4 ms·
Seems to me that the only correct fix to Shellshock and this is to completely remove bash from all systems. I'm not sure what to replace it with. rc perhaps?
by dscrd 12y ago
Seems to me that the only correct fix to Shellshock and this is to completely remove bash from all systems.
I'm not sure what to replace it with. rc perhaps?
(Yes, I know that almost every distribution depends heavily on bash for all kinds of things. It won't be trivial.)
- jvreeland 12y agoFor a system shell dash is a fairly good choice. For scripts that rely on a lot of bash-isms it's a touch choice.
- dspillett 12y agoDebian have moved over to using dash as the default system shell, as it is leaner and more efficient while being fully posix compliant and so forth. It deliberately doesn't offer any extensions (including "bashisms" that are used unwittingly in many scripts you'll find out there) or features for making interactive use more pleasant, so it probably isn't what you want for your login shell, but using it as your default /bin/sh significantly reduces your exposure to the recently discovered (and patched) vulnerabilities in bash (and you'll have slightly faster boot and CGI invocation times too).
- joshribakoff 12y agozsh is really great
- ZoFreX 12y agoIt's fine to have bash on your system as your interactive shell, if that's your preference. The problems occur when you have /bin/sh symlinked to bash. "Bash is for people, not for scripts" :)