If there were a legitimate looking GitHub how-to page that asked me to do that, I can see myself doing it. Fortunately, I ignore all security issues on my repositories.

Security by lack thereof

people make a lot of noise about piping into shell, but even if the instructions were

wget random.club/rc-12-release.sh

chmod +x ./rc-12-release.sh

./rc-12-release.sh

almost nobody would actually read the script before running it

Well yeah, if your intention is to install software from random.club on your system, what would be the point of checking the installer script? The worst thing it can do is the same thing you want it to do.

Yes, which is why complaining about curl | sh is silly.

I’m not disagreeing.

or even this:

git clone http://github.com/unknown/repo.git && cd repo && npm install

Even worse:

$ svn checkout

$ ./configure

$ make

# make install

No they haven’t, they’ve been trained to do

    curl https://url-of-well-known-project | sh 

I may not trust the owners of a random domain, but I certainly trust the owners of rustup.rs not to do anything intentionally malicious.

Microsoft owns more domain names than the amount of neurons in the brain.

Then you are more trusting of the Serbian National Internet Domain Registry than you should be.

Another red flag. I cannot take any project serious that has this on its documentation.

You prefer that they wrap it in an .msi file and put it on that same website? What do you think the advantages of that are?

I guess you don’t think the Rust programming language is a serious project, then?

I mean they even named the website cargo, after cargo culting! (jk)

what is the more secure way in you opinion? What is the weak link here? TLS transport? possibly compromised hosting/codebase? trust in app authors? not reading the shell script? checking a signature of some file?

My issue is the bypassing of the systems package manager. Doing so will result on files spread somewhere over the system. How do you uninstall such thing properly? How do you update (or even know) it's dependencies? Will it break because I uninstall or update one of it's dependencies?

Linux has a very good package management for many years. I see absolute no reason to break this by creating shell installers.