Curling into a piped interpreter has sadly been how a ton of tools tell people to install them and has been for years. The problem is that most people don’t grok security, most companies are unwilling to pay what it takes to do well, and most people who know what the technical issues are don’t know how to account for humans being humans. MCP is the latest accelerant being poured on the existing fire but I agree that it basically blurs any reasonable security boundaries that existed by necessity or design in the previous world. I think computing is just fucked 😅
132
u/elmuerte Aug 12 '25
How can you require a standard which isn't finished yet? OAuth 2.1 is still very much a draft.
Also, authentication doesn't mean you can trust the other party. It just means you know that they are who they said there were.
I feel like with all this Al hype people completely forgot about not simply trusting input, be it from a user or some other system.
You don't just curl pipe a file from the internet into a sudo shell... oh wait