> Also, I suppose the man-in-the-middle issue is mitigated by downloading directly from GitHub over https. Unless there is something else I'm missing (very like

> Also, I suppose the man-in-the-middle issue is mitigated by downloading directly from GitHub over https. Unless there is something else I'm missing (very likely, feel free to enlighten me). There is no substitute for end-to-end encryption, from you, the author, to me, the user. The only generally accepted relaxation is end-to-encryption from the maintainer (e.g. Debian maintainer) to the user - which is what you have in the distros. Compared to those best practices, the "HTTPS from GitHub" has the following flaws: 1) You have to trust GitHub. If GitHub is hacked, or starts to behave like SourceForge, you are doomed and nobody will notice. 2) Unless all of your users do certificate-pinning, a compromised CA (or a malicious CA) may be used to issue an alternative SSL certificate for GitHub, which is then used to deliver malware. It may seem implausible that anyone would go that long way to attack your prettyping project directly. However, it is very attractive to attack GitHub as a whole and to manipulate all hosted programs systematically. > Sure, I'd love to have it packaged on several distributions (...), but I can't do it myself. I hope users from other distros find it useful and contribute packages to their distros. Maybe it helps to ask them. I know that Debian has a mailing list for that. Sure, you still need to find volunteers if you can't do the packaging on your own. But maybe there are people willing to do that, who just need a little more motivation. > "How easy to install from scratch?" Agreed, that would be a much better wording.