I think the "super-hype" is warranted. You've missed out a large number of possible ways this could be exploited, so the above advice would leave a lot of peopl

I think the "super-hype" is warranted. You've missed out a large number of possible ways this could be exploited, so the above advice would leave a lot of people vulnerable. Furthermore, because it's such a common thing to pass environment variables and to invoke bash, people expect far more attack vectors to be discovered as this unfolds. In addition the current patches rely on huge swathes of bash code being bug-free, we've already seen one patch circumvented and with so many eyes suddenly on code that wasn't closely inspected from a security angle for over two decades, I would bet on seeing far more things being found over the next weeks or months.