173
A sneaky demonstration of the dangers of curl bash (blog.k3can.us)
submitted 8 months ago by to c/selfhosted@lemmy.world
70 comments fedilink hide all child comments
 

I set up a quick demonstration to show risks of curl|bash and how a bad-actor could potentially hide a malicious script that appears safe.

It's nothing new or groundbreaking, but I figure it never hurts to have another reminder.

you are viewing a single comment's thread
view the rest of the comments
[–] 1 point 8 months ago (1 child)

the difference though is you can check a script. if it’s an open source project, you can also compile from source. but I get what you mean

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 4 points 8 months ago

    You can, but to me it seems weird to say it's crazy to pipe to bash when people happily run binaries. If anything, the convenience script is lower risk than the binary since people have probably checked it before you.

    I wouldn't pipe a random script to bash though, nothing where I wouldn't trust the people behind it.

  • permalink
  • fedilink
  • source
  • parent