I think the recent situation with SourceForge, where binaries were changed to add a malware-ridden installer[1] shows why GitHub is potentially worse than trust

I think the recent situation with SourceForge, where binaries were changed to add a malware-ridden installer[1] shows why GitHub is potentially worse than trusting some other provider. I think it's a low likelihood that something like that happens with GitHub ever, much less soon, and SourceForge has reversed that action already. But it is one reason to potentially trust binaries from a third party like that less. But that's not really the thrust of the point. It's software from an unknown provenance, and yes, that's pretty standard for Windows but it's not great and it's getting worse all the time. Virus scanners are not a great solution, but not having them are worse. Without any kind of a checksum on that page, it's impossible to verify that the binary you have is the one that you should have. (Not that it's guaranteed that you can do so if there is a checksum.) So you're already in a bad situation, and you're turning off one of the few safeguards you have. As for registry changes getting flagged by Defender... programs that change the registry aren't rare.[2] They do not universally share this problem. I imagine it's probably a false positive and I don't know how it could be avoided, but the proposed remedy is reckless. 1) http://arstechnica.com/information-technology/2015/05/sourceforge-grabs-gimp-for-windows-account-wraps-installer-in-bundle-pushing-adware/ http://arstechnica.com/information-technology/2015/05/source... 2) http://windowsreport.com/windows-10-registry-cleaners/ http://windowsreport.com/windows-10-registry-cleaners/