You can pass an array to `IO.popen`, which is a lot safer than making a potentially insecure string.