Comment by ycombinatrix

agreed. the real story is that people are ignoring `sub` out of convenience and creating a security hole.