> $ curl -fsSL install.sh | sh # you'd be stupid to run that, slop or not I wish more people would point this out.
I still haven’t seen anyone point out how this is more dangerous than running an executable that you obtain any other way.
Every fucking website: 2026 edition
21–30 of 36 posts
Re: Every fucking website: 2026 edition
#22> $ curl -fsSL install.sh | sh # you'd be stupid to run that, slop or not I wish more people would point this out.
I still haven’t seen anyone point out how this is more dangerous than running an executable that you obtain any other way.
you can detect `curl | bash` server-side and serve a different payload for those (compared to curl -O file, wget etc), hence its an effectively undetectable attack vector.
Executables on the other hand can be inspected and prodded, so the likelihood of something going amiss and consequently security agencies finding out about it is significantly higher.
neither of those is secure of course, we're just discussing different levels of dangers. And curl|bash being worse, albeit not that much
(and the -L here is the extra cherry on top. piping a redirect to a shell is just monkas)
Re: Every fucking website: 2026 edition
#23What is wrong with this layout?
Re: Every fucking website: 2026 edition
#24Needs a cookie banner, 3s delayed sign up to our newsletter and enable push request
Re: Every fucking website: 2026 edition
#25What is wrong with this layout?
There's nothing wrong with it, per se. It's just that it's overused and filled with random garbage stats that no one cares about.
Re: Every fucking website: 2026 edition
#26It's missing the captcha that fails to load and then makes you retry three times.
Re: Every fucking website: 2026 edition
#27This is almost exactly this website [0] which is also on the frontpage of HN. Wow. 0: https://news.ycombinator.com/item?id=49297469
I was searching for the logo like an *-hole, but I had to settle for their "men's public restroom" logo instead.
Re: Every fucking website: 2026 edition
#28This is almost exactly this website [0] which is also on the frontpage of HN. Wow. 0: https://news.ycombinator.com/item?id=49297469
And this one, which is on the front page right now:
Re: Every fucking website: 2026 edition
#29> $ curl -fsSL install.sh | sh # you'd be stupid to run that, slop or not I wish more people would point this out.
I still haven’t seen anyone point out how this is more dangerous than running an executable that you obtain any other way.
Because this way does not run security scanners.
Re: Every fucking website: 2026 edition
#30Earlier quoted context omitted.
I still haven’t seen anyone point out how this is more dangerous than running an executable that you obtain any other way.
you can detect `curl | bash` server-side and serve a different payload for those (compared to curl -O file, wget etc), hence its an effectively undetectable attack vector. Executables on the other hand can be inspected and prodded, so the likelihood of something going amiss and consequently security agencies finding out about it is significantly higher. neither of those is secure of course, we're just discussing diff…
> you can detect `curl | bash` server-side
Oh wow, ok. So if anything, manually do `curl` and `sh` separately?