Re: Bash security issue

[Paul Smith]

On Fri, 2014-09-26 at 10:51 -0400, Steve Simmons wrote:
> 2) build a 'real' /bin/sh without those compiled in. This begs the
> definition of 'real', but IMHO if it's not in POSIX, it shouldn't be
> in 'real' /bin/sh

Ubuntu and it's derivatives have been doing this since 2006.  /bin/sh on
these systems is dash:

https://wiki.ubuntu.com/DashAsBinSh

They get a lot flak for it amongst people who care more about having
things work than having things portable, but they've stuck to their guns
so far.  Probably this current situation leaves them feeling justified
and even more resolute.  As someone who develops a lot of embedded
software and is constantly burned by people throwing badly-written
bash-specific scripts into their packages, I have really appreciated
them taking this stand.

It would be great if Red Hat would also join in, but I cannot imagine
that happening, ever: way too much would break for too little gain.