this post was submitted on 04 Aug 2026
735 points (98.8% liked)
Programmer Humor
32678 readers
208 users here now
Welcome to Programmer Humor!
This is a place where you can post jokes, memes, humor, etc. related to programming!
For sharing awful code theres also Programming Horror.
Rules
- Keep content in english
- No advertisements
- Posts must be related to programming or programmer topics
founded 3 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
If you trust the site,
curl | shis no worse than any other install method. If you don't trust the site, it's also no worse.that's why you install from repos managed by people you trust, it's like an app store without all the evil
yeah you can also just curl > cat and check the script yourself
🐱.sh
Relevant
Huh, nifty.
Do you mean
curl | cator do you really want to create a file called cat?Also piping to cat seems redundant but malicious hosts can detect whether the request is getting redirected, using some clever trick, so it's not.
Also, your chance of spotting something bad in a malicious script is probably quite small.
Just so you know, servers cannot detect piping to any arbitrary process. The trick you're talking about is detecting piping to an interpreter, for the lack of a better term. Piping
sleep Ntobashis observable behaviour, for example. Piping anything tocatis not.https://web.archive.org/web/20250622061208/https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/
Oh, I had totally forgotten how it worked! I thought it was exactly that. Thanks for the correction
Saving it to a file is actually a decent method, since you can be sure the script you're reviewing is the same one you're running.
Personally I often will just manually run the install steps in order if the script is simple enough. Half the time it's just a bunch of OS version checks followed by a tar -xf
This is my opinion on
curl | sh/bashtype directions. If the maintainers don't provide a hash so I can confirm that is what they intended, there ain't much I can do unless someone slapped in a function named "totallyNotMalware" into the script. I've looked through scripts, seen what they do, but I'm not good enough to recognize anything funky.If you just run the file you just created, it doesn't matter that they detected a redirect. I mean it would be a bit silly to download a script, check it, and then re-download it to pipe into bash.
Downloading a two kilobyte script a second time is probably less effort than remembering to rm the script after running it, so if you don't want to keep it, it could be better :)
or just curl