Most importantly, how do you check the binary you are running is actually built from the source code the vendor says it is if the source is not open ? They mig

Most importantly, how do you check the binary you are running is actually built from the source code the vendor says it is if the source is not open ? They might sincerely thing so, not knowing they were targeted and now all the binaries they ship are also containing a payload added by the attacker. With open source software and especially the Linux distro model where one set of people writes the software and another buikds it from source and integrates it is much harder if not impossible to pull off such an attack affecting all users of a piece of software.