Re: Healing the bash fork

[John Haxby <john.haxby () oracle com>]

On 29 Sep 2014, at 19:50, David A. Wheeler <dwheeler () dwheeler com> wrote:

> That said, a lot of people are looking to find other attack paths.  Shellshock has pointed out
> a kind of attack path that most people hadn't examined before.
> I'd still like to see Christos Zoulas's approach included eventually, since that's an even stronger
> countermeasure.  After all, if function imports only happen on request, then
> non-requesters will have no problem. But I also understand that Zoulas's approach
> is backwards-incompatible, and thus the bash folks are hesitant to apply it.
> If that can't be added now, perhaps it could be added in a next release of bash?

Normally I’d be all for maintaining backwards compatibility: we spend a lot of time fixing bugs in a way that doesn’t 
break anything.  On this occasion, though, I think Christos Zoulos’s approach is both correct and needed.

jch