I brought it up in a thread a couple of years ago, but I'll ask again: how can you be certain that open-source is trustworthy? I'm genuinely curious about this.
We had a pretty big discussion about my question then and the consensus was that because a given codebase was open-source, it had to have been checked out completely. But no one could tell me how they could be sure that line after line of code had been vetted. Everyone's classic response was, "someone checked it out". What if no one did?
I think people have it in their minds that code review is like a "peer review" process in the scientific world, where theses are closely examined for errors in fact or method prior to publication. I doubt that happens in programming. With all of the reusable code libraries people depend on now - especially from known bad actors like Google - I doubt that anyone can offer any certainty about any code at all, even if its open source.
I'm not the only questioning this.
https://github.com/nylira/prism-break/issues/169