Hacker News Reader

This outlines a POC for detecting whether your script is being downloaded or piped into Bash. Beware.

Good point, but the domain `raw.githubusercontent.com` is a dumb CDN that a possible attacker cannot control.

Can you say the same about raw.gjthubusercontent.com ?

Also, the attacker can push an update if they can successfully guess the window between you reviewing a file and you installing a file. Not nearly as reliable as that POC, but hardly impossible.

Best to avoid building bad habits. Perhaps worthwhile to build good ones - even when it's "safe" to skip.

I think your point about building good habits is really worth thinking about for anyone that thinks they can evaluate the entire set of risks every time they do something like this. Or pretty much anything really. You can't count on always having the clarity of mind you have at this moment. It's easy to get distracted and good habits protect you when you're vulnerable, not when you're at 100%.

Reply on news.ycombinator.com