substantial that you force autoupdate onto the package-manager-managed installs.

Also, the Chrome way is just a plain old RCE vulnerability. You’re just throwing Google the keys to the car at that point, they can exec whatever code they serve you.

FWIW my Chrome install has had its autoupdate explicitly neutered for this reason.

[Integralist]

I think if enough of the community complains about this, then I'm sure a reversal of the decision will be made, but I suspect this decision was originally for the benefit of the majority of users who really don't mind the feature (aka zero config).

You have the ability to disable the feature, so I'm not sure at this point what more can be said on the matter outside of waiting and seeing how the wider community responds.

[mitchellh]

As noted in my original post you can disable this before first start if you want by setting the configuration. I’m just arguing for the default.

And like I said, this is quite typical for macOS applications. The Linux application does not do this (or have any auto updates) since package management usually handles this and there are cultural differences.

[00-kat]

A possible solution might be to not check for updates on the first ever launch, and to add a note to the default config that was added in #3460.

[sneak]

Given that SNI is not encrypted, this also leaks to the network what software is running on my machine.

The argument is very much a practical one, not philosophical. A user of this niche software is not a normal computer user, and identifying them as such is a big information leak.

[bravecrayon]

In my experience, freshly installed macOS apps have often asked me if I want to check for updates on future launches. (Though, to be fair, I don't know how many apps I've installed that have not asked for permission to do that and did it anyway). I would think it'd be reasonable to have it be opt-in. And it might be especially good to include it in the context of the complaints around Warp requiring a login or sending telemetry.

[ldemailly]

Follow up suggestion came up: #7307

[mitchellh]

I should add that since Ghostty 1.1, we've changed the behavior so that by default we do ask for permission. We only override this if the auto-update setting is explicitly set. If it is unset (the default), then the normal macOS behavior should happen. This won't happen for people who previously used Ghostty since the preference is already saved, but will impact new users.