[__ryan__]

You're about to run their software on your computer-- what's the difference with that and running their install script?

[BeefWellington]

How do you guarantee that their install script is non-malicous and was actually provided by them?

There's a reason why code signing exists as a security measure.

[danenania]

While signing does improve security, it's still something of a turtles-all-the-way-down problem because how do you verify the public key is valid? An additional factor is added, which helps, but it's not a silver bullet. And the complexity tradeoffs of requiring cross-platform installation of a signing lib like gpg/minisign (which plenty won't already have installed) and a much larger install snippet are significant.

[skybrian]

For the Mac at least, signed dmg files and apps are normal, so they should have done it that way.

[marcus_cemes]

Most people trust that the script is not malicious, including me. There is wrong with this approach, it is extremely convienient to try something out that has good reputation.

For these people, running the script or downloading a signed GitHub release is equivilent, in both cases they do not read the source code of the software that they are running.

There is nothing stopping you from 1) reading the script before running it 2) reading the source code of Deno and any dependencies 3) compiling from source yourself. For most people, this is a waste of time. Trust has to start somewhere to build something great.