Hacker News Reader

What security implications does running curl have that wouldn't be present in a browser?

There have been instances of terminal vulnerabilities via terminal escape codes, as bad as an RCE in iterm2: https://blog.mozilla.org/security/2019/10/09/iterm2-critical.... I suppose the OP is thinking of something like that.

Yea, I was wondering about that; but the risk feels similar to a browser RCE to me. Maybe it's higher because browsers are more widely used/analyzed; but then again, a browser RCE has a much wider range of targets with more opportunities to exploit

Even just having the potential for the terminal to interpret escape codes is frustrating. Always pipe remote output to `less` or `less -R` (not `less -r`).

And this is exactly why I’m always playing the damp squid when people advocate for more features being supported via shell escape codes.

I’m wondering the same. You’re not piping them into a shell.

Reply on news.ycombinator.com