extras updatesite exposes external updatesites making updates outofband possible without user actually explicitly asked for it

extras site references:
http://subclipse.tigris.org/update_1.6.x
http://download.eclipse.org/egit/updates
http://update.rockstarapps.com
http://download.jboss.org/jbosstools/updates/m2eclipse-wtp
http://eclipse-cs.sf.net/update
http://eclipse.svnkit.com/1.3.x

meaning if those receive updates users of JBDS will automatically get updated even though we haven't yet certified.

If they actually explicitly added these then that is their choice, but we shouldn't expose that directly/upfront.