[michaelkrupp]

Not even then. The Server can detect if you pipe to a shell or just download the script: https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b...

[Cyph0n]

“Don’t ever” is a statement that depends on your threat model.

The vast majority of users would trust Homebrew (for example) to not do something like that.

[hollerith]

Thanks for that. (Now I hate bash slightly more than I hated it already.)