3 ms·
That's too much work. It would be easier to just tell them to curl | sh and put all your malicious stuff in the script. That way they won't actually see anythin
by maratd 11y ago
That's too much work. It would be easier to just tell them to curl | sh and put all your malicious stuff in the script. That way they won't actually see anything malicious on their screen.
- redthrowaway 11y agoThat requires more stupidity on the target's part. I think most devs know not to `curl | sh` random scripts, but something as innocuous as `ps -ef | grep /some/longish/annoying/path/to/script` would seem both safe at first glance and long enough to want to avoid typing.
- kbutler 11y agoDo you download binaries? Do you build or install projects you've downloaded? Those have the same risk as curl|sh
- redthrowaway 11y agoWith both binaries and curl|sh, trust in the source is a major factor in whether or not you do it. But copying an innocuous-looking terminal command (like `ps | grep`) doesn't seem like it would require trust. I'll absolutely grab a binary or `curl | sh` from slack.com. I won't do it from a forum. But I would copy a terminal command that didn't look like it was doing anything fishy from a forum.
- jacquesm 11y agoFor a long time I had the bash fork bomb without any further explanation as my signature line on /, I'd just about forgotten about it when I got a really angry email from someone telling me that I'd blown up his server and thanks very much for that.