Comment by mcherm

Why is the first step needed? What does the use of WGet (rather than curl) do to block this attack?