I make music and write software

One way “curl pipe sh” install scripts can be dangerous [proof of concept]

I have seen several sites recently that offer a one-line installation that looks something like this:

curl -s | sh

While I appreciated the elegance, it set off warning bells. Despite this initial reaction I could’t come up with a reason why it was any less secure than other installation methods. In fact, I read a very logical argument that this method was actually more secure from the highly respected Paul Irish:

Today I realized at least once case that could validate those initial warning bells. Take a look at this proof of concept:

curl -s | sh

I’ll wait while you paste the script url into your browser and make sure it’s not going to do anything naughty…

Now that you’re sure the line is safe to run, paste it into your shell (I dare ya!). Or, if you are a big wimp, pipe the output to `cat` instead of `sh` like so:

curl -s | cat

As you can see Curl returned a different script than the one you saw in your browser. This is achieved by checking for Curl’s user-agent and, when found, serving a different file.

Of couse, the whole point is pretty much moot because the install script is probably installing lots of other code that you haven’t reviewed, so you are wouldn’t be running this code unless you already trusted the author. However, be aware that you may be lulling yourself into a false sense of security because you appear to have the code right infront of you.

Charlie Chaplin’s Smile [Ukulele Solo]

Years ago I heard a beautiful arrangement of Charlie Chaplin’s “Smile” on Ukuele Mike’s Youtube channel. Unfortunately the video is no-longer online. However, his arrangement inspired me to create my own using his as a starting point. My goal was an arrangement which exposed the simplistic beauty of the song’s timeless melody. Unfortunately while trying to expose the melody I inadvertently exposed my amateur technique. That’s why it has taken several years (4-5?) of idle practice to get this piece to a place where it was fit to record. I hope you enjoy listening to this recording as much as I have enjoy playing it for the last several years:

Audio only:

Download as .mp3

Tablature of the melody and chord voicings, but not the finger picking:

The lyrics to the song are not used in this recording but are none-the-less an important part of this song:

Smile, though your heart is aching
Smile, even though it’s breaking
When there are clouds in the sky
you’ll get by
If you smile through your fear and sorrow
Smile and maybe tomorrow
You’ll see the sun come shining through
for you

Light up your face with gladness
Hide every trace of sadness Although a tear may be ever so near
That’s the time you must keep on trying
Smile what’s the use of crying
You’ll find that life is still worthwhile
If you’ll just

Walking Away [Ukulele]

Photo credit: Neil Patel

Yet another song from the vaults. This one from February 14th, 2006. One of only few serious original songs I have written.


I walked out the door and followed my feet and wished for it all to leave.
My head was too full, no way to digest, the thoughts you had left me with.
So I paced round the pond, and muttered of love, and tore my hair out from within.
There were tears that time round, and the time after that, and walking away never helped.
So I pace every night to try to forget. But it always just brings me back home.

Download as .mp3

Recorded on my first ukulele into my first (MacBook) laptop.

Tom Waits’ “Ol’ 55″ for Jared and Kathleen [Ukulele]

Jared and Kathleen

Photo credit: Will Rhodes

On July 14th I had the honor of being asked to sing Tom Waits’ “Ol’ 55″ at the wedding of my dear friends Jared and Kathleen. To help commemorate that special day, I have made this simple documentation recording of the arrangment I sang. Thank you both for letting me be a part of your beautiful ceremony, and thank you to Mr. Waits’ for writing this jewel.

Download as .mp3

Read the rest of this entry »

I Wish I Had The Time [Ukulele/Vocal Multitrack]

Photo credit: Beau Lambert (March 2010)

Another one from the archives. Here is a tiny song I sent Chelsea on March 14th, 2010. In keeping with my previous creations, it’s diminutive and bemoans my in-ability to create. Thank you Chelsea for being my muse.

Download as .mp3

Chelsea’s Text Tone [Ukulele]

Chelsea and I perform Menotti’s The Telephone at her parent’s house (4/28/2012)
Photo credit: Lori Lunsford Brevig

Here’s one from the archives. Last year Chelsea had her phone stolen on Muni. As a security measure she wanted to switch to a text-tone that did not scream “I have en expensive phone in my purse!” whenever she received a text. To help her out I wrote and recorded this tiny (even by my standards!) ukulele track. I have in my records that I sent it to her on July 15th, 2011. Feel free to use it your iPhone.

Download as .mp3
Download as .m4r (iPhone text tone)