The difference is in the article itself. Regardless or not of the fact that most people don't verify the scripts that they run (we should! But we don't), the cu

The difference is in the article itself. Regardless or not of the fact that most people don't verify the scripts that they run (we should! But we don't), the curl | bash paradigm, as explained in the article, actually makes it possible for the attacker to provide two different types of scripts depending on the situation. Are we dealing with a smarter-than-average user that is downloading the script and then running it (who knows, he might actually read it too!)? Let's serve a legit one. Are we dealing with somebody who's just mindlessly piping curl output into sh? We found our victim!