3 ms·
https://news.ycombinator.com/item?id=6650987 https://news.ycombinator.com/item?id=6650987 https://blog.dijit.sh//don-t-pipe-curl-to-bash https://blog.dijit.sh//
by busterarm 5y ago
https://news.ycombinator.com/item?id=6650987 https://news.ycombinator.com/item?id=6650987
https://blog.dijit.sh//don-t-pipe-curl-to-bash https://blog.dijit.sh//don-t-pipe-curl-to-bash
https://sysdig.com/blog/friends-dont-let-friends-curl-bash/ https://sysdig.com/blog/friends-dont-let-friends-curl-bash/
https://www.seancassidy.me/dont-pipe-to-your-shell.html https://www.seancassidy.me/dont-pipe-to-your-shell.html
- steveklabnik 5y agoMany of the things in this link are avoided by our script. For example, that last one is made impossible by putting the contents of what is to be executed in a function, and then invoking that function at the end. If the connection closes early, nothing will be executed. The last ones are the same as any other way of downloading software that's executable, and not specific to curl | bash.