Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Every time I see `curl ..| sh` I feel bad. It shouldn't be a norm to run a downloaded script in shell.




And especially not run the script while it's downloading. The remote server can detect timing difference (let's say the script has "sleep 30" and the buffer fills) and send a different response (really easy if using chunked encoding or HTTP2 data frames).

The script is 790 bytes, you can't fill a pipe with that.



Consider applying for YC's Fall 2025 batch! Applications are open till Aug 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: