[Martijn]

my .02c...

primary reason for using email is that basing stuff on pull requests would mean git(hub) only - which isn't a sane requirement - lots of authors use e.g. googlecode.

another reason for using email is that we need to be able to contact the developer for feedback. another reason is that you get a email every time some one wants to update his addon. this could be very usefull in case you depend on that particular one.
Some time ago a dev wanted to update his script.module however that broke backwards compatibility. with the mailing list none of the others would have known that until it was to late. So all involved devs update their addon in one go to prevent breakage.

second problem is that we cannot have hooks on github that react on push, so we'd need to external poll agent running, a more error prone, more involved and more taxing (on the backend) approach. sourceforge allows hooks, which is why the repos are over there still.

Hasn't this changed since our forum is now handled by github to and once you push to master the server gets updated.
TheUni has more info on how that's done.

as for allowing third party repos in the official repo; this would tear down the borders between code offered by us and third parties we have absolutely no control over. that is not acceptable from our pov, since we feel/are reponsible for software offered on our servers. since the python in xbmc isn't sandboxed, there needs to be a HUMAN reviewing all the add-ons looking for harmful code. this is us behaving reponsible, not us distrusting other authors. sure, there can malicious behaviour (not gonna happen very often) or good old brainfarts on the authors behalf.
i think the fact that we do this is missed by a lot of peeps.

Indeed. We are semi responsible for the things put in repo that no harmful scripts get added. It doesn't even have to be on purpose. Just a badly placed while loop can be enough to cause mayhem (this is more for the python beginners)