> subscription based email service such as this where the source is fully available for scrutinizing and patching this doesn't make any sense to me. how exact

> subscription based email service such as this where the source is fully available for scrutinizing and patching this doesn't make any sense to me. how exactly do you know what code a remote server is running as a subscriber (not an admin)? you obviously can't just believe what what it prints when you click "see the source!" in a web page. they could crypto sign the code you download, but that doesn't mean they gave you what they're actually running.