It's not even a solution for software that isn't Audacity :) I run a good chunk of OSS software, and I pray to the gods every day that somebody somewhere actua

It's not even a solution for software that isn't Audacity :) I run a good chunk of OSS software, and I pray to the gods every day that somebody somewhere actually read all the three bazillion packages I need to install as dependencies. (Why does ffmpeg require a DNS resolver again?) Yes, theoretically all that is out in the open and would be found by somebody. Practically, nobody has time to verify all software they run, and the smaller/less interesting packages are basically completely taken on trust. There is no solution outside of trust. You are running things that vastly exceed the complexity you could fully understand in several lifetimes. You have to trust somebody it does what it says on the tin. I'm fairly certain that OSS has survived so far because exploits there would mostly target small groups of people. (In the end-user scenario. The server/commercial user scenario is different, and often gets attention from several companies for each package)