I set up a quick demonstration to show risks of curl|bash and how a bad-actor could potentially hide a malicious script that appears safe.

It's nothing new or groundbreaking, but I figure it never hurts to have another reminder.

you are viewing a single comment's thread
view the rest of the comments
[–] 3 points 8 months ago (2 children)

I'm a bit lost with

a more cautious user might first paste the url into the address bar of their web browser to see what the script looks like before running it. In the

You... You just.... You just dump the curl output to file and examine that and then run it if its good

Just a weird imagined sequence to me.

  • source
  • hideshow 2 child comments