> its also possible to detect when someone is piping to bash (on the server) and serve a different payload. If you have a fear of your source maliciously servi

> its also possible to detect when someone is piping to bash (on the server) and serve a different payload. If you have a fear of your source maliciously serving you different code over curl, don't run their code at all. > You're better off piping curl to a file, reviewing the file and then running it manually. Right, but the safety there is reviewing the code. Running brew install, npm install, pip install, or a binary could all run malicious code too.