Don't trust me: I might be a spook
"If you can't see anything because you can't get the source code... well, who knows what they might be hiding?"Actually, it's worse than that.  Even if you can review the source code, you STILL won't know for sure.  As Ken Thompson put it three decades ago, "no amount of source-level verification or scrutiny will protect you from using untrusted code."[1]  This is because the tools we all use to process or transform source code (e.g., already-compiled-to-binary compilers, assemblers, loaders, etc.) may already contain secret back-doors.  Ditto for even lower-level tools like hardware microcode.While open-source software tools -- and open hardware too -- are much less likely to have secret back-doors embedded in them, there are no 100% guarantees.  Ultimately we have little choice but to trust the people who create, package, and distribute all the software and hardware we use but didn't create ourselves from scratch.--EDITS: Added last paragraph. Made minor edits to second paragraph so it more accurately conveys my thoughts.--[1] http://cm.bell-labs.com/who/ken/trust.html