content: You raise several good points. On the flip side, though, OSS in these senses is really the first layer of security. When you allow your software to be open-source, that alone tells the community you have nothing to hide in the source code. That tells everyone you are willing to have security auditors, programmers, volunteers, debuggers, whoever take a look at your code and make sure it is secure and make sure there are no glaring privacy issues. While most users certainly can't or won't inspect every line of code in their software or extensions or compile it themselves or whatever, open-sourcing provides a layer of security there for everyone that allows at least a decent sense of confidence that it's not been tampered with.