Any non-privileged user can "dump the proc table" with ps(1). It's somewhat harder to break process address space separation (root privs, physical access, ...).

Any non-privileged user can "dump the proc table" with ps(1). It's somewhat harder to break process address space separation (root privs, physical access, ...). It's not "fear" but rather "defence in depth" or perhaps "security evangelism". If we don't critique this kind of sloppy use then we tacitly condone it. That leads to (for example) people running "mysql --password=..." and wondering why their DB on shared host got owned. "But the ssh keys aren't readable unless... and we never reuse passwords and...". This kind of analysis is complex and (thus) error prone. Passwords on the command line should [almost always] simply be taboo, period.