Hacker News Reader

Comment by sneak | Hacker News Reader

Do not pipe random scripts from the internet into

    | sudo bash

View on HN

This can be generalized into "do not install random programs from the internet onto your machine".

Familiarize yourself with the program, the author and the supply chain, then you can also `curl | bash` safely.

No, it has been demonstrated that servers can detect whether a request is being downloaded or piped to a shell, so they can vary the response accordingly, sending safe-looking content to a user who's inspecting it, and sending malicious content to a shell.

https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b...

`curl | sh` is a terrible anti-pattern. It should never be encouraged.

familiarizing yourself with the program, the author and the supply chain is more than just inspecting the downloaded code.

At least this one is short and easy to read.

Reply on news.ycombinator.com