3 ms·
the problem is mainly that the script is executed without leaving a trace. if you downloaded the script then executed it, you would have something to inspect in
by slim 7y ago
the problem is mainly that the script is executed without leaving a trace. if you downloaded the script then executed it, you would have something to inspect in case something goes wrong.
it's too easy, and people with very scarce knowledge could develop a habit of doing this without asking questions and not even leaving any trace for a senior to inspect in case of a problem happening
- M4v3R 7y agoIt does leave a trace - the command executed is stored in your shell's history file, so unless a malicious script deletes the history (and it also could delete the download binary if you checkout it from a repo) anyone can immediately see what was executed.
- raimue 7y agoThe history file only contains commands typed into an interactive shell. Commands executed from a shell script or piped into sh will not end up there.
- akerl_ 7y agoIf that were the case, the best option is surely `curl | tee $(mktemp) | sh`. In the case of downloading a script and then executing it, the script has the ability to modify its own contents.