That's not really relevant to what's going on here. This isn't some script you're blindly downloading/executing from an untrusted source, and it's certainly not a phishing attempt with a seemingly innocuous URL that is actually malicious once you copy it.

You can just `man curl` and find out exactly what's going on here. (http://unixhelp.ed.ac.uk/CGI/man-cgi?curl, scroll down to the bit on "--form", and check out the example) I think curl.io, the service, merely accepts this form data and stores the file on their servers, allowing you access. But you should easily be able to point at your own HTTP server and do all the same stuff. I don't see any "magic" here, other than a little web app that's responsible for taking in the data and writing whatever that data is to a given filename.

It is absolutely relevant. Did you check the link I posted? I understand completely what's going on here, and the important part is that the website is inviting you to copy a command from the website and paste it into your terminal.

Now, even if you're OK with giving curl.io your files and trust it enough to not insert malicious commands into the command you're pasting (see link from my GP comment), since the connection is on clear text, anyone between your machine and curl.io can in theory modify the command text you're invited to copy-paste, and inject malicious commands of their choosing.

I think the poster above you meant that someone could change the command to a malicious one if they found a security hole.

Don't know about you, but an SSL certificate does nothing to increase my level of trust of a website.

Without TLS, absolutely anyone along the link (not just curl.io) can inject some BS into your command line if you choose to copy-paste.

If you don't trust curl.io, fine. But without TLS the list of people you need to trust is not only curl.io, but everyone else in the tubes too.

Or just yourself. As it really should be.

Hey, I'm not sure that the SSL certificate will change something in the trust of the website, because the file will be hold by the website anyway. So according to me, I think you have to encrypt your file before sending it to the server, that you'll be sure to be the only one who can read your file (and other people who you give your passphrase).

I've updated the website with gpg encryption w/ passphrase FYI.

you're right but it should increase the level of trust along the way, no? or do I not undestand SSL correctly?

While active attacks are still possible, TLS prevents passive attacks (eg: eavesdropping).