insecure.shell: do not leave stderr out