Playing around the paranoia, don't you think the NSA would have taken a minute to think, Gee we forced Microsoft and Apple to include backdoors in their OSes, maybe we should now tackle the OS that powers 90% of the web? You know maybe we could slip a backdoor in the one of the utility apps such as "htop".
Let's get serious, OpenSource is not always = Secure and Closed Source does not always = InSecure. Truecrypt is the perfect example: Open sourced but too complex to Audit, maintainers identities are unknown and offered binaries differ from manual compilation.
A good rule of thumb: Assume anything you din't write or can't audit as insecure.
http://www.linuxjournal.com/content/allegations-openbsd-back...
Not sure what was confirmed on that story, but I remember reading it and thinking there wasn't much chance that I'd ever be able to audit my own system.
http://cm.bell-labs.com/who/ken/trust.html
Ken Thompson, 1984, explains how to get a system with perfectly clean source code to compile a hacked 'login' binary every time.
"In demonstrating the possibility of this kind of attack, I picked on the C compiler. I could have picked on any program-handling program such as an assembler, a loader, or even hardware microcode. As the level of program gets lower, these bugs will be harder and harder to detect. A well installed microcode bug will be almost impossible to detect."
https://en.wikipedia.org/wiki/TrueCrypt#Licensing_and_Open_S...