zlacker

>>rubyn0+(OP)
This is immune to the attack:

    bash -c "$(curl -sSLf $URL)"

The key is to download first and then run

>>jamesc+01
Or better yet:

curl $URL

less $FILE

bash $FILE

This attack only works at all if you download something and execute it immediately without looking at it.