4 ms·
The site could detect that it's invoked as part of a `curl | bash` and sometimes serve a different script than you would get if you manually downloaded the scri
by ben0x539 4y ago
The site could detect that it's invoked as part of a `curl | bash` and sometimes serve a different script than you would get if you manually downloaded the script or the installer for manual inspection/auditing, making it harder to detect shenanigans. I think someone wrote this up as a PoC/blog post at some point.
- IshKebab 4y agoA binary that you download could be obfuscated to make it hard to audit. A site could offer different binaries to different people, locations, times of day, user agents, etc. That's not really a realistic risk.
- ben0x539 4y agoIt's not so much script vs binary, but once everybody downloads a file they can compare them to make sure they're getting the same file.
- IshKebab 4y agoYou can download the script using curl and then inspect it and run it if you really want?
- ben0x539 4y agoAnd then we get to what I was trying to state in my original post. I don't have a strong opinion that it's good or bad practice, I just thought it was a clever thing to do about it. Edit: I think I was thinking of https://news.ycombinator.com/item?id=17636032 https://news.ycombinator.com/item?id=17636032 / https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/ https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b.... Wow, it's been a while.