That would indeed be more precise, but it would be harder to obfuscate. If I simply curl the script (without piping to bash), I'd be less suspicious if I saw a

That would indeed be more precise, but it would be harder to obfuscate. If I simply curl the script (without piping to bash), I'd be less suspicious if I saw a sleep than I would be if I saw a callback to a server.