Hot take: If we added a "--install" option to #curl, we could optimize many a "| sh -" pipeline away.

[henryk@chaos.social]

@larsmb You could then extend https://xkcd.com/1654/ with `curl --install "https://get${1}.dev/install.sh" &`

[vyskocilm@witter.cz]

@larsmb
--insecure is implicit in this mode, correct?

[larsmb@mastodon.online]

@vyskocilm Snark aside, with "https" probably as (in)secure as getting the respective package from any community distribution.

[agowa338@chaos.social]

@larsmb But does it also leak to the server that you're using "--install" and not just try to download the file so that when you're trying to just download the malicious script the server can send you a version without the malware instead?

[totenlegionchris@metalhead.club]

@larsmb This should work fine with openclaw!! You are ahead of the time.

[benedikt_lauenburg@norden.social]

@henryk @larsmb misses an ai api call.

[heiglandreas@phpc.social]

@larsmb I was shortly thinking that that is a chicken/egg situation if you want to install cURL via the `--install` option...

[moritzboth@chaos.social]

@larsmb better naming: "--submit" or "--infect"

[l29ah@qoto.org]

@larsmb This is much longer to type than |sh -

[aspragg@ohai.social]

@larsmb Bonus, it would stop people getting confused from typing `sudo curl $URL | sh -` instead of `curl $URL | sudo sh -`

...nope, still nope!

[agateau@mastodon.xyz]

@larsmb What could possibly go wrong?

[ozzelot@mstdn.social]

@tux0r
doas users made a sad face. all five of us.
@larsmb

[amenonsen@mastodon.social]

@larsmb Or `curl --bash`

[tux0r@layer8.space]

@ozzelot @larsmb (sad pfexec noises)

[pianosaurus@c.im]

@larsmb @agowa338 Lets have curl add a "Variant: without_vulnerabilities" header when --install is specified.

[pianosaurus@c.im]

@larsmb @heiglandreas Let's just do a Microsoft, and ship every OS with something that isn't curl aliased as curl.

[fargate@tech.lgbt]

@larsmb This is a plan without a flaw nor any possibility of error!

[mrshark@mathstodon.xyz]

@pianosaurus @larsmb @agowa338

I think RFC 3514 "The Security Flag in the IPv4 Header" have place here.

https://www.rfc-editor.org/rfc/rfc3514

[busterb@infosec.exchange]

@larsmb @tux0r you don't have curl setuid root already?

[cos@sauna.social]

@larsmb it should default to sudo to make things easy.