> if you have the source code, you don't have to trust the package maintainers I wouldn't go that far. It's possible for a skilled malicious developer to conce

> if you have the source code, you don't have to trust the package maintainers I wouldn't go that far. It's possible for a skilled malicious developer to conceal malicious behaviour in their code, to make it hard to detect and plausibly deniable as a bug. Speaking of which, I've never understood why SELinux is adopted so uncritically considering it was developed by the government agency behind [0]. [0] https://www.schneier.com/blog/archives/2013/09/the_nsa_is_brea.html https://www.schneier.com/blog/archives/2013/09/the_nsa_is_br...