Re: ImageMagick Is On Fire -- CVE-2016-3714

[Tim <tim-security () sentinelchicken org>]

> Or, replace the strings with arrays and use execve() instead of system().
 
^^^

That.

system() should be taken out into the street and shot.  There's just
no good reason for a respectable programmer to use it.

Not saying that's the *only* thing they would need to do, but we need
to encourage development platforms, in general, to stop offering up
awful interfaces like this.  Heck, Node.js offers a child_process.exec()
call that isn't exec at all.  It is (approximately) system().  Surely
that won't lead to any problems...

tim