4 ms·
> I would argue that the bash security concern is not a bug. It is clearly a feature. Admittedly, a misguided and misimplemented feature, but still a feature
by lutusp 12y ago
> I would argue that the bash security concern is not a bug. It is
clearly a feature. Admittedly, a misguided and misimplemented
feature, but still a feature .... The problem is that it was designed 25 years ago. Apache didn't exist yet for five years!
The linked article's premise requires that the bug/feature be present when Bash was first written, not be the result of more recent changes, a a time when the risks were obvious. I can't show this, but I doubt it.
- informatimago 12y agoYes, this part of the code is basically unchanged in all versions from the oldest I could get (1.14.7). What made me look for it, was a suspicion that it was some backdoor added more recently. But apparently no, it's a feature that always existed in bash (granted, an ill-advised and ill-implemented undocumented feature, but still).