"curl http://url | sh" is not evil.

Also, if you add random Debian packages they are also entitled to run arbitrary programs (as root!) while installing.

The only thing wrong about this title is that it does not read "https".

It's easy to read the url, first.

Do you read the source of all the apps you install?

"In this example, the first – the scary, evil one – is the only one using HTTPS."

git:// ~= ssh:// ~= SSL ~= HTTPS