rule rulerule rulerulerulerule rulerule rule rulerulerulerule

So, it uses the fact that bash allows functions with non-alphanumeric names, in this case it defines a function called :. If we rename that to, for example bomb it becomes a little clearer:

bomb(){ bomb | bomb& };bomb

This defines a function that calls itself piped into a version of itself in a separate, background, process (that's what the & does) and then calls that function. Calling itself means the function never ends (it's essentially a recursive version of an infinite loop) and the extra background process that is created each time it's called means that it just keeps exponentially creating new processes that don't exit and each of which infinitely forks off more processes until the OS runs out of resources (unless you use ulimit to set per-session/per-user process limits - this may even be done by default on some distros these days, it's been a while since I looked)

In easier terms: it's a script function, which when executed starts itself twice (recursion), leading to an infinite loop that takes up resources, and - in the worst case - causes a freeze or crash. Due to its cryptic code, an unknowing user might not know what they get themselves into when they run it.

it creates a process that makes copies of itself. then those copies make copies... until your computer runs out of resources and crashes