You don't need to understand the script to have it in the directory and run a sha1 or md5 against it, and compare it against what should have been returned when

You don't need to understand the script to have it in the directory and run a sha1 or md5 against it, and compare it against what should have been returned when there's an announcement that there was a problem. That is what I mean by accountability. When nothing is left on disk of what was specified to execute, there's severely limited recourse in figuring out what happened. I'm not suggesting every person does: curl > install.sh less install.sh sh install.sh I'm suggesting they should be directed to do: curl > install.sh sh install.sh and then later if there's a known problem, there are fairly easy ways for them (even a novice) to determine whether what they ran was legitimate or not. Piping a web request directly to a shell is a poor trade off WRT security to request of anyone, IMO. By that I mean that the gain in ease of use is extremely small, but the loss in accountability is fairly large in the case that there's a problem.