Re: Re: CVE-2014-6271: remote code execution through bash (3rd vulnerability)

[Michal Zalewski <lcamtuf () coredump cx>]

> Am I the only one who is wondering: Who is paying Chet to do this?

Chet probably had a busy couple of weeks because of a piece of code
that went unnoticed for longer than the age of some people posting to
this list. As soon as additional problems with the original fix
cropped up, he also worked pretty hard to adopt a more robust prefix
approach, which shipped upstream about a day ago.

While I'd be the first to line up and just get rid of the affected
functionality, the worries about compatibility with existing code are
pretty valid. Heck, we unexpectedly bumped into issues with that when
fixing the bug at Google. We were surprised to notice that some people
do use function exports in their code, and then, that some of them use
mock object-oriented notation like function foo::bar { ... } - which
actually malfunctioned after the first patch.

So, I don't think there's a lot of value in making random accusations.

/mz