Instead of writing that, they should first use cURL, and then sh, without any piping. See http://unix.stackexchange.com/a/339276 http://unix.stackexchange.com/a

Instead of writing that, they should first use cURL, and then sh, without any piping. See http://unix.stackexchange.com/a/339276 http://unix.stackexchange.com/a/339276 That way, it is the same as running cURL without piping the output to bash, so people can easily check the code without worrying if the server is sending them different code when they pipe to bash