[avz]

Agreed. Perhaps the most prominent example of this shameful behavior is this one:

curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh

Source: https://www.rust-lang.org/tools/install

[hulitu]

Haha. This is the most secure part. When you start compiling, rust will happily download random "crates" and include them in your program, because "dependencies".