Comment by bradleyland

> You can't trust anybody except for open source repositories.

Meanwhile, in the real world, Sourceforge injects adware in to downloads for open source projects. Trust is more subtle than open source/closed source.