Don't Pipe to your Shell

Re:Don't Pipe to your Shell by FiloSottile on Thursday October 31, 2013 @11:10PM (#6651575)

"piping to a shell" is _impossible_ to inspect. The author is making that point himself:

> running arbitrary commands on your machine that could change based on user agent to trick you

Without even considering MitM, that running signed executables kind of mitigates.

Anyway, the point of the author is the failing mode.

[ Parent | on HN ]

Re:Don't Pipe to your Shell by shawabawa3 on Friday November 01, 2013 @08:21AM (#6653169)

> "piping to a shell" is _impossible_ to inspect

Absolutely not. The author points out 1 way in which stupid inspecting could be beaten, however you can always do

    $ curl https://coolscript.com/script > tmp.sh
    $ cat tmp.sh
    echo "I'm safe!"
    $ ./tmp.sh

[ Parent | on HN ]