The vast majority of defects groups like intelligence agencies are exploiting are not going to be intentionally-placed backdoors - they&#x27;re going to be typical vulnerabilities discovered the normal way, just by an organization with immense resources and no motivation to share.<p>So the bottom-line is that it comes down to how much you trust the people that made the software. Is it a very high quality vendor? Is it a very high quality open-source project?<p>The nice thing about open-source software is that you have a much better ability to evaluate this from the inside. Get on mailing lists, poke around trackers, and see how they usually deal with security disclosures. Do they even have a formal program to do so? I&#x27;m not sure that OpenVPN does, although a lot of distros watch that carefully.