I wonder how many people see "curl CVE" and decide *that's* when they need to rethink that `curl X | sh` process.