An unmodified curl invocation does not require weird timing based attacks, it sends an appropriate user-agent header the server can use (and which the article already adresses).
by detecting the usage of `curl | bash` you can serve a different script only when someone does it, so someone doing `curl -O /tmp/some_script.sh` to audit the script wont see the harmful code.
It opens you up to a literally undetectable attack.
nonetheless, the point of the article author does have some truth. there is always a degree of trust involved when you're installing binaries from a third party. by using curl|bash you're just increasing the required trust a bit.
This is the crux of it for me. This is why it is dangerous. The author appears to have overlooked this attack vector entirely.
curl | bash -xThis has all been mentioned in the linked comment thread
Good point about -x being fallible to an adversarial script, even a simple set +x would be enough!
Where's the link where this has been mentioned? I missed it.
0: https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b...