>> I believe it relies on webservices, which are a problem in medium trust i.e. you can only specify 1 in the originUrl.
DNNUpdate uses web services, but as you know, system administrators can modify the web_mediumtrust.config file or use originUrl to make it work in low trust. The DNNUpdate service module has been tested in a low trust environment and works perfectly once this change is made.
>> I think it was Vicenc who started the conversation, so he's probably a good person to touch base with.
Ok, I'll talk to him.
>> Would you download a windows patch from anyone but Microsoft?
www.windowsupdate.com is hosted and administered by akamai. So yes, I'd download a windows patch from someone other than Microsoft, since that's what every user of www.windowsupdate.com is doing - the point is that Microsoft have told me that they approve of the source. For that matter, the DotNetNuke software is hosted by SourceForge - same thing. Negotiating an agreement with us to provide a service to provide DNN updates to end users isn't much different.
>> out of sync versions, and hacked/altered distributions, both of which could be damaging.
We have a security system in place for this. A regular developer user can only do as much with DNNUpdate as they can do with a PA install, since that's the mechanism DNNUpdate uses to install the module. New developer users are checked and are required to only submit their own work to dnnupdate.