There is no shortage of articles and essays explaining why this anti-pattern is bad:
- "One way "curl pipe sh" install scripts can be dangerous [proof of concept]", Jordan Eldredge, 2012.
- "Don't Pipe to your Shell", Sean Cassidy, 2013.
- "Stop piping curl to /bin/sh", Chris Snell, 2013.
- "Piping into shell may be harmful", David Jones, 2014.
- "On the curl | sh pattern", Etienne Millon, 2014. This author also created the curl | sh wall of shame.
There are various attempts to address the first two problems:
This still leaves the further problems unresolved, though.