4 ms·

You should always inspect a script before executing it. You can even pass it to AI and query the AI about it.

• trashtester 3y ago
  Agree, and especially if it's from a dubious source. Piping it directly from curl to bash makes that near impossible if you run it multiple times. Even suggesting that for something like this in the readme is a red flag to me. It's probably just a bad habit on the part of the author, but it may very well be intended to promote such unsafe practices with the intent to at least have the option to exploit it at some point later.
  • mmsc 3y ago
    >Piping it directly from curl to bash makes that near impossible if you run it multiple times. I’m not sure whether pressing the „fork” button and inspecting it in your local repository is “near impossible”.
    • trashtester 3y ago
      "near impossible" referred to the specific act re-reading the code every time you run it, which you should do if you use the exact method for executing it that is in the readme. There are many ways more competent/sane users who realize the danger can work around those. My concern is that some percentage of users are likely to follow the method in the readme to the letter, without knowing or caring about the danger. Either the author knows this (if not-> incompetent, which is not likely), doesn't care (maybe it's mostly intended for black hack hacking). Or it's actually a trap, where it's first presented as a useful tool, but where a phone home addon is injected at some point later, and able to collect massive numbers of keys before it's detected.