Is that egg accounted for in the threat model? Did we just unnecessarily add to the attack surface? Does it get regular reviews? Does it have tests? Are we willing to continue to donate the cost of maintaining this "component" that serves no purpose but entertainment?
In this specific example, it's friggin' curl, whose whole existence is to go to talk to other machines over a hostile network. I'd rather it stick to its one, really, really hard job and not get cute.
You bring up a valid point, though I don't know that even that much is necessary. The internet will find it soon enough and document it for us. But, hey, takes ten minutes to write down the flag and what it does, right? Are we still talking about an Easter egg at that point, though? :-)
I mean Python has all the functionality of curl (potentially, at least) and it has an Easter egg.
At the same time, I could see someone launching an attack with a module “this.py” that outputs the Zen of Python and also installs a back door.
Come to think of it, one of the nastiest problems in Python programming is keeping track of which modules are in the PYTHONPATH (“hmm why is ‘pytest tests/test_my_module.py’ throwing an import error?”)
In this specific example, it's friggin' curl, whose whole existence is to go to talk to other machines over a hostile network. I'd rather it stick to its one, really, really hard job and not get cute.