> USER='-f root' telnet -a localhost Seems that the same code path results from the even simpler incantation:
$ telnet -l 'root -f' server.test The user-name-with-a-space-in-it doesn't get passed as a single argument to execv(), but "helpfully" gets split back into two parts and passed to execv() as two separate entries in argv[] :-) Q. "Hey, if we call execv() directly, we'll avoid some of the risks associated with shell-style command line processing. How good is that?" A. "Hold my beer." TELNET, eh? From the days when RFCs still had just three digits...
