Neither is a word which you would have associated with Microsoft ten years ago.

An example for you: Microsoft used to have an identity service called 'Passport'. They wanted to make it into a universal login, along the lines of Google ID or Facebook logins today. They created a whole suite of related services, codenamed 'Hailstorm', which they tried to bring to market under the terrible name of ".NET MyServices". And they failed because the universal reaction of the world was that they were not prepared to trust Microsoft with their privacy. (see, e.g. http://www.theregister.co.uk/2002/12/17/net_my_services_gone...)

You can't have a reasonable assurance of privacy unless your software is open source.

And that software is running on a machine that you own and control with verified open firmware running on open hardware with no known security vulnerabilities, with strong encryption on the drive and a locked bios, and not connected to any network (including the internet) where all the devices on that network satisfy the previous conditions.

If any of these are not met then you are trusting someone else with your privacy.

Going that direction, one could argue that what you open source might not be what you are running in production.

Right, you can never be 100% certain it's the same code. But it's a valuable "good faith" step that sets a level of trust between the users and developers.