Hacker News Reader

Comment by dfc | Hacker News Reader

  $ env -i WLIST=$WLIST WLIST2=$WLIST2 command

View on HN

I've been meaning to ask ... why have all the examples for shellshock used `env`? Without even an -i?

My guess is that the unadorned `ONESHOTENVVAR=1 someprogram` is a little obscure to some. As to the lack of -i; it almost certainly necessary makes no difference to the result.

Using env may be slightly more portable if you're using an exotic login shell that doesn't support the "FOO=1 program" syntax - say, tcsh.

But for most part, it's probably just people copying-and-pasting stuff without really figuring it out what it does. For example, compare "exploit #1" and the supposedly different "exploit #3" on shellshocker.net.

Reply on news.ycombinator.com