I've been thinking about the whole xz debacle. It's demonstrated to us once again that just because a project is open source, doesn't necessarily mean that project is trustworthy. Despite this, my stance remains the same: If you can't trust me with your source code, why the hell should I trust you with my data?