I wish this type of comment wouldn't inevitably come up in these discussions. Not only is it fundamentally wrong but it's actively harmful to improving securit

I wish this type of comment wouldn't inevitably come up in these discussions. Not only is it fundamentally wrong but it's actively harmful to improving security and privacy by scaring people away from things that may be just fine and that are probably better than a lot of the insecure alternatives they'll actually use instead. To the extent open source matters at all when looking at E2E encryption, it theoretically makes it easier to see whether the source code implements a secure protocol. This sounds much more useful than it actually is. For one thing, almost nobody is compiling the source code themselves, so you're ultimately going to have to evaluate the security of compiled code anyways. Also there is an incredibly vast gap between the promise and reality of the open source promise in terms of finding security problems. Accidental or deliberate weaknesses can be subtle and hard to find whether or not you have the code. The extensive history of serious cryptographic problems living in open source code for years before they were found and people regularly being able to find problems in software despite it being closed source suggests open source as a security panacea should be taken with a large grain of salt.