I once used it to change the user-agent and get an alternative response from an API.

badass...

I presume the author of the comment is refferring to incidents such as https://daniel.haxx.se/blog/2010/12/23/hacking-me/

If you write a general-purpose utility and it gets included in some kind of bad software, the people writing the 'bad' parts aren't likely to include their details, but if your 'good' code has your details....

I mean, I've personally used it to access APIs from shell scripts that would have been far more maintainable in a proper Python script.

That's three counts of conspiracy to degrade system maintainability, manufacturing tooling with intent to degrade system maintainability, possession of tooling to degrade system maintainability, one count of international travel with intent to degrade system maintainability, two counts of manufacture of false documents[0][1] in support of a conspiracy. Bail denied. And... that's life.

[0] Exhibit A: man curl

[1] CURL website

You monster!

If an attackers rouge process lands itself on a target, using something trusted like cURL is better than opening a socket directly, no? Less likely to attract attention?

Same goes for wget, links, etc.

Sorry no sources, it won't take you long to verify this yourself using google. I'm sure there are competent infosec guys and gals here who can provide a better explanation.

rogue, not rouge.

"I once saw him kill three men in a bar with a pencil, with... a... f#@king... pencil." © John Wick

curl -i -X POST http://SOME_TERRIBLE_WEBSITE/api/people/SSN/kill