8 ms·
All the attacks you described also apply to downloading and executing a file. I don't think `curl | sh` is worse in this regard.
by whyever 1y ago
All the attacks you described also apply to downloading and executing a file. I don't think `curl | sh` is worse in this regard.
- davedx 1y agoIf you download it first, you can at least eyeball what's been downloaded to check it doesn't start by installing a bitcoin miner
- geysersam 1y agoHow often do people do that when they install a package from npm, pypi, or other package repository? In practice never.
- deleted 1y ago[deleted]
- bflesch 1y agoWith a downloaded file your antivirus will run automated checks on it, you can calculate a hash signature and compare the value with others who also download the file, and you will notice if the file changes after you execute it.