3 ms·
The difference is that "curl | bash" doesn't save the output and can be distinguished server-side from commands that do <https://news.ycombinator.com/item?id=34
by josephcsible 2y ago
The difference is that "curl | bash" doesn't save the output and can be distinguished server-side from commands that do <https://news.ycombinator.com/item?id=34145799 https://news.ycombinator.com/item?id=34145799>, so it's an especially easy way for a malicious server to undetectably have you run something different from what you've looked over.
- chowells 2y agoSo you're saying it's exactly the same as binary installers, which frequently download additional components during installation?
- josephcsible 2y agoWhen binary installers download additional components, they usually do so in a way indistinguishable server-side from downloading a file to analyze.
- chowells 2y agoHonest ones, sure. Why would a malicious one leave behind evidence of its malicious behavior? The threat model is identical.
- josephcsible 2y agoBut that behavior would be noticeable in the original download, which would be evidence itself.