"curl | bash" isn't actually very different security wise from "download this piece of software from our webpage and install it". Every time you install softwar

"curl | bash" isn't actually very different security wise from "download this piece of software from our webpage and install it". Every time you install software these days you put a certain amount of trust on the vendor. (This may change in a theoretical future of reproducible builds and binary transparency logs.) I'd argue that "curl http://.* http://.* | sh" is always bad, but so is every webpage offering software downloads that isn't https by default (and there are plenty of them).