it's probably quite a similar risk. But who does that? After downloading you can at least do some sanity checks - even if you don’t checksum it if you are fami

it's probably quite a similar risk. But who does that? After downloading you can at least do some sanity checks - even if you don’t checksum it if you are familiar with it does it look right? Is make doing anything weird? Whereas curl|sh doesn’t give you this opportunity.