Exe-files, repository packages are usually signed by the developers, so in order to execute malicious code on your system, attacker must obtain private keys from developers. It&#x27;s usually harder than attack a website.<p>If an executable is not signed, I don&#x27;t see any difference, if you are not going to inspect script before you run it. You either trust a website or not.