Most code executed on my box comes from package managers, which often use code signing to make sure you're getting the right code. Other than that, we often have to depend on the reputation of the project, otherwise we would be stuck reading code all day, instead of getting work done.

The difference here is that this is not some long standing and reputable project, but instead just something that was randomly thrown up github.

tl;dr - I trust the Mozilla Foundation more than I trust jtwaleson

But usually it is from trusted repositories.

Is this the part where we mention Ken's talk on trusting trust for the 1,000th time?

Note that the URL in the one-liner references the master branch, which can be updated at will by jtwaleson. A much better idea would be to use a link to a specific version if you are going to make claims towards its cleanliness:

  curl -O https://raw.github.com/jtwaleson/decrypt/f004b7eab7b949a55ea3c784fb9bac244aa0296e/decrypt.py; chmod +x decrypt.py; ls -la | ./decrypt.py