I would encourage you to actually think about whether or not this is really true, rather than just parroting what other people say.

I would encourage you to read up on the issue before thinking they haven’t.

See if you can think of an exploit I perform if you pipe my install script to bash, but I can’t do it you download a tarball of my program and run it.

Here is the most sophisticated exploit: Detecting the use of “curl | bash” server side.

It is also terrible conditioning to pipe stuff to bash because it’s the equivalent of “just execute this .exe, bro”. Sure, right now it’s github, but there are other curl|bash installs that happen on other websites.

Additionally a tar allows one to install a program later with no network access to allow reproducible builds. curl|bash is not repoducible.

Anti Commercial-AI license