I meant that the logic implies that https://github.io https://github.io is shady because it uses the ccTLD of British Indian Ocean Territory despite being unrel

I meant that the logic implies that https://github.io https://github.io is shady because it uses the ccTLD of British Indian Ocean Territory despite being unrelated. Of course you should cross reference the authenticity of any URL you are about to execute as a shell script. No one is saying not to. But your point seems to agree with mine: it’s only as shady as it is unfamiliar. The answer shouldn’t be to come up with a URL that lowers your guard. Instead, users should get familiar.