And I was wondering: is that really true? While it is true that anyone can see and audit the code posted on a public github repo, is there anyone who really does it? If an NSA dev' would insert malicious lines of code in, say, OpenSSL, how much time would it be until someone notices and the word spreads out? From what I understand, OpenSSL's code is extremely complicated and there mustn't be more than a handful of people able to understand it all.