The argument here is that open source code can be verified where closed source is explicitly non-verifiable by nature.
> but that the binary was built from this code
Doesn't code signing address this? If not could you explain (for my own learning)?
https://en.wikipedia.org/wiki/Code_signing
> that your operating system and every layer below it is also trustworthy.
Yep, this is the last major piece for true security in my mind. Although there is some movement in the open hardware space as well as USB mounted OSs (http://gizmodo.com/try-the-super-secure-usb-drive-os-that-ed...).
> I stand by my claim that using software written by a malicious developer is game over in the vast majority of contexts.
Sure...perfectly accurate...but in the context you are implying that WhatsApp is malicious. To which I think "hackuser" was interpreting as "closed source is malicious" and therefore offering open source (and by implication Signal) as an alternative.
Might just be a miscommunication moment :-)
This is not a belief that people who actually do software security audits hold. Verifying binary only software is table stakes to a security audit of a third party application as you cannot trust the source provided.
Having source is a bonus for security audits not a requirement.
I stand by my claim that using software written by a malicious developer is game over in the vast majority of contexts.