He could put the easter egg externally, e.g. create a page on his site that would react differently if fetched with the curl user-agent compared to all other us

He could put the easter egg externally, e.g. create a page on his site that would react differently if fetched with the curl user-agent compared to all other user agents. So all the code would be server side and it'd still be an easter egg, because you get it by entering a certain input. e.g. curl hxxps://haxx.se/something-cute-here Obviously one day someone might see that page in the browser, thinks they need to get an offline copy of it, does a curl and gets something different. But I guess that's a surprising behavior of the server and not the client. Lots of servers already do this to do a first-level filter against people who can't figure out how to set curl's user-agent...