With Open Source software, I need a reason not to trust it. With proprietary software, it’s the other way around. Developer being the NSA has been a reason for me not to trust Ghidra.

Open-source has the advantage of more eyes on the code. I trust someone, somewhere has looked. That’s all I can do.

Anyone who says “jUsT cHeCk ThE cOdE” should be ignored.

foss auditing is done collectively. if there are many eyes on the code and it’s popular with users and contributors, it’s probably trustworthy.

if it’s a small but obscure utility i tend to once over the code just to make sure it’s not doing anything malicious.

if it’s a big but unknown project or something complex that goes over my head, i tend to distrust it.

No and the extent of my review of it will depend on how critical of a service will use it.

If there is a healty sized developer group contributing. I tend to just install.

If there’s just single developer, not much history and mayde AI involved, I’ll just skip the software.

I don’t have time to review the code and I don’t think the developer wants me to feed the code to AI.

If AI is one of the developers and already involved, AI review is an option, if I really need to run it.

Not entirely and with absolute certainty, but more than any proprietary software in general. The more eyes on it the better.

At the end of the day, you have to trust someone and a few black boxes in between as soon as you connect to the internet. So if there’s something I’d really rather not let out into the world, it’s either on an airgapped encrypted system or a piece of paper hidden where my keys get lost.

I trust no one or anything entirely

No.