Good going using `stdout=sys.stdout`. Did you do that to avoid the deadlocks possible with `PIPE`? It might be worth a comment so we don't screw it up later. Not a security issue, though: DOS of Shove at best.