[E-devel] add option to disable terminology escape codes ...

Niltze [Hello]-

This weekend has been distressful in terms of security for those of us 
who use any Linux derivative(s) as the XZ/liblzma security issue was 
'discovered'.
< https://www.openwall.com/lists/oss-security/2024/03/29/4 >

I also followed the now disabled GitHub repo
< https://github.com/tukaani-project/xz/issues/92 >
where they had a frank interaction as the situation was emerging. 
Initially, one of the entities referred to something along the phrase of 
"it had to be a 'chink'", i.e., the committer who had been gradually 
introducing the backdoor into the XZ/liblzma source code. Yet, in the 
Internet *anyone* can utilize any name and does not necessarily reflect 
the prejudices inherent in others. I still remember a phrase, probably a 
cliche by now, during the early phase of Internet being embraced where 
'no one would know if you were a dog using the Internet'. Fact is that 
no one knows if behind a particular screen name/email at gmail[.]com, 
there was a major intelligence organization from *any* country -- yes, 
even from the West, i.e., Vault 7 anyone? for which Julian Assange is 
being tortured by the AngloSaxons' and their 'rules-based order'.

Possibly unrelated but AT&T got hacked, and they barely realized that 
some (all?) of its customers' personal data ended up in the so-called 
Dark Web.

And then reading through the OpenWall threads there is a link to 
terminal emulators vulnerabilities
< 
https://dgl.cx/2023/09/ansi-terminal-security#vulnerabilities-using-known-replies 
 >
where its author lists Terminology as to be avoided, but:

"add option to disable terminology escape codes that could be considered 
security issues by some. They are enabled by default"
< 
https://git.enlightenment.org/enlightenment/terminology/commit/144e0b5068aa25b7fce822a94101586f374aa236 
 >

Question:
If I add that option to the current source code of Terminology, what 
functionality would I lose?

-- 
Best Professional Regards.

P.S. In retrospect, the patches that I developed for Metztli Reiser4 
basically had ZSTD as the kernel de/compressor instead of the usual XZ 
used in Debian default. Nevertheless, xz/liblzma allegely touches even 
Systemd, which the Distro maintainers have pushed against the will of 
many users downstream --including myself. It is one thing to have a 
local Systemd-free operating system(s) -- which can be tinkered and 
fixed when it breaks with a given 'official' repository update; yet, it 
is another thing to attempt a Systemd-free remote bare metal or virtual 
instance(s) where it is not so easy to fix after a given update breaks 
it.

--
Jose R R
http://metztli.it
---------------------------------------------------------------------------------------------
Download Metztli Reiser4: Debian Bullseye w/ Linux 5.16.20 AMD64
---------------------------------------------------------------------------------------------
feats ZSTD compression https://sf.net/projects/metztli-reiser4/
-------------------------------------------------------------------------------------------
Official current Reiser4 resources: https://reiser4.wiki.kernel.org/