Or running random curl | bash scripts from GitHub, AUR, NPM are just as bad but many developers here still have dubious assumptions on this bad practice.

The last few weeks tell us how bad this is especially with all the mini-shai hulud's running around.