2 ms·
did you access that url with curl to make sure it does no user agent sniffing? how do you know the script is the same on subsequent requests?
by hnha 13y ago
did you access that url with curl to make sure it does no user agent sniffing?
how do you know the script is the same on subsequent requests?
- akane 13y agoYou can always `curl`, then `cat | sh` if you don't trust me :)
- bcoates 13y agoIt's an https request to GitHub, which has about a million more subtle ways to own your machine if they really wanted to. Figuring out how to solve the TOCTOU problem for a small script in a source control repo is should not be difficult for anyone actually qualified to tell if a script is evil or not by looking at it.