Tweet
Originally posted by interested
View Post
-
Oh, some of them try. But they usually give up once they realise just how much work they're looking at. -
I know that dash isn't bash compatible. So unless you ready to do some porting work....
Personally, I just program in Bourne shell... then it doesn't really matter (well bash isn't fully Bourne shell compatible and likely there are some minor issues with other shells as well... but in general it works!)Comment
-
-
-
Considering that there are really only 6 big, general purpose root distros, and half of them AREN'T huge, bloated messes, I don't think this holds up.Originally posted by Luke_Wolf View Post
If your world is only Debian/RH/SUSE, I feel sorry for you.Comment
-
The important thing is dash is /bin/sh compatible. Maybe more so than bashOriginally posted by cjcox View PostComment
-
I don't see how you count 6,Originally posted by Scimmia View Post
sure if you want to go overly simplistic there's: Debian, Red Hat, SUSE, but there's also Maegia, Slackware, Gentoo, and Arch, which makes 7.
If we want to go how things actually play out there's: Debian, Ubuntu, RHEL, Fedora, openSUSE, SLES, Maegia, Gentoo, Arch, and Slackware makes 10.
And just for the record Slackware has 5 shells installed:
ash, bash, tcsh, ksh, and zsh.
Which means you're left with.... Gentoo and Arch...Comment
-
It is an almost irrational reaction! I mean really this BASH fault was found during an apparent regroups review by some people at RedHat, are other shells so reviewed. Even a strong effort to review for security issues may mis holes so even after this update do we really have 100% confidence.
Personally I like BASH. The only good reason I can see to get rid of it is to transistor to a product not bound up with GPL 3. Most people won't even think that that is a good reason (eventually they will learn).
An alternative that might make a lot of sense is an all new shell built with modern programming techniques and C++. Of course many would reject that idea simply because of C++.
I think the only thing that needs to be bashed here is the knee jerk feel of the reactions that lead to this proposal. Hey if they can demonstrate that an alternative shell is significantly more secure, not an easy thing to do, then it might be a justification. However I'm left with the impression that people just "think" that the alternative shells are more secure. This is not a wise move. Any switch to a new shel would require that that shell be reviewed as rigorously as BASH or built from the ground up to be secure.Originally posted by Adarion View PostIt is interesting to see how people suddenly are fleeing towards other shells. But does that really make sense? Nobody can assure you that other shells don't have similar problems. After some mass use they might exhibit also flaws and defects. Or does any of those have regular code audits?
I'm not into any shell bashing (no pun
) but it's interesting to see people's reactions.Comment
-
Not exactly! There is no reason to believe a minimal shell is more secure if it hasn't been written to be secure and hasn't gone through extensive reviews for security issues. Maybe one or more of these alternative shells has a good development process that gives you confidence but even so I see it as reckless to adopt a new she'll without thorough testing and audits.Originally posted by RahulSundaram View Post
Well there have been a few silly comments here but for the most part the people seeing this as an over reaction or a case of moving to fast, to be of the right mind set.
Probably just phoronix infested by silly comments.
As a side note; in the sailing world there is a concept that you should never leave a large boat for a smaller one at see if you don't have to. There have been numerous instance where people thought the boat was sinking and decided to move to a life raft/dingy or whatever and died or suffered significantly while the boat they abandoned sailed on without sinking.
Now is this concept applicable to BASH and its usage as a system shell? This likely could be a huge debate but do we really want a world where things like shell are never enhanced or improved? Don't get me wrong being POSIX compliant is good but maybe there needs to be more effort put in moving the standard forward.
By the way not relying upon sell scripts is actually a good idea. You will be fighting years of UNIX/Linux experience to get other developer to see the positives in reducing shell script usage. It is almost funny that one of the justifications for the move to DASH is the faster execution environment, which to me implies that maybe interpreting scripts is the wrong approach if performance is a problem. Maybe what the development world needs to look at is a set of C or C++ libs that make writing quick apps that can handle common shell like operations easily. These days building a compiled app isn't that much slower than writing a shell script, so time is no longer a factor. Give the user a library that makes writing these sort of apps easy and you sove your bash performance and security issues.Comment
-
You're counting Mageia as a major root distro now? Last I knew, it was a RH derivative. Whatever, never was a Mandrake fan.Originally posted by Luke_Wolf View Post
And a basic install of Slack does not have 5 shells installed. You can, of course, choose to install them, but you can on any of the other distros as well. There are only 2 shells in package group A: Bash and tcshComment
Comment