You can be appalled, but it&#x27;s not like anyone&#x27;s paying them for the work that they do.<p>If you want to help them, I&#x27;m sure you could contribute some additions to their build process or something that would help them tighten up security. But I think it&#x27;s funny that you&#x27;re so shocked that a popular free software project isn&#x27;t perfect.<p>Be the change you want to see.<p>PS: who cares if the devs are using unsigned software downloaded over HTTP? I care about using signed software (and then I suppose the transport doesn&#x27;t really matter), but that&#x27;s totally unrelated to what the devs do on their own computers.