3 ms·
The threat model is exactly the same as executing untrusted, uninspected content you've downloaded locally. I could do some tricks where I sent different files
by nailer 3y ago
The threat model is exactly the same as executing untrusted, uninspected content you've downloaded locally.
I could do some tricks where I sent different files based on user agent, but still... most people aren't inspecting the download anyway before running it.
- im3w1l 3y ago> I could do some tricks where I sent different files based on user agent Not from githubusercontent you couldn't. Which I'd say is where the majority of these scripts are hosted.
- bravetraveler 3y agoIt's been demonstrated that the server can tell if the client is piping or not https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/ https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b... I'm on mobile and this refuses to load due to SSL/HSTS problems. It's an interesting approach if you can get it to load. Point being... someone clever could make a bad day for the minority of users who do check first (but don't save/run what they explicitly checked) Running curl, saying "yup that looks good", then adding a pipe achieves little with actual malice. The payload can be completely hidden until it's too late The phrasing you use is important for any hope at safety - review/run the same downloaded thing.