i didn’t think it was physically possible, but there’s finally something worse than curl | sh
ALT
Replying to @Rairii@labyrinth.zone
@Rairii i never understood how curl | sh was worse than just downloading a script and running it tbh .. seems to do the exact same thing
@Li someone did a poc once showing how curl piping into a shell could be detected serverside compared to directly downloading a script, not sure if that's still true though
Replying to @Rairii@labyrinth.zone
@Rairii @Li probably still true
Every program that downloads from the internet sends a user-agent header to the server, normally it's program name, version & a bit more text.
A server could use that to detect curl & send a malicious install script that's different from if you downloaded it with Firefox
Replying to @patterfloof@meow.social
@patterfloof @Li it was specifically the piping being detected, found the post again and its over 10 years old https://web.archive.org/web/20160419194042/https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/
web.archive.orgDetecting the use of "curl | bash" server side | Application SecurityAnother reason not to pipe from curl to bash. Detecting curl | bash serverside.