> I would set up my server to serve a non-malicious script most of the time and just occasionally substitute my malware script, why not just detect the `curl |

> I would set up my server to serve a non-malicious script most of the time and just occasionally substitute my malware script, why not just detect the `curl | bash` part server-side? I'm still amazed how many FOSS projects have that as the primary installation path... https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/ https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b...