5 ms·

You still have to replace /bin/bash and /bin/sh binaries, even after doing a `brew install bash`. ...right? `brew install bash` will just give you /usr/local/b

You still have to replace /bin/bash and /bin/sh binaries, even after doing a `brew install bash`. ...right? `brew install bash` will just give you /usr/local/bin/bash, and then use that as your interactive shell.

oinksoft 12y ago
No, you change your user shell to the shell you want. You can do this in the "Accounts" preference pane by control-clicking a user, selecting "Advanced Options" from the context menu, and changing the "Login shell" setting to your preferred shell.
- qzc4 12y ago
  #!/bin/bash
  - oinksoft 12y ago
    That should be #!/usr/bin/env bash, particularly for BSD which does not install bash in /bin. Nothing new about absolute executable paths being non-portable, #!/bin/bash is as bad as #!/usr/bin/python.
    - qzc4 12y ago
      I'm not saying you should use that. It's just that "#!/bin/bash" shows 18 million results on Google while "#!/usr/bin/env bash" shows only 121,000.
- unspecified 12y ago
  Right....but your user shell has nothing to do with shellshock. Shellshock involves things like Apache invoking system calls that need a shell, and those system calls don't care what your user shell is. They care what /bin/sh and /bin/bash are (or wherever your system shells live, it's /bin for OSX). This guide is claiming that updating your login shell to bash via Homebrew will mitigate shellshock, which is flat-out wrong, and dangerous to boot.
  - oinksoft 12y ago
    OK, but nothing in your comment implied that you were talking about the "Shellshock" vulnerability. I believe that a very recent OSX update patched this vulnerability, anyhow.
    - unspecified 12y ago
      Oops, a very good point. I should have mentioned that right off the bat: my issue was with calling this a "hacker's guide", when it contains a pretty blatant security issue.
- crusso 12y ago
  I think the parent poster is talking about eliminating all known-vulnerable bash shells from his machine, not just having the default user shell change.
tjl 12y ago
Or you can update your bash from Apple's Support Site, http://support.apple.com/downloads/ http://support.apple.com/downloads/ I don't know if it fixes the more recently found bash vulnerabilities, but I know it fixes the first one that was reported. You can find versions for Lion and Mountain Lion if you search.

oinksoft 12y ago

No, you change your user shell to the shell you want. You can do this in the "Accounts" preference pane by control-clicking a user, selecting "Advanced Options" from the context menu, and changing the "Login shell" setting to your preferred shell.

qzc4 12y ago
#!/bin/bash
- oinksoft 12y ago
  That should be #!/usr/bin/env bash, particularly for BSD which does not install bash in /bin. Nothing new about absolute executable paths being non-portable, #!/bin/bash is as bad as #!/usr/bin/python.
  - qzc4 12y ago
    I'm not saying you should use that. It's just that "#!/bin/bash" shows 18 million results on Google while "#!/usr/bin/env bash" shows only 121,000.
unspecified 12y ago
Right....but your user shell has nothing to do with shellshock. Shellshock involves things like Apache invoking system calls that need a shell, and those system calls don't care what your user shell is. They care what /bin/sh and /bin/bash are (or wherever your system shells live, it's /bin for OSX). This guide is claiming that updating your login shell to bash via Homebrew will mitigate shellshock, which is flat-out wrong, and dangerous to boot.
- oinksoft 12y ago
  OK, but nothing in your comment implied that you were talking about the "Shellshock" vulnerability. I believe that a very recent OSX update patched this vulnerability, anyhow.
  - unspecified 12y ago
    Oops, a very good point. I should have mentioned that right off the bat: my issue was with calling this a "hacker's guide", when it contains a pretty blatant security issue.
crusso 12y ago
I think the parent poster is talking about eliminating all known-vulnerable bash shells from his machine, not just having the default user shell change.

tjl 12y ago

Or you can update your bash from Apple's Support Site, http://support.apple.com/downloads/ http://support.apple.com/downloads/ I don't know if it fixes the more recently found bash vulnerabilities, but I know it fixes the first one that was reported. You can find versions for Lion and Mountain Lion if you search.