Keep reading. Use of environment variables is specified for Unix. (And, actually, for all other systems which the RFC provides a specification, differing only i

Keep reading. Use of environment variables is specified for Unix. (And, actually, for all other systems which the RFC provides a specification, differing only in minor detail.) http://tools.ietf.org/html/rfc3875#section-7.2 http://tools.ietf.org/html/rfc3875#section-7.2 For UNIX compatible operating systems, the following are defined: Meta-Variables Meta-variables are passed to the script in identically named environment variables. These are accessed by the C library routine getenv() or variable environ. This is how CGI works. This is how CGI has always worked. NCSA HTTPd was built on and for Unix, and was the origin of what we now call CGI. This is the interface to which CGI-compliant scripts and webservers have always adhered. > I suppose the authors of bash know that most of the implementations of CGI do this 1) I don't know why you would suppose the authors of Bash would know how CGI works. Nothing about writing a shell implies knowledge of the intricacies of web technologies. Certainly many of the people on HN so eagerly looking to blame either Bash or Apache don't seem to know how it works. If they did, they might have realized what quesera so astutely observed earlier today[0]: "This is neither a bug in bash, nor a bug in Apache, etc. It's an integration bug between two complex systems that were designed with zero-to-poor knowledge of each other." 2) I don't know when this particular Bash feature originated, but Bash as a whole pre-dates CGI by about five years. > I still maintain that this sounds like a very insecure mechanism I don't know of anyone who has looked at CGI and thought the use of environment variables was a good idea in the face of the 21st century's security landscape. This mess was more than two decades in the making. It is the collision of two entirely unrelated courses plotted by two entirely unrelated parties, neither of whom could have been expected to know what the other was doing, and neither of whom could have foreseen how yet more unrelated parties would (in some cases unknowingly!) combine their works into a time bomb. [0] https://news.ycombinator.com/item?id=8376914 https://news.ycombinator.com/item?id=8376914