[Evidlo]

Bad actors can detect if its being piped to bash and send different data. Better to just download the script first if you're concerned.

[dopidopHN]

That what I meant but I had no idea about piping detection at the same time so thanks for pointing that out, nifty.

[selcuka]

How can you detect where someone pipes the output of curl output to?

[pests]

Basically, bash executes the script line by line as it is downloading - pausing the download while that line executes. By sending a sleep() command early in the script you can detect the delay in the next line beind downloaded.

Its a lot more complicated due to TCP buffers and trying to hide output from the user.

Original article below. It is giving me a certificate error though but its available through archives or a cache.

https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b...

[asdfgeoff]

Neat article.

Cached version → http://archive.today/O46rw

[column]

"This Connection is Invalid. SSL certificate expired."

[pests]

Yeah I mentioned that. You have to go through a cache or an archive.

[selcuka]

Amazing, thanks.