Actually what is displayed is not necessarily the same as what would be executed if you ran that script. You are viewing one piece of code , you will be executing a different file. In fact, you can view the github code, and see the code displayed is embedded into index.html (with syntax highlighting).
If anyone is at all concerned with their privacy, they should never blindly run a script like that.
Copy the text displayed in the code block on the page, diff it against the fix-macos.py file in the curl link. It is character for character the same code. Why am I the only one not too lazy to do this?
Is the link in the curl line binary, compiled, non-human-readable code? No? Then your argument has no merit. It's a plaintext python script. Download it, parse it, if it checks out, run it. If it doesn't check out or you don't understand it, don't. It doesn't matter if it's today, a month from now, or a year from now. If the code checks out, and you feel like it will help you, run it. Or don't, and no one will care.
Or are you seriously going to tell me that you feel you can't trust a 75 line script you just fully vetted, but you can trust, say, the Linux kernel, despite the fact that you didn't manually parse the millions of lines of code in it? If that really is your argument, then I can only imagine that you stop on green and go on red out in the real world, because that's pretty damn fucked up.
No, I'm saying exactly what you are saying. Don't pipe to the shell from curl, download it first, then inspect it. Btw, I can trust a linux binary, because I can verify through checksums, posted on the download site and elsewhere that the binary matches what I expect it to be.
As well, OSX won't let me execute unsigned binary code from unknown developers, unless I manually overwrite it.
The pattern of piping a script from curl and executing it, isn't one I'd expect a site that claims to care about people's privacy to champion. This seems to be exactly what you are saying too.
Why didn't the site owner say, 'curl this script', inspect it, here is the md5 of what it should be, then execute it? Why the cuteness of the direct download and execute? That is my critique.
If anyone is at all concerned with their privacy, they should never blindly run a script like that.