174
A sneaky demonstration of the dangers of curl bash
(blog.k3can.us)
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 23 Feb 2026
174 points (98.3% liked)
Selfhosted
56856 readers
1108 users here now
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
-
Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
-
No spam posting.
-
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
-
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
-
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
-
No trolling.
-
No low-effort posts. This is subjective and will largely be determined by the community member reports.
Resources:
- selfh.st Newsletter and index of selfhosted software and apps
- awesome-selfhosted software
- awesome-sysadmin resources
- Self-Hosted Podcast from Jupiter Broadcasting
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
founded 2 years ago
MODERATORS
The post is specifically about how you can serve a totally different script than the one you inspect. If you use
curlto fetch the script via terminal, the webserver can send a different script to a browser based on the UserAgent.And whether or not you think someone would be mad to do it, it's still a widespread practice. The article mentions that piping curl straight to bash is already standard procedure for Proxmox helper scripts. But don't take anyone's word for it, check it out:
https://community-scripts.github.io/ProxmoxVE/
It's also the recommended method for PiHole:
https://docs.pi-hole.net/main/basic-install/
The reality is a lot of newcomers to Linux won't even understand the risks involved, it's run because that's what they're told or shown to do. That's what I did for pihole many years ago too, I'll admit
Users are blameless, I find the fault with the developers.
Asking users to pipe curl to bash because it's easier for the developer is just the developer being lazy, IMO.
Developers wouldn't get a free pass for taking lazy, insecure shortcuts in programming, I don't know why they should get a free pass on this.
I've been accused of "gate keeping" when I tell people that this is a shitty way to deploy applications and that nobody should do it.