Top all-time · #19454
Luke Spademan
Personal blog · lukespademan.com/blogprogrammingsecurity
Luke Spademan's personal blog at lukespademan.com covers programming and security. Since 2023, 4 different Hacker News readers have linked it 4 times, most often “The Dangers of Curl – Bash (2021)”. The last post was in 2021, but the archive is still widely read.
Too few sampled comments (3) to say how often HN recommends it.?
Why HN links it
HN readers link this post on the dangers of curl-piped-to-bash installs, which is about servers serving different scripts depending on how they are fetched. Commenters cite it as support for their points on script security.
Summarised by Claude from a sample of 3 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- The Dangers of Curl – Bash (2021)4 people · 4 mentions · first linked 2023-09-27
What Hacker News says?
> in a reasonably secure fashion It's trivial for a remote server to hand two different versions of a script with the traditional `curl | bash` pipeline. https://lukespademan.com/blog/the-dangers-of-curlbash/ There is 0 validation that the script that you are piping into bash is the script that you expect. Even just validating the command by copying and pasting the URL in a browser -- or using curl and piping into m…
Comment linking /blog/the-dangers-of-curlbash/
on “Microsoft Edit”Submitted The Dangers of Curl – Bash (2021) as a story · 2 points
HN discussion> Using curl is surprisingly secure one thing to remember is that you can make a server respond one thing when a user does "curl <url>" and another thing when the users does "curl <url> | sh": https://lukespademan.com/blog/the-dangers-of-curlbash/ another thing to know is that github.com/<org>/<proj>/[...somethings...] isn't necessarily controlled by <org>: https://vulcan.io/blog/github-comment-malware-what-you-need…
Comment linking /blog/the-dangers-of-curlbash/
on “Show HN: ffmpeg-english "capture from /dev/video0 every 1 second to jpg files"”It can be detected if your adversaries are clever enough: https://lukespademan.com/blog/the-dangers-of-curlbash/
Comment linking /blog/the-dangers-of-curlbash/
on “The Philips Hue ecosystem is collapsing into stupidity”