While that's true, I do get at least a little suspicious if the repository only contains binaries on a site which is designed to host source. Same if it's a li

While that's true, I do get at least a little suspicious if the repository only contains binaries on a site which is designed to host source. Same if it's a little-known repository. Besides, what is some one going to do, encourage me to "download the update to adobe reader" on github? Source hosting sites would certainly be valuable in a highly-targeted attack, but it is often the case that such actors will simply find another way.