For the record, I think this is a totally reasonable comment, and I don't see why it's being downvoted. Often, the same people who spread FUD about shell script

For the record, I think this is a totally reasonable comment, and I don't see why it's being downvoted. Often, the same people who spread FUD about shell script installers will download a binary from GitHub releases, npm, etc. without a second thought. There are a few things that make shell script installers particularly dangerous, though. I don't think any are meaningful with the way people normally use computers, but they could be meaningful in the future if we improve our collective security posture: * Shell script installers aren't digitally signed. Most OSes have pretty weak code signature schemes anyway. They're littered with root-of-trust issues that prevent a lot of OSS from being signed to begin with, and in turn, the vast majority of users (especially power users) ignore code signing warnings. But, as these problems are addressed, shell scripts will become weaker and weaker in comparison to binary packages. * Shell script based sites can fingerprint the client and serve different content to a browser and to the "curl" command, confusing users who attempt to audit what's going to run before it's passed into the shell script command. This is a fine argument and a real problem with the "pipe to sh" approach. However, unless the user is also independently checksumming or disassembling every binary application they download, it's also a bit of a straw man.