"curl … | sh" is bad.

In plain words

This website explains why downloading and executing scripts directly from the internet using curl piped to shell is a security risk. It's aimed at developers and system administrators who need to understand the dangers of this common practice. The site breaks down why this method can compromise system security and what safer alternatives exist.

written from the facts on this page · September 2026

• 
  Inspect questionable scripts before piping them to sh or bash2015 · github.com · ▲28

  Don't run "curl | sh" again. Use "curl | shed" to verify scripts before running. - mplewis/shed

• 
  My shell script for HTTP/HTTPS troubleshooting and profiling2019 · github.com · ▲155

  My simple Swiss Army knife for http/https troubleshooting and profiling. - trimstray/htrace.sh

• 
  curl.io2014 · curl.io · ▲132

  Share your files from your Terminal / SSH

• 
  Tap curl in your editor before it gets to sh2016 · github.com · ▲60

  tap curl in your editor before it gets to sh it. Contribute to awalgarg/curl-tap-sh development by creating an account on GitHub.

• 
  Run unknown shell script with a line-by-line confirmation prompt2021 · gist.github.com · ▲158

  Run a shell script with bash, line-by-line, prompted on each command. Useful for running unknown scripts or debugging. Not a secure substitute for understanding a script beforehand. - LICENSE

• 
  A WireGuard Powered Remote Shell2024 · github.com · ▲170

  Time to announce Noisy Sockets Shell, the first in a series of WireGuard powered applications I'm working on. Noisy Sockets Shell is an SSH replacement that uses WireGuard for authentication and encryption, and WebSockets for communication. CLI and browser client available.

• 
  SimCity, but with Permits▲909

  A free city-building game in your browser. You are the mayor. You know what the city needs. Now get it past the zoning board, the neighbors, the appeals court and the next election.

  Life & fun · 1d ago · permit.petercai.com

• IV
  I've been paying for a rural Tanzanian's education for 10 years▲778

  Life & fun · 14d ago · tanzaniaeducationproject.org

• 
  Bigwords.page – Turn any screen into a sign. The URL is the app▲728

  Turn a phone, tablet or TV into a sign. Type a message and it fills the screen: welcome signs, timers, Wi-Fi passwords and more. No app, no account, free.

  Life & fun · 14d ago · bigwords.page

• 
  Guitoro, a virtual guitar you strum with your keyboard▲573

  Play a free virtual guitar online with your keyboard or by touch. Slow songs down and see every chord, string and strum. Acoustic, classic, electric and bass.

  Life & fun · 8d ago · guitoro.com

• 
  See *almost* any carriers phone settings▲432

  Carrier settings from iPhone, Pixel and Galaxy firmware, decoded and compared: APNs, VoLTE, 5G and Wi-Fi Calling per carrier, and what each build changed.

  Life & fun · 12d ago · carrierexplode.com

• 
  The whole Solar System and every tracked satellite, live in the browser▲407

  Life & fun · 22d ago · space.bl2.net

• 
  my weekend project, Gumroad▲396

  Start selling what you know, see what sticks, and get paid. Simple and effective.

  Work · 2011 · gumroad.com

• LS
  Let's end the Programmer Salary Taboo▲278

  Life & fun · 2011 · salaryshare.me

• MW
  My weekend project, tracking the services you can't have in Canada▲212

  Work · 2011 · cantada.ca

• MA
  made a html5 game, polished it many many times▲211

  hi all, I've always wanted to make my own game, but couldn't afford a thousand-dollar adobe (flash+photoshop) license. I'm not a talented programmer, have no degree in CS. But I understand some elements of design. So I got me a copy of ImpactJS, and after about 5 months of steep learning curve (at least for me), I managed to come up with a game. I also integrated it with a highscore and badge system, similar to what you get at Kongregate. You need to login with Google/OpenID to earn badges/scores. link is: http://www.hotbazooka.com/privatejoe hope to hear some feedback/questions from you guys!

  Life & fun · 2011 · hotbazooka.com

• CA
  CSS3 Animated Glowing Forms▲182

  I remember seeing the Dragon Labs Dragonfish Glowing Form Demo[1] when it first came out, and it always stuck in my head. They implement the effect by using a rather large background image and a mask image and move the background image around via Javascript. I was inspired and wanted to see how close I could get with CSS3. I recommend using a Webkit browser [and you can see an alternate version of the animation on Firefox 4]. [1] http://labs.dragoninteractive.com/panel/demo/

  Life & fun · 2011 · kaylarose.github.com

• HT
  Hacker Typer [joke]▲160

  Ever wanted to type as fast as those amazing hackers in the movies? now you can! just write something. Yes, i was really bored. To change writing speed: javascript:writer.speed=10;

  Life & fun · 2011 · duiker101.tk