Personally, "strangers under a banner of long-standing organization XYZ" is different to me than "jkb_25342" on GitHub with one repository, with no source and only binary releases. Realistically, of course you're right, I don't know everyone who maintain the software I work, but I am familiar with the organization. Basically, you need to figure out where you can place your trust, which again for me personally, depends on a lot more things than "met face to face and know who they are".
Comments
Personally, "strangers under a banner of long-standing organization XYZ" is different to me than "jkb_25342" on GitHub with one repository, with no source and only binary releases. Realistically, of course you're right, I don't know everyone who maintain the software I work, but I am familiar with the organization. Basically, you need to figure out where you can place your trust, which again for me personally, depends on a lot more things than "met face to face and know who they are".