> Apache should have used a socket, and should have known they needed to. Well, there's nothing inherently dangerous about setting environment values. Yes, som

> Apache should have used a socket, and should have known they needed to. Well, there's nothing inherently dangerous about setting environment values. Yes, some have special meanings in special contexts but so could data piped over a socket. So your argument boils down to: Apache should have seen the special treatment of data in this context, and used another context instead. That's fine, but it doesn't address the real problem, which is that the shell was not designed to be executed on behalf of other users. There's no spec to say that data received from the "other" channel will not be interpreted or used unexpectedly. Until you have that guarantee, you're just rearranging the problem space. There's no systemic improvement.