First: I apologize for not reading your original post closely enough. I agree that "curl | sh" is no worse than "git clone && make"; I think both are terrible.

First: I apologize for not reading your original post closely enough. I agree that "curl | sh" is no worse than "git clone && make"; I think both are terrible. I will say that I can't recall ever seeing anyone recommend "git clone && make". It sounds like we agree that blindly downloading code and building/executing it is a bad idea. That's all I was trying to assert. There's a spectrum of safe/acceptable between "download a random binary" and "build yourself, from trusted source". I think "curl | sh" and "git clone && make" are just one step above "download a random binary" on that spectrum. We can and should do better than that.