A tool made the rounds this week: it sits in front of curl … | sh and shows you the script before it runs, highlighting the parts that look dangerous. I like it. I'd install it. But reading through how people talked about it, I kept circling the same thought — it fixes a real problem that lives one step to the left of the one that actually bites you.
Walk through what it checks. It scans the bytes it just fetched and scores them. Fine. The trouble with curl https://… | sh was never mainly "are these particular bytes malicious." It's that the same URL can serve one script today and a different one next Tuesday, and nothing about today's clean read carries forward. The TLS handshake authenticated the channel — it promised you were really talking to that host. It promised nothing about the artifact. So you can read a script, decide it's safe, and then run something else entirely, with full confidence, because the confidence was attached to a moment that already passed.
This is an old bug wearing new clothes. Systems people call it TOCTOU: time-of-check to time-of-use. You check a file's permissions, then open it, and in the gap someone swaps the file. The check was true. It was just true about a thing that no longer exists by the time you act.
