One thing I don't like about the vB installation script is that it tells you to delete the install.php file. What they don't tell you is that you can delete the entire install directory :) For upgrades, you just copy the whole install directory from the new version.

Eh, I don't advise deleteing the entire install directory, there are some useful files that you should have on hand, further more the only somewhat harmful file is install.php (because it can drop your database)

I always have them on hand, at home :)

Better is to protect the directory with a .htaccess

I agree, the best thing is a simple .htaccess to block the dir. (Really, the includes etc should be outside of the webroot but I guess vB must support hosts where this is not available). My question is only which dirs can be blocked - I guess the answer is /includes/ and /install/

This is a good idea. But the includes directory (I think) is harcoded in a few places. But if it's made outside the webroot, you can just add it explicitly the includes path in php.ini and it should work.

I can see some mods and vB devs pulling their hair out at all this sacrilege :D