Do you keep track of changes to open source projects you use?

While OSS is often hailed amongst privacy enthusiasts for the transparency it provides, this can be more of a possibility than an actuality - while code audits and peer reviews are *possible*, one often *trusts* someone is *actually* doing them. In theory, one should *trust, but verify*. In practice, doing that for every OSS one uses, and moreover to every change to every software (and its dependencies!), is simply impossible.

Even doing it for just a few projects can be …

audits code doing open source oss privacy projects reviews theory track transparency trust verify