> 'd rather trust my distro's package maintainers to not let developers abuse their users, and have a look at the source if I'm in doubt about the upstream's in

> 'd rather trust my distro's package maintainers to not let developers abuse their users, and have a look at the source if I'm in doubt about the upstream's intentions. Trusting 3rd parties to decide what you can trust isn't ideal either. It's what Google and (especially) Apple have for mobile apps now. They decide what you can safely install and we're just supposed to trust them. That's clearly not working. While you have the added benefit of being able to trawl over thousands of lines of code looking for something suspicious, that's not exactly scalable or even possible for the majority of users. In the end, what exactly are you looking for anyway if not signs that an application is making connections or accessing files that it shouldn't. In that respect, it's far better to have the OS just tell users when an application is doing those things (connecting to the internet, reading their personal files, or activating their cameras). The more transparency in what an app is doing the better because the reality is that we cannot trust every app we install. How could we possibly?