I like the response[1] to that issue by Kenton Varda on the sandstorm team. I think it's a well thought out piece. [1] https://sandstorm.io/news/2015-09-24-is-

I like the response[1] to that issue by Kenton Varda on the sandstorm team. I think it's a well thought out piece. [1] https://sandstorm.io/news/2015-09-24-is-curl-bash-insecure-pgp-verified-install https://sandstorm.io/news/2015-09-24-is-curl-bash-insecure-p... He addresses code signing and mitm and connection interruptions. Edit: The gist of it is no, it's not more insecure than other software distribution methods.