There is a request already for GOG to open source the upcoming updater client:
https://secure.gog.com/wishlist/site/release_the_future_gog_updater_client_as_open_source

However if you can't do that, it shouldn't prevent GOG from opening the protocol and API used by the client. It would make creating an open community alternative client for GOG service much easier than trying to reverse engineer it.

__________________________
* See corresponding wishlist entry to vote for opening the protocol and API.

what's the point and why? I'm happy if they build it in-house.

The point is explained in the thread about open sourcing the client.

The key idea is trust. "Being happy" doesn't make such client more secure or trustworthy. Building it in house can be perfectly fine, if they open the client as well. Community client would be needed if GOG will decide to keep the client closed.

What about the games? They are closed source and you still trust them enough to run them, so what does it matter if the GOG client is open source or not?

I'm not so bothered about it being open source but an official API that's open for anyone to use would be a good idea. See my thoughts on this:
http://www.gog.com/forum/general/third_party_clients

Games are different because their focus is not to manage the system (like installation) but to provide a gaming experience. One can sandbox them as well, for example by running them in a container (see Docker: https://www.docker.io) since indeed, each game should have nothing to do with the rest of the system.

Client for managing installation is another type of software. It's by design intended for managing the system to some degree. Therefore the level of trust it requires is higher.

The "type of software" is an artificial distinction. The only thing that matters is what privilege level the software runs at. Since many games here require administrator privileges anyway, what's the difference?

What matters is trust. Trusting any client installing and updating installed components when it's closed is not a good idea. I already explained the difference. The intent of the application. Whether you consider it artificial or natural - it doesn't matter. The difference is there. Also, you can of course go and ask games developers to open source those games, but it's not likely (and reasons are many). Asking GOG to open their client is more useful, because GOG decides that and there are good reasons to open it. They can't decide it for the games which developers distribute through them.

i would rather prefer they keep the galaxy client to themselves and make sure that it runs efficiently and is updated frequently with new user requested features , releasing out would mean other drm free providers official and non official jumping on it

What's wrong with others "jumping on it"? It's the client. It won't give them access to your accounts on GOG. More participants will help improving the client and auditing its security better.

Yes, trust matters. But you really trust people and their intentions, not their source code. A malicious game or any other piece of software you run on your computer could potentially do the same things as the GOG client. Don't get me wrong, I think it would be great if GOG open-sourced their client. But it's a serious mistake to equate open source with trustworthiness.

Agreed. Given GOG's history with software development, they will sure as heck need help with squashing bugs and making a user-friendly client. a) That games here require admin priviledge is flatout stupid, as 99% of them don't need that.
b) There's a massive difference between a client directly injecting files and installing software to your hard drive without your explicit permission (all you do is give implicit one by installing it), handling connectivity between users etc. etc. and a ... Well, videogame, which is mostly just sitting there. Besides, yes, game engines should be open souced as well. Wrong. GOG can license their open sourced code however they wish, and they don't even have to incorporate customer's branches into their main application.

Open source doesn't guarantee trustworthiness. It makes auditing more feasible. When it's closed - it's simply not possible. I.e. open client has more potential to be secure and not having any nasty side features. Making potential an actuality is a second step. But we are talking about the first.

That aside i notice both u and shmerl are both pro linux (as far as i remember) is there something extra for linux out of this?

For every open sourced application released, Linus Torvalds gets an erection.