You can always read the script file (orm ore realistically feed it to agent).
If they distributed appimage or rpm would that be safer anyhow? Cannot it run malitious code same as the script would run?
Regarding appImage or rpm, attackers need to build and package these to inject these, while this curl | bash pipe opens up the possiblity of payloads simply by taking over the domain. And this isn't really that far fetched, just think about the Notepad++ update payload recently. The regular package was unaffected while the domain used for the update was taken over.
Then theres also the argument about normalization. Just like he said, this isn't just something he said, this is a very real argument. You don't want to teach users bad habits. Even if / you / inspect the code you get, not everyone will. And ultimately, we should strive to make the Internet a safer place, if only to get less botnets.
Totally agree we should make the internet safer, this is just a clarification that we don't necessarily need everyone to check it. One person who always checks everything and sends this to their LLM and posts a viral post can be a deterrent.
The installer is one threat. You're then running this on your machine which is the next threat.
Take a look at the screenshots here for one example of getting non-technical users to paste things into the equivalent of bash:
https://www.tilburguniversity.edu/about/conduct-and-integrit...
I do.