If you install a package via the package managers on debian, ubuntu, fedora, and other major distros you can be reasonably sure that the packages aren't malicious because they've been security reviewed before they made it into APT/YUM/etc. Downloading some shell script off the internet and running it without even reading it first is a really bad idea by comparison.

So, you mean like everything on OSX and Windows, where you don't have such package management systems with (long-standing, trustable) benevolent hosts? Yeah, downloading some application off the internet and running them is a really bad idea - how is this worse?

edit: how about iOS? There have been news entries about them sending data where they shouldn't - that's a curated host. iOS is a lot more sandboxed, but that doesn't make the danger nonexistent.

I take it you don't use pip, gem, sbt, (insert your favorite language's package manager) either?

If you do, what's the difference?

> If you install a package via the package managers on debian, ubuntu, fedora, and other major distros you can be reasonably sure that the packages aren't malicious because they've been security reviewed before they made it into APT/YUM/etc

When people are delivering software that isn't in the official repository, downloading a script and running it is no less secure than the alternatives.