2mo
A lot of people are apparently happily running a script clearly marked as a root exploit from some random website using curl | bash blobsweat

Some do inspect the script, but then still run it using curl | bash anyway.
thaenkin

Incidentally, this very relevant blogpost about detecting curl | bash and serving different scripts based on that is almost exactly a decade old:
web.archive.org/web/20230318063325/https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/

17
3
1
0
User avatar
Celeste_transbian flori_ava_star:~cursor_blinkingbadge-petting-encouraged badge-biting-allowed @star@amazonawaws.com
2mo
@rysiek what's the issue with doing that? if you expect that command to run an exploit, malware, whateveryouwannacallit, and you are fine with what that may imply, then i don't quite see the issue; i more see an issue with literally any other curl | bash oneliner from random websites
:drgn_heart@not.an.evilcyberhacker.net:1
2
0
0
1

User avatar
Epic Null @Epic_Null@infosec.exchange
2mo
@star @rysiek Given the "detecting curl", I believe a good part of the issue is you should not trust the script you inspected to be the one you will be delivered, and should capture the script in an inspectable context (or curl >> file, inspect file, bash file)
0
0
0
0
2mo
@star
if you expect that command to run an exploit, malware, whateveryouwannacallit, and you are fine with what that may imply
But folks are clearly not fine with what that might imply. If this is exploit/malware, by definition it cannot be trusted. Running it directly on one's workstation means that if it is malicious, it can access all user-accessible files at the very least.

I don't believe folks running this on their workstations consider this an option, and they really should.
0
0
0
0