TL;DR
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
A report published by Disconnect3d on Oct. 2 explains that putting a quoted tilde path such as “~/.local/bin” in PATH does not expand it to a user’s home directory in Bash or Zsh. Use “$HOME/.local/bin” instead, and check PATH for entries containing a literal tilde.
A report published by Disconnect3d on Oct. 2 warns that adding a quoted “~/.local/bin” entry to PATH in a Bash or Zsh startup file may not point to the user’s home directory. The tilde can remain a literal character, causing the shell to look for programs in a relative directory named ./~/.local/bin instead.
The issue arises in a line such as export PATH="$PATH:~/.local/bin/". Because the tilde is inside double quotes, it is not expanded into the home directory in this usage. Disconnect3d says the result is a PATH entry containing the literal ~/.local/bin/, rather than an absolute path such as /home/user/.local/bin/.
The report describes noticing the problem after the nono agent sandboxing tool warned that a PATH entry it could write to was listed as ~/.local/bin/. In a demonstration, Disconnect3d created a directory literally named ~ in the current directory, placed an executable inside it, and ran that executable using a PATH value containing the quoted tilde. The example shows the shell can find a program under that relative directory; it does not involve the user’s home directory.
Disconnect3d recommends using export PATH="$PATH:$HOME/.local/bin/". The post also notes that an unquoted assignment such as export PATH=$PATH:~/.local/bin works in Bash and Zsh because those shells perform tilde expansion in certain assignment positions, including after a colon. The author describes relying on that behavior as fragile, since adding whitespace can disrupt the assignment.
A PATH Entry Can Point Locally
PATH tells a shell which directories to search when a user enters a command. If a startup file adds a quoted tilde without expanding it, the apparent home-directory shortcut can instead refer to a directory named ~ relative to the current working directory. That can make a command unavailable when expected, or lead the shell to run a different executable if one exists in that relative location.
The report’s example also has a security implication: the nono warning concerned a directory the sandbox could write to. A PATH entry that resolves somewhere unexpected may affect which executable is selected. The post does not establish that this configuration has caused an attack or that every environment is exposed; it illustrates why users and tool developers should verify what a PATH entry resolves to rather than infer its meaning from the printed tilde alone.
For readers, the practical step is straightforward: use $HOME in quoted PATH assignments, and inspect any existing entries that still contain a tilde. The warning is relevant to shell configuration in Bash and Zsh, but it does not mean every use of tilde in every shell command behaves the same way.
As an affiliate, we earn on qualifying purchases.
How Shell Tilde Expansion Works
In Bash, tilde expansion applies when a word begins with an unquoted tilde in specified positions. The Bash documentation cited in the report also describes expansion in variable assignments after the first equals sign and after a colon. Those rules explain why an unquoted assignment can work even though a quoted tilde in a similar-looking PATH assignment does not.
This distinction is easy to miss because quotes are commonly used to protect values in shell commands, and ~ is widely used as shorthand for a home directory. But quoting changes how the shell processes the character. In the report’s example, "$PATH:~/.local/bin/" preserves the tilde as text, while "$PATH:$HOME/.local/bin/" explicitly supplies the home-directory value.
Disconnect3d suggests checking PATH with echo "$PATH" | grep -- '~', or displaying entries separately with echo "$PATH" | tr ':' '\n' | grep '~'. Any result is a prompt to inspect the relevant .bashrc, .zshrc or .profile; it does not by itself prove that the entry is harmful or that the same configuration is loaded in every session.
““So instead of having /home/
/.local/bin/ added to PATH we end up with ./~/.local/bin/ added to PATH.”” — Disconnect3d, in the report
As an affiliate, we earn on qualifying purchases.
Scope of the PATH Warning
The report documents a specific configuration pattern and a demonstration, but does not provide data on how many users have it in their startup files. It also does not identify affected systems beyond the Bash and Zsh behavior described, or report that a user suffered harm because of the issue. The impact depends on the actual PATH value, the current working directory, and whether a matching executable exists in the directory the shell searches.
The post says a contribution to make nono’s warning more verbose was forthcoming, but provides no later status for that work. It also does not independently test other shells or every way PATH can be assembled. Readers should treat the shell-specific explanation as the scope of the report, not as a claim that all shells process tilde characters identically.
As an affiliate, we earn on qualifying purchases.
Check and Correct Startup Files
Users who want to check their current PATH can run the commands given in the report and inspect any output for a literal tilde. If an entry comes from a shell startup file, the recommended change is to replace the tilde with $HOME in the assignment, then start a new shell and check the resulting PATH again. Which file needs editing depends on the user’s shell and setup.
Disconnect3d said a pull request to improve the nono warning was planned; the source material does not confirm whether it was submitted or merged. The immediate next step for readers is to verify their own configuration rather than assume the warning applies to every machine.
As an affiliate, we earn on qualifying purchases.
Key Questions
Does a quoted tilde in PATH always mean the home directory?
No. In the quoted assignment described by Disconnect3d, the tilde is not expanded, so it can remain a literal character in the PATH entry.
What should I use instead of a quoted tilde?
Use $HOME, as in export PATH="$PATH:$HOME/.local/bin/". That explicitly inserts the home-directory value.
How can I check whether PATH contains a tilde?
The report suggests echo "$PATH" | grep -- '~'. To display entries on separate lines, use echo "$PATH" | tr ':' '\n' | grep '~'. A match means you should inspect the entry and its source.
Can a shell still run a program from a literal-tilde directory?
Yes. The report’s demonstration shows a program can be found under a directory literally named ~ relative to the current directory when that relative path is in PATH. That is different from running a program from the user’s home directory.
Source: hn
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
