The GitHub thing also isn't very surprising to those of us have been around in this space for a while. People used to tell me they hosted their stuff at Sourceforge and Google Code because they were sure those companies could handle things better than they could. I get that then and even now with GitHub, but I've seen enough to be skeptical.
The Gitorious apocalypse is also evidence that a non-federated but FOSS git solution isn't really trustable either.
@cwebber I worked for Sourceforge and heard a lot of this. Then they moved to Allura but it was rather complex to get working. But they could point to a repo and say "here is the code".
There were a lot of kind folks there who cared deeply about FLOSS. I remember calling one of them after Dice did that whole CNet nonsense with adding malware to software. He was very upset about the whole thing and resigned soon after. But SF was also profit driven and that was unfortunate.
About the best I can muster when discussing nominally "FOSS" companies is usually related to this point you make: No organization is a monolith, and has in it people with a wide variety of awareness and motivation.
It's a subtle thing, to try to disentangle the various threads in an organization to find the people and projects that are, or have the potential, to do right by the broader community, to try to identify how that nets out, and even to try to work with.
