It's been demonstrated that the server can tell if the client is piping or not https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/ htt

It's been demonstrated that the server can tell if the client is piping or not https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/ https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b... I'm on mobile and this refuses to load due to SSL/HSTS problems. It's an interesting approach if you can get it to load. Point being... someone clever could make a bad day for the minority of users who do check first (but don't save/run what they explicitly checked) Running curl, saying "yup that looks good", then adding a pipe achieves little with actual malice. The payload can be completely hidden until it's too late The phrasing you use is important for any hope at safety - review/run the same downloaded thing.