Detecting the use of "curl | bash" server-side
What I leaned in addition to the sleep trick:<p>> <i>Execution in bash is performed line by line and so the speed that bash can ingest data is limited by the speed of execution of the script.</i><p>So even without any clever detection logic, thinking of curl | bash as "downloading a script, then immediately executing it" is already wrong.<p>It's more "give this remote host a poor man's shell to my machine and hope that they will always execute the same sequence of commands on it".