Comment by nkrisc | Hacker News Reader

Comment by nkrisc | Hacker News Reader

Parent Full thread

Right, I understand. My point is that if they're going to mention cURL, but then describe it as "a command-line tool that transfers data using HTTP, HTTPS, IMAP, and other common Internet protocols." why not just say the attack can be executed directly from the command line? Any techincally literate audience will understand that implies cURL (or any other tool!) and an non-technical audience will understand its simplicity, if that is in fact the case.

I still think it's strange to mention cURL specifically in the way they did and agree with the GP. Here's another terrible analogy for the HN archives, but it's kind of like saying, "the smash-and-grab on the jewel store can committed with a Stanley™ 16 oz Curved Claw Fiberglass Hammer" when of course any heavy, handheld object will do.

> why not just say the attack can be executed directly from the command line? Any techincally literate audience will understand that implies cURL (or any other tool!) and an non-technical audience will understand its simplicity, if that is in fact the case.

I mean, the normal way to use curl for this kind of thing is to define the request you want to send in a file and tell curl to read the file. There's no requirement -- or implication -- of simplicity in an attack that "you can execute from the command line"; that description refers to every possible attack. It's meaningless. There's nothing you can do that you can't do from the command line.

Yes, so why mention cURL at all?

I'm not saying there's a reason to mention curl. I'm saying the explanation given makes no sense.

cURL has above-average name recognition. It's like mentioning a Dremel tool instead of a handheld rotary tool.

> cURL has above-average name recognition.

It might to you and people in your circle, but that's not the entire audience of the article. I wouldn't assume everyone knows what a Dremel is either.

Reply on news.ycombinator.com