Traditional "linux repositories" are kind of walled gardens though. I mean, the software is vetted and controlled by the bistro's maintainer, is it not? Isn't it also true that sensible advice is to not add repo's from unknown sources?