3 ms·
Bad actors can detect if its being piped to bash and send different data. Better to just download the script first if you're concerned.
by Evidlo 3y ago
Bad actors can detect if its being piped to bash and send different data. Better to just download the script first if you're concerned.
- selcuka 3y agoHow can you detect where someone pipes the output of curl output to?
- pests 3y agoBasically, bash executes the script line by line as it is downloading - pausing the download while that line executes. By sending a sleep() command early in the script you can detect the delay in the next line beind downloaded. Its a lot more complicated due to TCP buffers and trying to hide output from the user. Original article below. It is giving me a certificate error though but its available through archives or a cache. https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/ https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b...
- dopidopHN 3y agoThat what I meant but I had no idea about piping detection at the same time so thanks for pointing that out, nifty.