Most developers I’ve looked at would happily just paste the curl|bash thing into the terminal.

I often would skim the script in the browser, but a. This post shows that’s not fool proof and b. a sufficiently sophisticated malicious script would fool a casual read