I read the codex source code it linked me to.

Unless you are building from source yourself that means exactly and precisely zip.

I'm using the codex package from the official Arch Linux repositories.

https://gitlab.archlinux.org/archlinux/packaging/packages/op...

Is there any reason to believe Arch Linux is compromised?

Did you also build the compiler?

https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_Ref...

> Perhaps it's more important to trust the people who wrote the code

Yeah... about that.

> > Perhaps it's more important to trust the people who wrote the code

> Yeah... about that.

Well done. You presented a straw man and drag poor Ken into this, and then proceeded to burn it. +1. Yeah, it is precisely about the people behind the product. To wit, I may not have liked the Gophers but I did trust them to build a trustworthy compiler.

Eh? I was pointing out that by volume of code written now I suspect it's not people writing it any more, it's machines that don't understand context writing it for people who don't bother to read what it's writing (or often couldn't understand it if they did).

Trust but verify except no one is verifying (not that I trust it either).