I agree that `curl | tar && mv` is not safer than `curl | sh`.