this post was submitted on 04 Aug 2026
373 points (99.0% liked)

Programmer Humor

32614 readers
1419 users here now

Welcome to Programmer Humor!

This is a place where you can post jokes, memes, humor, etc. related to programming!

For sharing awful code theres also Programming Horror.

Rules

founded 3 years ago
MODERATORS
Feyter@programming.dev
anzo@programming.dev
BurningTurtle@programming.dev
pylapp@programming.dev
373
finally something worse then curl | sh (lemmy.blahaj.zone)
submitted 7 hours ago by not_IO@lemmy.blahaj.zone to c/programmer_humor@programming.dev
61 comments fedilink hide all child comments
 

https://labyrinth.zone/objects/96478395-64d9-452c-a906-9e6159cd10a3

you are viewing a single comment's thread
view the rest of the comments
[–] Unleaded8163@fedia.io 29 points 6 hours ago (1 children)

If you trust the site, curl | sh is no worse than any other install method. If you don't trust the site, it's also no worse.

[–] kayzeekayzee@lemmy.blahaj.zone 2 points 4 hours ago (3 children)

yeah you can also just curl > cat and check the script yourself

[–] FishFace@piefed.social 6 points 4 hours ago (1 children)

Do you mean curl | cat or do you really want to create a file called cat?

Also piping to cat seems redundant but malicious hosts can detect whether the request is getting redirected, using some clever trick, so it's not.

Also, your chance of spotting something bad in a malicious script is probably quite small.

[–] cenzorrll@piefed.ca 4 points 4 hours ago

This is my opinion on curl | sh/bash type directions. If the maintainers don't provide a hash so I can confirm that is what they intended, there ain't much I can do unless someone slapped in a function named "totallyNotMalware" into the script. I've looked through scripts, seen what they do, but I'm not good enough to recognize anything funky.

[–] not_IO@lemmy.blahaj.zone 2 points 3 hours ago

or just curl