people act weird around any kind of script, more-so than executables, i've never really understood it.

I periodically get told that a published browser userscript of mine is malicious or suspicious in emails simply because of the cautions and wording around the userscript installers themselves (it's just a css tweak, a theme), meanwhile the executables I have in the wild have generated zero similar feedback.

my theory is that since the script is more easily read that it attracts people to read it without any theory or knowledge of what they're even looking at .

This feels like a thing but I can’t think of a name for it.

Where something that can be verified gets more scrutiny than something that can’t.

Maybe someone else knows.

"bikeshedding"?

Verification bias?

Even if you don't review it before running it, after

  $ curl https://whatever/foo.sh > foo.sh
  $ sh foo.sh

if something goes terribly wrong you can examine foo.sh to try to figure out what happened and how to fix it. Even if foo.sh managed to delete itself you can just grab it again.

After

  $ curl https://whatever/foo.sh | sh

if something goes wrong and you then try

  $ curl https://whatever/foo.sh > foo.sh

to get a copy of the script to examine a malicious server can tell that you aren't piping to a shell [1] and give a non-malicious script.

Since it takes an insignificant amount of effort to defend against this why not get in the habit of doing it?

[1] https://news.ycombinator.com/item?id=17636032

Absolutely. And just to be sure, I also check file checksums, which I've downloaded from same server over the same connection.

Actually they do. Not individually one by one themselves but they outsourced this to their distro maintainers which do a spectacular job.

I'll take a properly curated package in flatpak Fedora repos over a random script downloaded and piped into a root shell any day