I can think of two very obvious ways two suborn lib_openssl (obvious in that a competent auditor would find them) after relatively little due diligence. 1. Cri

I can think of two very obvious ways two suborn lib_openssl (obvious in that a competent auditor would find them) after relatively little due diligence. 1. Cripple the random number generator similar to the debian bug from 2008, this would be difficult to spot through source inspection, but not hard to spot from active queries. 2. Include valid certificates in the trusted certificate store that allow the distributor to execute a man in the middle attack. This becomes even easier if the dns servers are hardcoded to be those of the attacker. Basically, if you think the US Air Force has reasons to snoop your communications; don't use their software to communicate. Linux is freely available, build your own high security distro or use OpenBSD or write your own from scratch, don't assume software is secured unless you implicitly trust the person who claims it has been secured for the purpose you are using it; and even then they might be wrong.