the problem is there's absolutely zero trust built into the curl/pipe/shell. you could do a MITM attack on curl with a simple hosts file entry. that's literal

the problem is there's absolutely zero trust built into the curl/pipe/shell. you could do a MITM attack on curl with a simple hosts file entry. that's literally all it takes. you could do it by ACCIDENT. a signed or checksummed package is a completely different matter entirely. no, it's not foolproof. yes, it takes knowledge to verify. but it's much better than just running executable code straight off the web.