@gumnos I found your blog: https://astrid.tech/2026/03/24/0/curl-to-dev-sda/
Hah, that crossed my feed earlier this morning making it feel all the funnier.
However I've used this technique in the past when a VPS provider didn't let me insert an ISO boot image for my own BSD-install purposes. Used a file-backed md(4)-type device as the disk-image, installed to that, unmounted, rebooted the VPS to rescue mode, then something like
$ gzip -9 < freebsd.img | ssh root@$VPSIP 'gunzip > /dev/sda2'
and it worked like a charm.
And since I was in control of the sending & receiving sides and the link was over ssh, I didn't have any concerns about it.
Downloading untrusted $URL targets though? :shiver: