Re:Zellij: A terminal workspace with batteries included
by tslocum on Friday August 12, 2022 @07:56PM
(#32445385)
This actually doesn't protect you the way you think it does. Using a simple check of the user agent which makes the request, an innocuous file may be served to browser requests, while an infected file may be served to cURL requests.
[ Parent
| on HN ]
Re:Zellij: A terminal workspace with batteries included
by kej on Friday August 12, 2022 @09:17PM
(#32445954)
You can even get more devious and use timing differences to serve one thing to `curl` and a different thing to `curl | bash`: https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b...