Quick notes about the bash bug, its impact, and the fixes so far
This is a perfect example of why you should never, ever put special magical values in-band with a facility which has a different purpose normally.I know it's tempting and in many cases, it will save you a lot of work, but it will eventually lead to data corruption, or, way worse, a problem like this one here.People in the office complain about my annoyed remarks when they succumb to the dark side and use some special values. My question "but what if a real value is ever sent that looks like one of these magic values?" is usually countered with "but who's ever going to send this value?".This bug here is providing me with a perfect answer to that question: "Security researchers, or worse, bad guys".There are so many ways of transferring functions to subshells that don't involve magic values in a free-form key/value store, but all of them would have been more complicated, so people chose the quick hack.And now the sh*t has hit the fan :(