> Package manager is less safe than curl|bash, they do the same thing This is so far from true, I wish this misconception didn't exist. First, a package in a

> Package manager is less safe than curl|bash, they do the same thing This is so far from true, I wish this misconception didn't exist. First, a package in a distro repo is maintained by known people, the package maintainers. Some do an exceptional job, some put in less effort, but at the very least there is some oversight on what gets into an official distro package. And there is an audit trail of who approved what and when. Distro packages are signed and verified by the tooling, so inserting a malicious package is much more difficult. Distro packages are also versioned and prior versions remain available, so if there is an issue we can trace who/when/why it was introduced and when it was fixed. None of these protections exist when you just curl some random executable off from some third-party website and hope for the best. Realize that the website might return a different executable every time. Even if you & I curl it within seconds, we might be served different content. It might return malware in a tiny percentage of cases to avoid detection. It may return code without any versioning, or code that claims a constant version even though the content changes. It is impossible to have reproducible installs when you just retrieve something via curl without any validation or versioning. (You could, of course, curl it to a file and then compute a hash on the file, assign it a version number, store and look up known hash/versions and so on... but now you're down the path of building an adhoc package manager to resolve the problems with curl|bash. So... might as well use the mature package manager your distro already has because it already solved these problems.) > while curl|bash can run in user context No, it runs as whatever user you run it as. You can find plenty of websites saying their installer needs to be run as root.