@icing What's next? An attacker that can modify local files in the user's home directory can cause curl to download malicious files into the user's home directory? Oh wait, that was a few years ago.