Can’t resist mentioned the funny, but perhaps less than adequately prominent note to “beware of gift horses” on the Plan 9 manual page for bundle(1) [pack files into a self-extracting shell script, more or less equivalent to shar(1) on a normal Unix].

https://9p.io/magic/man2html/1/bundle

That's the wrong way to solve this. You have to assume people don't read the manual, especially for security issues.

The correct solution is that `ldd` should be safe by default, and require a `--allow-unsafe-execution` flag if it needs to actually execute code.

I think this is pretty well known these days but probably not well known enough!

Too backwards incompatible maybe, although you could add a check on whether the output is a tty, like ls does; I don't know how often ldd is used in scripts.