Wouldn't the obvious solution be to throw a captcha in-front of the download?
Or am I missing the fact that this exact download path needs to be directly accessible by package managers or something?
Or am I missing the fact that this exact download path needs to be directly accessible by package managers or something?
It may not be ideal but you could certainly put some form of authentication in front of the Windows downloads or force token generation via the Web site to download the executable.
The question is whether that's a good idea - as mentioned, it's not cURL's responsibility to prevent malicious usage, but perhaps being a little more cautious about the acquisition of cURL in the first place for Windows users might not be seen as an intrusion.