> $ curl -fsSL install.sh | sh # you'd be stupid to run that, slop or not
I wish more people would point this out.
Akronymus 10 hours ago [-]
I've legitimately seen one project that basically says to do that, but with "your ai agent". At least piping to sh is deterministic and, you can pipe to a filw and check the script
"Claude, install these 215 npm dependencies from unvetted repositores, make no mistakes"
xigoi 6 hours ago [-]
I still haven’t seen anyone point out how this is more dangerous than running an executable that you obtain any other way.
ffsm8 6 hours ago [-]
you can detect `curl | bash` server-side and serve a different payload for those (compared to curl -O file, wget etc), hence its an effectively undetectable attack vector.
Executables on the other hand can be inspected and prodded, so the likelihood of something going amiss and consequently security agencies finding out about it is significantly higher.
neither of those is secure of course, we're just discussing different levels of dangers. And curl|bash being worse, albeit not that much
(and the -L here is the extra cherry on top. piping a redirect to a shell is just monkas)
willturman 15 hours ago [-]
The GitHub and X logos are chefs kiss
cigarettestshir 19 hours ago [-]
This is one of my favorite things I've ever seen.
TacticalCoder 15 hours ago [-]
> Trusted by... six companies from the same YC cohort.
I giggled.
spottedmarley 18 hours ago [-]
* <- tiny logo
BoingBoomTschak 15 hours ago [-]
The fact that I can see it with JS disabled really breaks immersion here.
tosti 14 hours ago [-]
I expected cloudflare turnstile and if that happens to work, flashing gray bars to "compensate" for an absurdly long loading time.
doublerabbit 17 hours ago [-]
If the layout is intentionally LLM generated, heh.
arodenmaxxing 17 hours ago [-]
oh yeah I worked there
angoragoats 16 hours ago [-]
Why does the HN title say “2026 edition” when the page itself says “Slop edition”? We aren’t supposed to editorialize titles here.[0]
0: https://news.ycombinator.com/item?id=49297469
https://news.ycombinator.com/item?id=49307700
I wish more people would point this out.
https://github.com/0xeb/ghidrasql
Executables on the other hand can be inspected and prodded, so the likelihood of something going amiss and consequently security agencies finding out about it is significantly higher.
neither of those is secure of course, we're just discussing different levels of dangers. And curl|bash being worse, albeit not that much
(and the -L here is the extra cherry on top. piping a redirect to a shell is just monkas)
I giggled.
https://news.ycombinator.com/newsguidelines.html