Hacker News Reader

Comment by ams6110 | Hacker News Reader

Why not just:

  curl ... | less

View on HN

One potential issue is that you don't know you'll get the same HTTP response next time.

From within less, you can save to a file or pipe to a command, once you've inspected the payload to whatever degree you desire.

I'm not sure that this is as safe as you may think.

EDIT More info. Yes this is better than curl ... | sh. But less has a lot of functionality (more than you'd expect) and a carefully written script could exploit some of this.

Would that really be any different that downloading the script, then opening it with less/vim/whatever locally, which is typically going to be pretty safe, unless the script is accidentally executed somehow.

Well it is exactly the same.

Can you provide an example?

EDIT found link http://seclists.org/fulldisclosure/2014/Nov/74

Basically the tldr is that gnu less is a program that has been engineered to do a lot of things over the years and this has created attack surfaces which mean that if someone was to curl .... | less on a carefully designed payload it could allow the payload to obtain a shell.

I wasn't saying that it isn't safer just that it isn't totally safe.

`curl ... | <your favorite code editor, like vim or emacs> -` should work too.

Thats generally what I do when I encounter the curl -> bash instructions on the web.

Reply on news.ycombinator.com