Dash As The Default Shell For Fedora?

[nanonyme]

Good idea... but obviously, make sure to audit the code, and move every single program to use dash.

Also always always report bashisms in scripts using /bin/sh as upstream bugs rather than maintaining everything yourself

[halo9en]

I have not noticed any issues and I believe that is has been tested by far more Arch users than me since it is in the Arch wiki how to do it

Thanks - I will give it a go.

I was a bit undecided on which shell to pick but dash is smallest and less features _might_ mean less attack surfaces...

Hopefully...

[Adarion]

It is interesting to see how people suddenly are fleeing towards other shells. But does that really make sense? Nobody can assure you that other shells don't have similar problems. After some mass use they might exhibit also flaws and defects. Or does any of those have regular code audits?
I'm not into any shell bashing (no pun ) but it's interesting to see people's reactions.

[Kemosabe]

Is it really clever and secure if everybody starts using the same shell - dash?

[DrYak]

It is interesting to see how people suddenly are fleeing towards other shells. But does that really make sense? Nobody can assure you that other shells don't have similar problems. After some mass use they might exhibit also flaws and defects.

Yup, I agree. Fleeing to a different shell won't magically solve the MAIN problem: We NEED to have the shells (whichever) audited.

[Luke_Wolf]

It is interesting to see how people suddenly are fleeing towards other shells. But does that really make sense? Nobody can assure you that other shells don't have similar problems. After some mass use they might exhibit also flaws and defects. Or does any of those have regular code audits?
I'm not into any shell bashing (no pun ) but it's interesting to see people's reactions.

On the other hand this has the positive effect of ensuring that sh scripts are really sh scripts and not bash scripts. Which means that they'll work in any sh-compliant sh as opposed to only in bash, removing that single point of failure

[carewolf]

It is interesting to see how people suddenly are fleeing towards other shells. But does that really make sense? Nobody can assure you that other shells don't have similar problems. After some mass use they might exhibit also flaws and defects. Or does any of those have regular code audits?
I'm not into any shell bashing (no pun ) but it's interesting to see people's reactions.

The problem is bash is designed to be a feature rich user shell. Something like dash is designed to be a system shell that no user use, but is the one implicitly used for system functions.

[uid313]

The system shell should be a fast, small, minimalistic, secure shell without bells and whistles.

The user shell needs more bells and whistles such as command history, autocompletion, line editing features, etc.

[dh04000]

Before we all jump ship off of Bash and OpenSSL, why don't the community form security groups and audit the codes. Try to fix/mainain these mature projects before jumping to less mature ones with a code with potentially more bugs. Seems to silly to change based on one well known bug.

[TheCycoONE]

Since ArchLinux was brought up, it should be noted that the developers there are leaning towards not switching to dash, and part of the reason is security (how dash handles setuid): https://bugs.archlinux.org/task/42134#comment128011