Well, I use it every day, all day long and this is terrible unless there is some way to turn it off.
Got a tip for us?
Let us know
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.
macOS 26.4 Introduces New Security Feature for Terminal Commands
- Thread starter MacRumors
- Start date
- Sort by reaction score
No different than having a friend that tries to catch rattlesnakes with his bare hands. Stupid is as stupid does and he deserved what we got.
Some people think and learn, others have to experience consequences to learn.
There is no reason to stop the consequences.
Superhai
macrumors 6502a
Fortunately rattlesnakes are shy, otherwise it would more prevalent than being subjected to pastejacking.
Superhai
macrumors 6502a
For those who think they are immune to this kind of things, this is an example of why (as well as why you should never paste anything from the web into the terminal) you probably aren't. (Courtesy of Dylan Ayrey) https://security.love/Pastejacking/
Shirasaki
macrumors P6
This is just one of many steps to silently brand their terminal as malware and find excuses to axe it, completely turning macOS into a glorified iPadOS while iPadOS slowly become macOS that has no terminal access. Yes it can thwart random people pasting random commands that they don’t understand to execute them blindly, but long term effect is “terminal bad. Don’t use it”. What we all enjoy as Mac OS X is going away slowly but surely.
Shirasaki
macrumors P6
Bundling terminal with Xcode is an amazing idea. It would suck for those who just want to use terminals but at the end of the day, terminal is an experimental tool and should be used by people who knows what they are doing rather than being part of the default experience. Rather than making terminal unusable, make the barrier to get one higher.
More like turning macOS into iPadOS. I’ve seen this trend a couple years ago when Apple decides macOS inheriting iOS design language is a must and before we know it, macOS becomes more and more like iPadOS by the day.
Nah. Apple is Apple. People will continue to buy Apple products and use their os. Linux user-base doesn’t have a ton of overlap with Apple users I think.
turbineseaplane
macrumors Penryn
Fishrrman
macrumors Nehalem
What's the terminal command to turn this "protection" OFF ...?
awesomecat
macrumors newbie
Mac Fly (film)
macrumors 68040
100%. I always wondered when I was trying to do something with Terminal if I was pasting in sneaky commands. Obviously care is taken, but this extra layer of protection for Terminal is a nice feeling.
edubfromktown
macrumors 65816
Superhai
macrumors 6502a
I tried to paste various "dangerous" commands into Terminal in MacOS 26.4, and it works fine, no popups or anything. However it seems that all pastes are being properly bracketed now, so nothing that is pasted with newlines will autorun before you press enter.
What will fail however is trying to paste after running this
What will fail however is trying to paste after running this
Bash:
print "\e[201~" | pbcopy
Last edited:
JaydenA
macrumors regular
From my POV, it wouldn't bug me inside the local machine. But most of my use makes the mac just the first point through a chain of various systems and security gateways, into some very mission critical linux servers scattered over the world.
So, inside the mac locally, in Darwin, it's a great idea that can only protect people, kudos on that.
But if i've chosen to SSH out, then this should absolutely stop or be an option.
And taking that option further into places I hope Appple don't go... if it is an option for other systems it must be very clear if the commands are being sent to an external AI for checking... in which case no, not acceptable and likely contract breaking matter which would see me unemployed. Those external system commands - if they are sent to AI - potentially become huge security holes with major impact or to a lesser extent are silly as it isn't Darwin any more but redhat or solaris, or whatever.
So no, wouldn't bug me at all on localhost, but it should never assume that's where I will be and should be off, or optional with full AI use disclosure.
As an experienced sysop/devop a great feature with some powerful external system caveats.
villagehiker
macrumors member
Nice work, Apple. Millions of us use the terminal, but may not self-identify as advanced. Perl is fairly easy for non-developers because it can note errors without terminating a program. TeX and friends* are the only reasonably-priced means to produce beautiful typesetting for book-length projects. The best static website generators also enable content creation with productivity and security easily surpassing that of any of database-driven web content managers.
*A non-command line way to install TeX and friends is MacTeX on tug dot org, maintained and supported by open-source-ish volunteers—open-source-ish because TeX is free to use but not exactly open source.
*A non-command line way to install TeX and friends is MacTeX on tug dot org, maintained and supported by open-source-ish volunteers—open-source-ish because TeX is free to use but not exactly open source.
Black_Mage
Contributor
For everyone who has disagreed with me, anyone with a lot of experience with Linux, including LTT, will confirm that you need to learn the command line interface if you really want to learn Linux because you can’t do everything with the GUI…..yet. That was not an opinion that’s a fact. Also, why oppose introducing a feature to Linux that would make it even more secure?
IvyKing
macrumors 6502a
Definitely not, but mentioning it is a good way of gauging whether someone has familiarity with the UNIX command line. Users should read up on UNIX commands before using the terminal app.
I am interested in whether xterm will be affected by this as I do most of my CLI work with xterm.
Superhai
macrumors 6502a
I tried to paste something into the Apple Terminal on a new install, and then it is triggered. It does not seem to be related to the content, but just the fact that you try to paste. If you choose to not paste, the pop up will repeat each time you paste. However after clicking paste anyway, it will never ask again. But it will still trigger on the bracketed paste end marker I have above, which have no way to bypass.
Also to turn it off you can directly write
and then restart the Terminal. I am not sure if it matters if it is true or false, because to re-trigger the warning I had to delete entire settings
so possibly there are more than that which actually triggers it.
Also to turn it off you can directly write
Code:
defaults write com.apple.terminal UserAcknowledgedPasteWarning -bool true
Code:
defaults delete com.apple.terminal
Last edited:
Mac Fly (film)
macrumors 68040
You mean those models that constantly make mistakes? Would rather not.
you're not wrong, still, it should be able to decipher this kind of stuff i'd imagine
Mac Fly (film)
macrumors 68040
The less information we give these AI companies the better tbh.
“Perhaps we’ve convenienced our real life away someplace.”
Last edited:
Dr Drang article on this MR article:
leancrew.com
He was unable to determine what would trigger the alert. He tried a few risky things, like piping 'curl' output directly to 'bash', which didn't trigger it. Huh.
Saving us from ourselves?
leancrew.com
He was unable to determine what would trigger the alert. He tried a few risky things, like piping 'curl' output directly to 'bash', which didn't trigger it. Huh.
Superhai
macrumors 6502a
No wonder, because there is nothing specific triggering it, except pasting anything into the Terminal for the first time as I described above. There is some heuristic Apple is using to also decide if you have used the Terminal already (before updating to 26.4) which will also cause it not to trigger the alert.Dr Drang article on this MR article:
Saving us from ourselves?
He was unable to determine what would trigger the alert. He tried a few risky things, like piping 'curl' output directly to 'bash', which didn't trigger it. Huh.
me, if Apple doesn't offer an option to disable it. modern macOS in some areas requires 20 extra clicks to do anything already.
Nevermind, this is a decently thought out change then. Apple should have made it pop up to everyone however. What about those who have already been scammed once?
Last edited: