> This doesn't change my opinion that there's no reason modern websites are opening shells—and nothing you've said provides evidence of that. What? Evidence of

> This doesn't change my opinion that there's no reason modern websites are opening shells—and nothing you've said provides evidence of that. What? Evidence of your opinion? I live in reality, one not informed by opinions, and there are plenty of sites that were designed to be secure, but that didn't anticipate something like Shellshock -- many existing PHP pages, as just one example. Setting environment variables is very common, and safe if the shell is safe, because a sound shell won't do anything with an environment variable setting action beyond setting an environment variable. Consider a prudent design that sanitizes the entry to limit itself to an alphanumeric variable name and a value provided by the user, as in my example. The left-hand side of the assignment is not an issue because the program checks its content for malicious intent. The right-hand side is safe if Bash is safe. If Bash is safe and if rudimentary precautions are taken, any variable-assigned text string is benign. Not so for Shellshock, which is why it caused such consternation among Website operators. Here's an online reference that makes the same points I do, and even uses the same example of reading /etc/passwd: https://blog.cloudflare.com/inside-shellshock/ https://blog.cloudflare.com/inside-shellshock/