tgt

joined 2 years ago
[–] tgt@programming.dev 10 points 2 weeks ago (1 children)

What, do you mean to tell me that random chances are not influenced by God? We call it RNGesus for a reason. /s

[–] tgt@programming.dev 5 points 1 month ago

Or the over 3.6 million people in the territories of the US.

[–] tgt@programming.dev 1 points 6 months ago (1 children)
[–] tgt@programming.dev 8 points 7 months ago

People still name their sons Richard...

[–] tgt@programming.dev 3 points 8 months ago

I guess it's you and 255 others?

[–] tgt@programming.dev 2 points 8 months ago

So parel is actually feminine and and meisje is gender-neutral.

[–] tgt@programming.dev 2 points 11 months ago (1 children)
[–] tgt@programming.dev 2 points 1 year ago (1 children)

See the proof of concept for the pipe detection mentioned elsewhere in the thread https://github.com/Stijn-K/curlbash_detect . For that to work, curl has to send to stdout without having all data yet. Most reasonable scripts won't be large enough, and will probably be buffered in full, though, I guess.

Thanks for the laugh on the package installer, haha.

[–] tgt@programming.dev 2 points 1 year ago (3 children)

So I was wondering what the flags do too, to check if this is any safer. My curl manual does not say that -f will not output half downloaded files, only that it will fail on HTTP response codes of 400 it greater... Did you test that it does not emit the part that it got on network error? At least with the $() that timing attack won't work, because you only start executing when curl completes...

[–] tgt@programming.dev 14 points 1 year ago (2 children)

What's that? A connection problem? Ah, it's already running the part that it did get... Oops right on the boundary of rm -rf /thing/that/got/cut/off. I'm angry now. I expected the script maintainer to keep in mind that their script could be cut off at litterally any point... (Now what is that set -e the maintainer keeps yapping about?)

Can you really expect maintainers to keep network error in mind when writing a Bash script?? I'll just download your script first like I would your binary. Opening yourself up to more issues like this is just plain dumb.