Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

PSA: Top Google Result for Claude Code Is Malicious

onemillionwords.substack.com

Post reply on HN
Print view View original

1–10 of 15 posts

Re: PSA: Top Google Result for Claude Code Is Malicious

#2

Post by walletdrainer »

Feels like the author is using Google for the first time? This has been a feature as long as the ads have.

You can literally find this exact same blog post from approximately 20 years ago. Absolutely nothing has changed since then!

Well, I lied. A lot has changed. Drive-by attacks are gone, largely thanks to Google. 15 years ago you would’ve been hacked immediately after you clicked the ad.

Re: PSA: Top Google Result for Claude Code Is Malicious

#6

Post by dngray »

One of the things which really annoys me is the idea that it's every acceptable to blindly "curl -fsSL" bullshit .sh scripts.

Even large companies have adopted this crap and you don't know whether there's any digital signing going on or whether they're downright stealing anything you have of value.

It's not difficult to generate a rpm, deb, tgz and relevant detatched .asc PGP signature or if you hate PGP use openssh signatures or something.

Re: PSA: Top Google Result for Claude Code Is Malicious

#7

Post by igor47 »

> If this how google chooses to go out, then their death cannot come fast enough.

> Alphabet (Google) reported historic financial results for fiscal year 2025 (ending Dec 31, 2025), with annual revenue surpassing $400 billion for the first time. The company showed strong profit growth, with Q4 2025 net income at $34.5 billion, a 30% increase year-over-year. Key growth drivers were AI integration, YouTube ads, and a surging Cloud segment.

Re: PSA: Top Google Result for Claude Code Is Malicious

#8

Post by igor47 »

dngray wrote: post #6

One of the things which really annoys me is the idea that it's every acceptable to blindly "curl -fsSL" bullshit .sh scripts. Even large companies have adopted this crap and you don't know whether there's any digital signing going on or whether they're downright stealing anything you have of value. It's not difficult to generate a rpm, deb, tgz and relevant detatched .asc PGP signature or if you hate PGP use openssh…

Agreed. I was using mise to install Claude (via it's npm package) and keep it updated, and then they nagged me to switch to the 'curl | bash' method. Now I get to keep it updated manually, plus they helped train all my peers to continue just executing random scripts right off the Internet

Re: PSA: Top Google Result for Claude Code Is Malicious

#9

Post by dngray »

walletdrainer wrote: post #2

Feels like the author is using Google for the first time? This has been a feature as long as the ads have. You can literally find this exact same blog post from approximately 20 years ago. Absolutely nothing has changed since then! Well, I lied. A lot has changed. Drive-by attacks are gone, largely thanks to Google. 15 years ago you would’ve been hacked immediately after you clicked the ad.

No they say there they block ads, and I do as well, so maybe they're not used to seeing this kind of crap.
Post reply on HN