Not to mention that a webserver can be configured to show one sh file when a regular browser visits and another when curl etc. gets it. Show one thing, install another.
Not to mention that a webserver can be configured to show one sh file when a regular browser visits and another when curl etc. gets it. Show one thing, install another.
So download it with curl and read it first before executing it from your local disk.
read it ? we dont do what kind of stuff here, i got my army of reader agents.
Except you can't really be sure, still: http://web.archive.org/web/20250622061208/https://www.idontp...
This is helpful to know, but also pretty general security practice. If you are auditing an artifact, only use that audited artifact after, don't assume that a network endpoint can never change what it serves. If you must use a newly downloaded artifact, verify it matches whatever you audited by comparing some sort of hash or derived value.