> They could easily configure it to be malicious one time out of a million (say); what are the odds that they would be caught? How could they do that easily? T

> They could easily configure it to be malicious one time out of a million (say); what are the odds that they would be caught? How could they do that easily? Their source code is public, and many third parties work on it and produce their own compiled versions - plus every security people tracking unexpected connections would catch it.