EDIT found link http://seclists.org/fulldisclosure/2014/Nov/74 http://seclists.org/fulldisclosure/2014/Nov/74 Basically the tldr is that gnu less is a program

EDIT found link http://seclists.org/fulldisclosure/2014/Nov/74 http://seclists.org/fulldisclosure/2014/Nov/74 Basically the tldr is that gnu less is a program that has been engineered to do a lot of things over the years and this has created attack surfaces which mean that if someone was to curl .... | less on a carefully designed payload it could allow the payload to obtain a shell. I wasn't saying that it isn't safer just that it isn't totally safe.