curl -s foo.com/bar | sh vs curl -o install foo.com/bar && chmod a+x install && ./install The script is an open source installer, the binary is hidden/closed

curl -s foo.com/bar | sh vs curl -o install foo.com/bar && chmod a+x install && ./install The script is an open source installer, the binary is hidden/closed. You and others at least have the option to inspect it. The binary would also be coming over http (https is clearly preferred for binaries or scripts). A binary can always embed a script and do a 'system' call to execute any script-available privilege escalation. I'm not sure what you mean by "as a .sh script, its self-selecting in terms of what system the binary executable has to be written for". I think you mean that a single .sh script can target multiple platforms. That doesn't mean a binary is any safer for you to download and execute on your system.