Hacker News new | ask | show | jobs
by kevincox 781 days ago
99% of the time you are downloading from a domain that you do trust. This check is to detect corruption, not malice.

But yes, if you were downloading from an untrusted mirror you would want to check the signature or trusted hash before running the script at all.