And yet when I complained about `curl | sh` on HN the other day, I got ridiculed. "Everyone" is too much, but even on a purportedly "hacker" website, people find the idea of perusing a shell script before executing it preposterous.
Something that's hard to remember, but helps a little: if you get 3 people saying stupid things, that's only 3 people -- not necessarily representative of the people out there.
But `curl | sh` is no less secure. Download this file and execute it. Functionally the same outcome. Tell me how doing that is materially different than `apt get`. Both employ signing and checksums (just with different PKI). One delegates trust to a package maintainer while the other trusts the author directly. I truly don’t understand the paranoia and consider it tinfoil hat security theater.
