This is helpful to know, but also pretty general security practice. If you are auditing an artifact, only use that audited artifact after, don't assume that a network endpoint can never change what it serves. If you must use a newly downloaded artifact, verify it matches whatever you audited by comparing some sort of hash or derived value.
The remote server is able to determine whether you are fetching the script using curl/browser or piped directly into bash. I don't remember the magic by heart, but the blog post conclusion was essentially that you can't / shouldn't blindly trust which scripts you pipe straight into bash from the internet, because even if it looks correct in a browser, the script you might end up running could be different.
It's more of a "this is possible" than "this is a real concern", of course.
read it ? we dont do what kind of stuff here, i got my army of reader agents.
Except you can't really be sure, still: http://web.archive.org/web/20250622061208/https://www.idontp...
This is helpful to know, but also pretty general security practice. If you are auditing an artifact, only use that audited artifact after, don't assume that a network endpoint can never change what it serves. If you must use a newly downloaded artifact, verify it matches whatever you audited by comparing some sort of hash or derived value.
The link won’t load for me, but I’m having a hard imagining how a remote server could change a file on your hard drive.
Is it about deceptive commands that look like they’ll do something different using weird characters to alter what commands run or something?
The remote server is able to determine whether you are fetching the script using curl/browser or piped directly into bash. I don't remember the magic by heart, but the blog post conclusion was essentially that you can't / shouldn't blindly trust which scripts you pipe straight into bash from the internet, because even if it looks correct in a browser, the script you might end up running could be different.
It's more of a "this is possible" than "this is a real concern", of course.
4 replies →