All notes2026-09-30

SSH Probes Can Consume a Piped Installer

When a script runs through curl | sh, child processes can read the rest of the script from stdin.

With curl ... | sh, the shell reads the script from standard input. Any child process that inherits stdin can read from that same stream, and ssh is happy to.

An installer probe like this needs no input, but it still holds stdin open:

ssh "$host" 'uname -s; uname -m'

If it reads, it eats the rest of the installer, and the script stops partway with no error. Giving the probe an empty input fixes it:

ssh "$host" 'uname -s; uname -m' </dev/null

ssh -n does the same thing.

Lesson

When a script is piped into a shell, stdin is the script. Redirect it away from every child command that does not need to read anything.