I think this, really, is the take away. Everyone is getting stuck on the subshell part, but it's the untrusted data part that's the problem. Especially becaus

I think this, really, is the take away. Everyone is getting stuck on the subshell part, but it's the untrusted data part that's the problem. Especially because the early examples in the article (making subdirs for something like different packages/release - "project/staging", "project/production") are almost certainly safe to use a subshell for - so much so that I was genuinely wondering why the author wouldn't just call out to "mkdir -p" for that use case. The error came when someone decided to pass untrusted/user-supplied data to this function (the later example - usernames). But I think doing the later is a huge mistake either way. Don't pass untrusted & unsanitized user data ANYWHERE that isn't explicitly designed for it. Who gives a hoot whether that's to a subshell, or a pipe/stream, or to a sql query, or your DOM, or any other of hundred of places that user supplied data isn't safe.