'Memory-Unsafe and Faster Than Yours' Is a Real Terminal

A terminal emulator named shitty hit Hacker News this weekend with the tagline "memory-unsafe and faster than yours." It reads like a shitpost, and the name is doing exactly what you think it's doing to kitty. But behind the trolling is a genuinely serious project: a C++23 hard fork and rewrite of Zutty, built by Anton Samokhvalov (pg83), the developer behind stal/IX, the aggressively static-linked Linux distro. Nearly 800 commits in a few weeks, a Vulkan backend on Linux, Metal on macOS, a VT conformance suite, sanitizer builds. The joke is the marketing. The code is not.

The Zutty lineage, minus the compute shader

Zutty's claim to fame was rendering an entire terminal grid with an OpenGL ES compute shader — character cells living in GPU-mapped memory, one shader invocation per cell, "zero-cost" rendering from the CPU's perspective. It was a beautiful proof of concept that stayed niche because it depended on GLES 3.1 compute support and never grew the feature surface daily drivers need.

Shitty keeps the philosophy and swaps the machinery. Terminal state stays on the CPU; rendering goes through native APIs — Vulkan on Linux (Wayland only), Metal on macOS — with damage-driven updates, so unchanged cells cost nothing per frame, and lazy glyph rasterization backed by a persistent GPU cache. That's a more conventional architecture than Zutty's, and closer to what Alacritty, kitty, and Ghostty already do. The differentiation is in the sweating of details: the repo bundles its own libstd revision in-tree, a very stal/IX move that trades distro-friendliness for controlling the entire dependency graph down to the standard library.

Feature-wise it's further along than you'd expect from a three-week-old fork: grapheme clusters and emoji sequences, the kitty keyboard protocol, five mouse protocols, OSC 8 hyperlinks, OSC 52 clipboard with configurable policy, scrollback reflow. No sixel or inline graphics, no bidi. That's a defensible scope — it's roughly Alacritty's scope — but it rules out the image-heavy TUI workflows kitty and Ghostty users have gotten attached to.

The benchmark it wins is the one that matters least

The README's headline numbers: catting 100MB of ASCII, shitty finishes in 0.81s (~118 MiB/s) against Alacritty 0.17.0 at ~99 MiB/s, kitty 0.48.2 at ~75, and Ghostty 1.3.1 at ~64. On random bytes — mostly invalid UTF-8 — it claims ~51 MiB/s to Alacritty's ~31, and kitty doesn't finish at all because random bytes keep tripping escape-sequence handling. These are the author's own numbers, on one machine, best of three runs. Nobody has independently reproduced them yet, so treat them as a claim, not a result.

But say they hold. What did we learn? Throughput benchmarks measure how fast a terminal's parser can chew through a firehose you'll encounter roughly never — the accidental cat of a binary, a runaway log. Every modern terminal already handles that case by decoupling parsing from rendering and dropping frames. What you actually feel, hundreds of times a minute, is keystroke-to-glyph latency, and there the interesting prior art is Zutty itself, which got typometer results down to the 5–10ms range through damage short-circuiting. Shitty inherits that DNA, and "low latency" is its stated design goal — but the README leads with the MiB/s table because MiB/s is what wins Hacker News threads. Alacritty spent years branding itself the fastest terminal before quietly softening the claim; we're rerunning that playbook with a ruder name.

The random-bytes result is the one worth pausing on, though not for speed reasons. Feeding a terminal garbage is a fuzzing smoke test, and the fact that the fastest terminals diverge wildly on it — kitty effectively DoS'd by bell and title-change sequences — tells you the escape-sequence layer is where terminals are weird, fragile, and different from each other.

The joke cuts in the wrong direction

Which brings us to the tagline. "Memory-unsafe and faster than yours" is a jab at Rust-as-a-feature marketing, and as a jab it lands — Ghostty is Zig, kitty is mostly C and Python, so the safety halo around "modern" terminals was always partly branding. But a terminal is close to the worst possible program to be cavalier about memory safety in. Its entire job is parsing attacker-influenced bytes: everything you cat, every SSH session, every CI log you tail is input to that VT parser. This isn't hypothetical — iTerm2's CVE-2019-9535 was full remote code execution triggered by output the terminal displayed. A parser bug in a memory-unsafe terminal is a candidate RCE in a way a parser bug in your text editor mostly isn't.

To pg83's credit, the engineering doesn't match the swagger: the project ships a native conformance suite and sanitizer test variants through Nix. That's the honest version of the trade — C++ with fuzz-adjacent testing versus Rust with unsafe blocks in the hot paths — and it's a closer call than either camp's marketing admits. But the tagline invites you to read the project as an argument that safety doesn't matter, and for this program category specifically, that argument is wrong.

Should you care?

As a daily driver, not yet. You need Wayland plus a Vulkan driver on Linux or Metal on macOS, the license is mid-transition from Zutty's GPLv3 to MIT, and the binary installs as st — which will shadow suckless st for anyone who has it in PATH, a collision HN commenters flagged within the hour. With 65 stars and a single author, the usual young-project risks apply.

As a signal, it's more interesting. Terminal emulators are having a second renaissance — Ghostty's launch, kitty's protocol-standardization work, Alacritty's long stability grind — and shitty is a reminder that the performance frontier is now cheap enough for one skilled person to reach in weeks by forking good prior art and picking modern GPU APIs. The moat was never speed. It's protocols, ecosystem, and a decade of escape-sequence edge cases — which is exactly the layer where the new fast terminal, per its own benchmark table, still has everything to prove.