this post was submitted on 04 Aug 2026

447 points (98.9% liked)

Programmer Humor

32610 readers

1247 users here now

Welcome to Programmer Humor!

This is a place where you can post jokes, memes, humor, etc. related to programming!

For sharing awful code theres also Programming Horror.

Rules

Keep content in english
No advertisements
Posts must be related to programming or programmer topics

founded 3 years ago

MODERATORS

anzo@programming.dev

Feyter@programming.dev

BurningTurtle@programming.dev

pylapp@programming.dev

447

finally something worse then curl | sh (lemmy.blahaj.zone)

submitted 11 hours ago by not_IO@lemmy.blahaj.zone to c/programmer_humor@programming.dev

73 comments fedilink hide all child comments

https://labyrinth.zone/objects/96478395-64d9-452c-a906-9e6159cd10a3

(page 2) 23 comments

sorted by: hot top controversial new old

[–] Unleaded8163@fedia.io 29 points 10 hours ago (1 children)

If you trust the site, curl | sh is no worse than any other install method. If you don't trust the site, it's also no worse.

[–] kayzeekayzee@lemmy.blahaj.zone 3 points 8 hours ago (4 children)

yeah you can also just curl > cat and check the script yourself

[–] FishFace@piefed.social 9 points 8 hours ago (2 children)

Do you mean curl | cat or do you really want to create a file called cat?

Also piping to cat seems redundant but malicious hosts can detect whether the request is getting redirected, using some clever trick, so it's not.

Also, your chance of spotting something bad in a malicious script is probably quite small.

[–] cenzorrll@piefed.ca 6 points 8 hours ago

This is my opinion on curl | sh/bash type directions. If the maintainers don't provide a hash so I can confirm that is what they intended, there ain't much I can do unless someone slapped in a function named "totallyNotMalware" into the script. I've looked through scripts, seen what they do, but I'm not good enough to recognize anything funky.

load more comments (1 replies)

[–] not_IO@lemmy.blahaj.zone 3 points 7 hours ago

or just curl

load more comments (2 replies)

[–] testaccount789@sh.itjust.works 20 points 10 hours ago

I don't know what the first one is about. Is it about how the Gemini webpage displays the output?

[–] raspberry_confetti@lemmy.ml 2 points 10 hours ago

cursed

[+] ncsk@lemmy.world -32 points 10 hours ago (7 children)

Isn't this actually kinda what AI is good for? I mean a simple task that just takes time and has step-by-step instructions, and you can just let it handle it and do it faster. Like its almost as good as writing a long script that just does it for the user?

[–] JRaccoon@discuss.tchncs.de 32 points 10 hours ago* (last edited 10 hours ago) (1 children)

Yeah, but I would never let an AI agent run commands on my machine without verifying each command. And at that point I would just rather copy and paste commands by hand, takes about the same time.

If the installation for example required creating some complicated host specific config files, then sure, I could see how that kind of a "runbook" could maybe be useful. But that doesn't seem to be the case here.

[–] OwOarchist@pawb.social 19 points 9 hours ago (1 children)

Yeah, but I would never let an AI agent run commands on my machine without verifying each command.

I would never let an AI agent run commands on my machine, period.

Because that's how you get "You're absolutely right. I did make a mistake when I deleted your entire /home and /backups directories while executing that command. Great job noticing the error!"

[–] Lauchmelder@feddit.org -5 points 9 hours ago (1 children)

honestly if your backup folder is on the same machine as your home folder you deserve everything that comes your way

[–] OwOarchist@pawb.social 12 points 8 hours ago

Regardless of where your backup folder is, your machine needs writable access to it in order to make new backups.

And if an AI agent has root-level access on your machine (needs root to install things), then it will be able to access that backup folder and potentially be able to delete its contents.

[–] Cabslock@lemmy.world 22 points 10 hours ago (1 children)

A script uses much less power/water I suppose... And, wouldn't you have to pay tokens for an AI to do those things? Or are you expected to set up a local model or something for this?

[–] JensSpahnpasta@feddit.org 5 points 10 hours ago

An agent installing that should not use that much power or water. The issue here is that you do not want an agent running on your system being able to install stuff from the internet

load more comments (5 replies)

load more comments