When are these comments going to stop? Everyone lazy enough is going to keep suggesting "curl install" and everyone lazy enough is going to keep using it, and everyone that has something worth protecting and cares enough is either not going to use it or is going to audit it anyway, and comments like this aren't going to move anyone between those camps.
If you all think "curl install" is so evil then build something secure to replace it. It's got to be as easy from a "package maintainer" as well as a user's perspective, and you have to figure out some way to validate security. But until then, warning people that they should read code they execute is a waste of bandwidth.
Comments
When are these comments going to stop? Everyone lazy enough is going to keep suggesting "curl install" and everyone lazy enough is going to keep using it, and everyone that has something worth protecting and cares enough is either not going to use it or is going to audit it anyway, and comments like this aren't going to move anyone between those camps.
If you all think "curl install" is so evil then build something secure to replace it. It's got to be as easy from a "package maintainer" as well as a user's perspective, and you have to figure out some way to validate security. But until then, warning people that they should read code they execute is a waste of bandwidth.
It's never a waste of bandwidth if it prompts one person to do the critical checks and prevents them from being owned.