this post was submitted on 04 Aug 2026
737 points (98.8% liked)

Programmer Humor

32691 readers
67 users here now

Welcome to Programmer Humor!

This is a place where you can post jokes, memes, humor, etc. related to programming!

For sharing awful code theres also Programming Horror.

Rules

founded 3 years ago
MODERATORS
Feyter@programming.dev
anzo@programming.dev
BurningTurtle@programming.dev
pylapp@programming.dev
737
finally something worse then curl | sh (lemmy.blahaj.zone)
submitted 4 days ago by not_IO@lemmy.blahaj.zone to c/programmer_humor@programming.dev
131 comments fedilink hide all child comments
 

https://labyrinth.zone/objects/96478395-64d9-452c-a906-9e6159cd10a3

you are viewing a single comment's thread
view the rest of the comments
[–] Dumhuvud@programming.dev 2 points 2 days ago (1 children)

Also piping to cat seems redundant but malicious hosts can detect whether the request is getting redirected, using some clever trick, so it’s not.

Just so you know, servers cannot detect piping to any arbitrary process. The trick you're talking about is detecting piping to an interpreter, for the lack of a better term. Piping sleep N to bash is observable behaviour, for example. Piping anything to cat is not.

https://web.archive.org/web/20250622061208/https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/

[–] FishFace@piefed.social 1 points 2 days ago

Oh, I had totally forgotten how it worked! I thought it was exactly that. Thanks for the correction