3 ms·
Every time I see `curl ..| sh` I feel bad. It shouldn't be a norm to run a downloaded script in shell.
by zx8080 1y ago
Every time I see `curl ..| sh` I feel bad. It shouldn't be a norm to run a downloaded script in shell.
- zekica 1y agoAnd especially not run the script while it's downloading. The remote server can detect timing difference (let's say the script has "sleep 30" and the buffer fills) and send a different response (really easy if using chunked encoding or HTTP2 data frames).
- GoblinSlayer 1y agoThe script is 790 bytes, you can't fill a pipe with that.