Detecting the use of "curl | bash" server-side
What I leaned in addition to the sleep trick:> Execution in bash is performed line by line and so the speed that bash can ingest data is limited by the speed of execution of the script.So even without any clever detection logic, thinking of curl | bash as "downloading a script, then immediately executing it" is already wrong.It's more "give this remote host a poor man's shell to my machine and hope that they will always execute the same sequence of commands on it".