this post was submitted on 09 Apr 2024
126 points (94.4% liked)

Programming

17313 readers
322 users here now

Welcome to the main community in programming.dev! Feel free to post anything relating to programming here!

Cross posting is strongly encouraged in the instance. If you feel your post or another person's post makes sense in another community cross post into it.

Hope you enjoy the instance!

Rules

Rules

  • Follow the programming.dev instance rules
  • Keep content related to programming in some way
  • If you're posting long videos try to add in some form of tldr for those who don't want to watch videos

Wormhole

Follow the wormhole through a path of communities [email protected]



founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
[–] colonial 36 points 7 months ago (1 children)

Oof. Looks like this affected some other languages as well - somebody at Microsoft needs to up their documentation game, methinks.

[–] UnfortunateShort 4 points 7 months ago (1 children)

This hurts my brain. We have nice shell languages now, can we just lock down and phase out the rest please? I don't even want to know the hidden cost of running Bash or sh scripts tbh. Both are languages where you can do something not right enough, because everything just has to be obnoxious.

[–] [email protected] 3 points 7 months ago (4 children)

I won't argue with you that bash is janky and easily insecure, but what shell language do you think should replace bash?

[–] [email protected] 1 points 7 months ago

The only semi-realistic way I can see Bash becoming mostly obsolete is with a tool that provides automated migration of large scripts, and the only project I know of that's even attempting that is Oil: https://www.oilshell.org/

But for spawning a command in a subprocess, there really ought to be a standard OS API that doesn't involve invoking a shell at all. I expect that most or all implementations of posix_spawn and execve don't invoke a shell, but the standard call to start a process on Windows, CreateProcess, apparently does involve cmd.exe for some bizarre reason, and that's why this is a problem in the first place.

[–] [email protected] 1 points 7 months ago (1 children)
[–] [email protected] 7 points 7 months ago (1 children)

While there certainly is some overlap, Python is a scripting language and not a shell language. Some tasks that involve calling lots of different programs and juggling input and output streams are much easier done in bash than in Python.

[–] [email protected] 2 points 7 months ago

Absolutely true, it was more of a joke because Python is being used for pretty much anything today. I really don't want to mess with correct indentation in my terminal.

[–] [email protected] 1 points 7 months ago
[–] UnfortunateShort -1 points 7 months ago

I think fish is simply fantastic. Not only is it significantly more readable than most other shell languages, it was also recently rewritten in Rust (still in testing I think), which gives me a lot of confidence when it comes to your typical vulnerabilities.

I mean sure, a Rust vulnerability the reason we're talking, but let's not forget how valuable memory and thread safety are.