The tilde in your PATH may not be your HOME(disconnect3d.pl)
247 points by arusekk 2 days ago | 176 comments
tl;dr: Using `export PATH="$PATH:~/.local/bin/"` (with quotes) in your shell config doesn't expand `~` to your home directory—instead, it literally adds `./~/.local/bin/` to your PATH, which can be a security risk since binaries placed in that relative path will be executed. The fix is to use `$HOME` instead of `~`. You can audit your setup with `echo "$PATH" | grep -- '~'`.
HN Discussion:
  • ~Just don't quote the tilde; the issue stems from unnecessary over-quoting habits
  • ↑Avoid tilde in scripts entirely and use $HOME instead
  • ↑Bash's quoting/escaping rules are absurd and not worth learning
  • ↑Shells should have a strict mode to validate PATH entries and prevent such issues
  • ↓The problem would be obvious since the PATH entry wouldn't work in the first place