"curl http://url | sh" is not evil. (gist.io)

It's easy to read the url, first.

Do you read the source of all the apps you install?

Also, if you add random Debian packages they are also entitled to run arbitrary programs (as root!) while installing.

The only thing wrong about this title is that it does not read "https".

"In this example, the first – the scary, evil one – is the only one using HTTPS."

git:// ~= ssh:// ~= SSL ~= HTTPS