Don't trust me: I might be a spook
<i>"If you can't see anything because you can't get the source code... well, who knows what they might be hiding?"</i><p>Actually, it's worse than that.  Even if you can review the source code, you STILL won't know for sure.  As Ken Thompson put it three decades ago, "no amount of source-level verification or scrutiny will protect you from using untrusted code."[1]  This is because the tools we all use to process or transform source code (e.g., already-compiled-to-binary compilers, assemblers, loaders, etc.) may already contain secret back-doors.  Ditto for even lower-level tools like hardware microcode.<p>While open-source software tools -- and open hardware too -- are much less likely to have secret back-doors embedded in them, there are no 100% guarantees.  Ultimately we have little choice but to trust the people who create, package, and distribute all the software and hardware we use but didn't create ourselves from scratch.<p>--<p>EDITS: Added last paragraph. Made minor edits to second paragraph so it more accurately conveys my thoughts.<p>--<p>[1] <a href="http://cm.bell-labs.com/who/ken/trust.html" rel="nofollow">http://cm.bell-labs.com/who/ken/trust.html</a>