My two-hundredths-of-a-dollar on this whole 'debate' is that if you can't modify the curl pipe command so that it writes a file instead of running it immediately (as someone other than root. Right? RIGHT?) then you really deserve that Trojan you just piped into your shell.