On Mon, Jan 25, 2021 at 9:48 PM AJ Jordan ***@***.***> wrote: This is a security vulnerability because under an out-of-the-box Linux configuration, any user can read any process' command line arguments. That means that a local attacker would be able to see the new password as the command was being run. To prevent this lxdui user update and friends should drop their -p option and instead only accept passwords interactively or via environment variable (environment variables are secure because they do not have the same problem, and they can be used in noninteractive settings just as easily). — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#341>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ACXOWQ6LJXVAT45JLXKBYHTS3Y3PXANCNFSM4WSY5X2Q> .