Go on, just sudo that unencrypted http link and blindly run what it downloads. I'm sure nothing bad could happen.
There's a difference between "curl ... | sh -" and this.
He's even separated it nicely into steps, so you can view that (very short) file in between.
What worries me more is that he doesn't properly quote $@, so this script will break when there are spaces in the filename. One of the reasons I hate bash.
So everyone needs to check the script before running it anyway. Which is easy, because it's a very short script.
(Of course, it's so short that it might as well have been an alias or, even better, just a copy-pasteable git command, but I guess the author really wanted to call it 'git punish'.)
Am I missing something?
"Don't worry, you don't even need to 'sudo' this so it can't do any harm!" See, it's not running as root while it wipes clean your home folder.
It's not curl thats the problem, it's combination of download and execution in the "curl | sh -" pattern, which is not used in the article.