Really what much else could you ask for?
It only takes 1 trusted friend to verify the codebase, and from there it can spread. Luckily there are a lot of talented people on the Internet whom several people can vouch for, easy to find. It's pretty much a non-problem in the age of the Internet.
The same natural logic applies to anything else really... like cars - "yo what car do you trust?"
It's just the nature of living. If you don't have the skills, you need to find someone who does to trust. And no just because it comes from a company doesn't mean you can trust it, that's a fallacy. "Safety" doesn't necessary equate to "profits" which is what a business needs to live. It's an organism.
I don't think your car analogy quite fits, as there are ongoing updates, and it's not like the end-user perception of regular VSCode, or backdoored VSCode, are going to be any different until someone spots the backdoor (and we can't rely on that).
https://news.ycombinator.com/item?id=37261500
Why would a GitHub Action be worse? You're just telling me it is, asking me to believe that...
The car analogy is just that - you can break any analogy if you try. You've got a better one to help prove me right? :)
When I worked for one of the largest voting machine companies I was astounded how the final build process for the software was done just before it was sent to the customer. It was built on a Jenkins server that several people had access to change and update with minimal oversight and the devops person had freedom to do anything to with no oversight. For the year I worked there this one man could have changed dozens of elections if he chose to and figuring it out would have been very hard. I am sure a large enough investigation could could have figured out such a thing, but by then the damage would already be done. If he changed only municipal elections that couldn't affors such an investigation it might never have been done. I have no reason to claim this happened, but we certainly can't prove it didn't and this is in one of the most paranoid and regulated spaces in software development.
I don't know if other big tech is quite the same, but from the little I've heard, I suspect that Microsoft, Amazon, Apple, and others in that ilk are similar.
I'm very much in the camp of "trust but verify" here. You're right that Solar Winds was an utter disaster. It should never have been able to happen.
https://news.ycombinator.com/item?id=36979532 (Microsoft comes under blistering criticism for “grossly irresponsible” security)
The reason why organizations turn to other companies to deliver this is because there's a "throat to choke" for when things go wrong and a financial incentive to fix the inevitable issues when they come up.
For example, Microsoft recently "lost" (they didn't disclose what happened) some sort of authentication key that allowed Chinese hackers to break into their network: https://techcrunch.com/2023/07/17/microsoft-lost-keys-govern...
How does this even happen at a big company like Microsoft? Then you take a look at small, <100 people company, their security policies are much more strict than Microsoft's. And even if it happened the same way, we wouldn't have such high expectations because they have a small team.
Honestly, I prefer trusting a small project than a big company project. Take a look at Terraform now, HashiCorp pulled the plug and made it a proprietary app with source available requiring you to sign a CLA to prevent them from being sued later on. Red Hat is manipulating the GPL2 to force people to buy their subscriptions.
EDIT: how can we forget how GitHub was before Microsoft bought it in 2016? GitHub was much more friendly to open source and nowadays they just use any open source code available on their service to train their Copilot AI without respecting the terms of the licenses of the millions of projects hosted there. They killed Atom. They scan your private and public repos for "vulnerabilities". They literally read everything on your repo and feed it into Copilot. If GitHub wasn't sold, I'm pretty sure the situation would be different.
Call me crazy or dumb but I strongly believe that the bigger a company is, the worse their policies are. They neglect security at the cost of higher profits (ahem, looking at Facebook for allowing people to mine their users' data via an exploit that was just fixed when they called out Facebook for selling users' data).
I don't know if this is because Microsoft took down the blog posts and press releases or because Google web search sucks now (different conversation) but I had trouble finding the source for Microsoft statement. I'm talking about the incident when Microsoft spied into a user's hotmail email contents.
> However, to determine the identity of the leaker, CNET reveals, Microsoft actually looked through the Hotmail email of a French blogger who was in contact with the leaker, and make available online early copies of Windows 7 and Windows 8, as well as means that allowed users to circumvent activations protection for Microsoft and Windows.
https://bgr.com/general/microsoft-hotmail-and-outlook-privac...
I wouldn't give Microsoft any benefit of the doubt. While I have utmost respect for the people (who I know and) who work there, the senior leadership has always been poopy at best. I would never trust a word they say.
As Capricorn2481 points out though, suing isn't really on the cards for most individual.
There's basically no way to do this without trusting the redistributor in addition to the original publisher, but some things can reduce the amount of trust. Having a verifiable build process, that checks signing keys and hashes, that re-signs, etc, that all helps. If end-users can theoretically produce exactly the same build themselves it's easier to trust it.
The best option however is for the source project to produce unbranded builds themselves, and potentially for a project like VSCodium to become "config only" for things like disabling telemetry, and therefore not requiring re-signing. The Chromium project distributes its own Chromium binaries which lack the Google-specific stuff for example.
[^1]: Mostly thinking of app stores, but the same is basically true of things like Debian package repositories.
[^2]: App stores typically re-sign in the middle, so you do have to trust the store, but see (1), these companies go to great lengths to ensure trustworthiness there.