Hacker News Reader

Comment by raxxorraxor | Hacker News Reader

Both is completely secure theoretically. You can read the output of the curl before you refetch and pipe it to bash. You can also look at the commands claude is executing.

You always do that, right? ...right?

View on HN

I used to think the same, but apparently there's a way to differentiate between curling into bash and curling into a text file.

So you could be diligent and curl into a text file, see nothing is wrong, but then when you curl into bash, it runs something different.

Being diligent means that you curl into a text file, see nothing is wrong, and then run the file instead of curling again.

I think the difference people were warned about is that the server can infer the client, so there would be a difference between reading it in your regular browser and curling. As the other commenter says, I'm not sure how the server would be able to tell what curl does with the response.

    curl > some_file
    bash some_file

(Also, how in the world would a server be able to tell where you’re piping the response?)

Edit: thanks for the replies, that makes perfect sense

Heuristically: https://web.archive.org/web/20250622061208/https://www.idont...

Timing. A megabyte of "sleep 10;" would be read from the server more slowly when piped to bash versus written to a file

No but we use MCP so we’re fine.

Reply on news.ycombinator.com