* Sam Stephenson posted Pow with instructions to install it by piping curl http:// into sh.
* I posted a comment calling that installer directive "borderline irresponsible", while at the same time attempting to convey being impressed with Pow itself. My execution of the message I am trying to convey is not graceful.
* Because I have better name recognition on HN and also an unasked-for but not unappreciated status as HN resident security dork, my comment shot up to the top of the thread.
* Because HN is a community of nerds, a bunch of people jumped on to say (in effect) "hey wait, people are also at risk when they install software from Rubygems, but you don't call Rubygems out".
* I responded to some of these comments. I was careful at first because wow is this a boring argument, and more careful later because wow did that comment thread ever spin out of control.
* At this point, 2/3rds of the comments on the thread are nerds arguing about (or, more accurately, piling on to one side of the argument or the other) curl|sh installers.
* Here I decide to edit my comment to note that it sucks that this argument is taking over the thread, because Pow is pretty cool. I see it as an appeal to please downvote my comment because it isn't germane to Pow.
* Sam Stephenson posts a comment thanking someone else for praising Pow, because he's happy not to see FUD about Pow. I now feel very bad, because I can see why he feels FUD'd. I'm having a bad week, so I don't communicate this very gracefully.
* Sam, obviously still stung (or amused) by the HN debacle, posts "gosh", a program that makes fun of the notion that you shouldn't pipe web pages into sh.
Here we are a little stuck. I don't know Sam, but I know the team he works for and admire it. On the other hand, I do know that curl|sh is a bad idea and am not going to say it's a good idea just because HN commenting dynamics, whether my fault or not, spun out of control. It doesn't matter how much I like 37signals. I still have to rely on my judgement. I may be wrong, but from what I can perceive now, curl|sh is evil.