My point is that in Maemo, we're still stuck with busybox as /bin/sh, so suggesting (or considering as only one viable possibility) to half-bake a replace by installing bash, instead of putting updated (including security updates) busybox to CSSU, is a big bulls**t.

Especially, that busybox is prime example of core system package that can't be distributed in extras in sane way (the only possibility is via binary file replacement, and you could distribute whole CSSU this way... Except, that it's just plain wrong), yet it's not included in CSSU for bulls**t reasons.

Suggestions to use BASH instead were all too common during busybox-power in CSSU discussion, effectively creating TWO possible attack surfaces, instead of one. Of course bash fanatics were absolutely sure that we won't create 2nd attack surface, as bash is awesome, magic, and 100% secure - which was proven wrong, and such assumption was wrong by design (no matter how secure your software is, it's still 2nd surface for attack). Not to mention being quite unrelated and demagogic (as it's hardly argument against updating our default /bin/sh).
---

Anyway, there is a side effect to this thread, too - suddenly, I lost big portion of respect for some people, that suddenly are able to only use derivatives of "troll" in place of discussion with arguments (and even gain "thanks" for it) - and I bet that it have more to do with pan-maemo's politic, than topic at hand. Well, there is old saying about spending too much time with someone and gaining his traits - I guess some people sticked to joerg on IRC for too long. Pity, perhaps, but well, not the end of the world and s**t happens... Enough OT.

/Estel