I agree that documentation sets a bad example. > The point that you've lost sight of here is that someone can do that and someone likely will. Sure, that is i

I agree that documentation sets a bad example. > The point that you've lost sight of here is that someone can do that and someone likely will. Sure, that is inherent in the freedom of powerful tools, you can also use them to do dangerous things. But that is besides the point. The point is that the default and simplest way is the safe way to spawn commands. You have to do extra work to invoke dangerous shellisms. You need to at least understand that arguments are conceptually not one long string but an array of several strings, and to invoke a shell you would already have to start with splitting that invocation into an array, so you gain little from then writing the rest of your command as one string, you might as well split up all of them and avoid all those escaping pitfalls. This is the contrast to other languages which have constructs like system("echo foo"), spawn_sh("echo foo") or whatever which are superficially easier to easier use than launching child processes the safe way. In this regard rust is safer than most other languages, since it has no "construct which calls the shell" - note the active voice used here, "can be used to call a shell", passive, is a different case. This is all I have claimed in this thread.