Hacker News Reader

I've been meaning to ask ... why have all the examples for shellshock used `env`? Without even an -i?

My guess is that the unadorned `ONESHOTENVVAR=1 someprogram` is a little obscure to some. As to the lack of -i; it almost certainly necessary makes no difference to the result.

View on HN

Using env may be slightly more portable if you're using an exotic login shell that doesn't support the "FOO=1 program" syntax - say, tcsh.

But for most part, it's probably just people copying-and-pasting stuff without really figuring it out what it does. For example, compare "exploit #1" and the supposedly different "exploit #3" on shellshocker.net.

Reply on news.ycombinator.com