its a plus and a minus. Verifiably open source packages are a net positive to security because it ensures the code running is the same code that has the public

its a plus and a minus. Verifiably open source packages are a net positive to security because it ensures the code running is the same code that has the public's eye on it. People keep forgetting this, because they spend most their time thinking about security in the terms of a enterprise system, but for a personal usecase, an app extracting data to their servers that i was not expecting is a info leak security breach. Its just that acknowledging that fact requires treating most operating systems (ubuntu, (but not debian) android, and ios included) as malware and this is a uncomfortable position.