No Stupid Questions

In short the answer is this: you have two companies selling you boxes, one that it's literally impossible to look inside, and another one that's very easy and encouraged to do so. Even if you know nothing about bombs, if both those boxes claim to not explode, which one do you trust more?

It's sorta the same thing, it doesn't necessarily means that the closed box is inherently less safe, but even if you personally haven't verified that the open box doesn't contain anything dangerous you can be somewhat safer in the knowledge that people COULD have verified it.

There are many science articles that I personally do not understand, most of them in fact. But I trust that as long as the methodology and findings can be studied, people who are specialized in that area will point out mistakes and try to disprove and improve each other. We don't talk about phlogiston anymore, because science did its thing. I see free software in a similar way. As long as the source is free to study, and people are interested in finding errors, those errors can be fixed. Trusting software becomes more about trusting a community. It's not perfect, but what is.

I'll offer the contrarian answer: FOSS does not guarantee secure software; in-fact, neither does proprietary software, nor government software, nor anonymous software.

As others have mentioned, assurances about software come from audits or by trusting someone reputable who has done the audit. Delivering security guarantees is not what most FOSS projects are meant to do.

So what exactly do FOSS projects do? Why are they any better than proprietary software? The short answer is that FOSS is about continuity. You can and will find FOSS projects from 30 years ago, which have been kept updated so they can run modern machines. The folks doing that didn't need anyone's permission to do that; they can just do it.

Meanwhile, if Adobe of MSFT declare that a certain proprietary software suite is going EOL and will not receive any more security updates, then the user base is SOL. FOSS gives a potential route away from this fate, if someone or some group is willing to put the elbow grease into security updates. Even if it's just one person.

So in the short term, there are no security assurances for either proprietary or FOSS. In the long term, all software cannot escape the unstoppable march of time and vulnerabilities. But at least FOSS has a chance to be corrected, years or decades later.

I guess the main thing is that it's not just one person saying "I looked at the code and didn't find any malware" - depending on the size of the project it could be millions of people saying that. Also, changes to programs generally have to be approved by the maintainer, so it can be pretty difficult to slip malicious changes in unnoticed.

The arrangement isn't perfect, but keep in mind that closed-source software also requires trust on the part of the users - It's just that in that case nobody can vet the code.

No. Software hasn't thousands, but millions of lines of code. So what did you think that programmers owe you?

Open source software is none the worse just because you can't read source code. Nobody requires you to read it.

You can decide to trust the others that have actually read the source code. Or the ones that use it without reading the source code. Or you can decide not to trust them. You are free to decide. You are even free not to decide :)

Now tell us about your freedom when you pay for Microslop.

Personally when I install some software I generally look at popularity (like stars if the code is hosted on Github), whether an audit has recently happened, it is recommended by someone I trust, and whether the permissions it needs are reasonable (I'm on Silverblue so I only install Flatpaks)

When I used to use Arch I also looked at the pkgbuild beforehand since they're generally fairly small en very human readable. I also looked at popularity there and whether the developer maintained an Arch package. But that obviously doesn't say anything about the code itself.

I definitely don't consider myself non-techy since I'm doing an an engineering masters with a CS track but those things shouldn't require any programming knowledge.

But I think most of the more common users don't really care and install the packages they need without thinking too much about it. Unless the source seems very untrustworthy.

Edit: you can never truly be certain that a project's code is safe. You can only have soft guarantees. Albeit some like formal verification are harder than others like project popularity.

Why do you compare reading the code to reading an EULA ? A nefarious or compromised closed source program can still do nasty stuff not described in the EULA.

Basically: public audit

A bunch of people better than me look at the code and post their findings. However this take time and with AI coding it’s becoming increasingly to make good audit of a code

so distros have default package managers with default configured repos. The repos are like curated stores of software. So if you trust the linux distro you might trust its default repos it uses. you can further add repos if you think they are reputable. its all sorta repuation if you don't read the code.