Detecting the use of "curl | bash" server-side

The sleep cleverness is excessive though - what you really want to know is if the script you're returning is being executed as it's sent. If it is, then you can be pretty confident that a human isn't reading it line by line. 1. Send your response as transfer-encoding: chunked and tcp_nodelay 2. Send the first command as curl www.example.com/$unique_id Then the server waits before sending the next command - if it gets the ping from the script, we know…

> Installing software by piping from curl to bash is obviously a bad idea and a knowledgable user will most likely check the content first It's funny how so many obvious things are all but obvious when you think a little bit more about it. Interesting read on the subject: https://sandstorm.io/news/2015-09-24-is-curl-bash-insecure-p... (I don't want to enter the `curl | bash` good or bad rabbit hole; just that the topic cannot be just dismissed as "obvious")

I wonder why there is such a focus on this `curl|bash` pattern. Meanwhile most of us are downloading hundreds of thousands of lines of code using all kinds of package managers and I don't see many inspecting all those downloaded files, especially not manually. I don't think anyone would ever get to doing anything other than checking if you really want to verify everything. I'm not saying that downloading something from your official OS package repositories is the same as…

Need to also detect wget | bash, which should cover most cases that I see on the web