Is the link in the curl line binary, compiled, non-human-readable code? No? Then your argument has no merit. It's a plaintext python script. Download it, parse it, if it checks out, run it. If it doesn't check out or you don't understand it, don't. It doesn't matter if it's today, a month from now, or a year from now. If the code checks out, and you feel like it will help you, run it. Or don't, and no one will care.
Or are you seriously going to tell me that you feel you can't trust a 75 line script you just fully vetted, but you can trust, say, the Linux kernel, despite the fact that you didn't manually parse the millions of lines of code in it? If that really is your argument, then I can only imagine that you stop on green and go on red out in the real world, because that's pretty damn fucked up.
No, I'm saying exactly what you are saying. Don't pipe to the shell from curl, download it first, then inspect it. Btw, I can trust a linux binary, because I can verify through checksums, posted on the download site and elsewhere that the binary matches what I expect it to be.
As well, OSX won't let me execute unsigned binary code from unknown developers, unless I manually overwrite it.
The pattern of piping a script from curl and executing it, isn't one I'd expect a site that claims to care about people's privacy to champion. This seems to be exactly what you are saying too.
Why didn't the site owner say, 'curl this script', inspect it, here is the md5 of what it should be, then execute it? Why the cuteness of the direct download and execute? That is my critique.
Or are you seriously going to tell me that you feel you can't trust a 75 line script you just fully vetted, but you can trust, say, the Linux kernel, despite the fact that you didn't manually parse the millions of lines of code in it? If that really is your argument, then I can only imagine that you stop on green and go on red out in the real world, because that's pretty damn fucked up.