In general I don't want to spend time reading source of software I use. If I'm downloading a script from a trusted source, I like to be confident that I'm getti

In general I don't want to spend time reading source of software I use. If I'm downloading a script from a trusted source, I like to be confident that I'm getting the right script. That's accomplished by the author publishing a sha256 hash and me following this workflow: curl http://scriptname > scriptname.foo sha256 scriptname # visually verify that it looks right from the web site chmod 755 ./scriptname.foo Of course, if I'm downloading from an untrusted source, I review the script and any commands I miss. Note that, e.g., Calibre, has their Linux update procedure to be as follows[1]: sudo python -c "import sys; py3 = sys.version_info[0] > 2; u = __import__('urllib.request' if py3 else 'urllib', fromlist=1); exec(u.urlopen('http://status.calibre-ebook.com/linux_installer').read()); main()" I'm sorry, but I don't see any verifications that calibre has not been rooted and malware installed. It's not HTTPS either, so I won't even get an SSL warning for a MITM attack. To decode the Python: that command/script downloads a script from the internet without verification, and executes it as root. [1] http://calibre-ebook.com/download_linux http://calibre-ebook.com/download_linux