I set up a quick demonstration to show risks of curl|bash and how a bad-actor could potentially hide a malicious script that appears safe.

It's nothing new or groundbreaking, but I figure it never hurts to have another reminder.

you are viewing a single comment's thread
view the rest of the comments
[–] 31 points 8 months ago (2 children)

And you better inspect and execute a downloaded copy, because a malicious actor can serve a different file for curl/wget than to your browser

  • source
  • parent
  • hideshow 2 child comments