So get gentoo, if you're that paranoid

"How do we know these mismatched binaries don't include some sort of malware?"

So get gentoo (http://www.gentoo.org/) if you're that paranoid, and compile everything yourself. Of course, just compiling KDE or Gnome take an afternoon, and OOo isn't much faster either. And generally, it's the choice for tough guys whose time is worth nothing, and who think the stone age and chipping your own flint spearhead was the golden age of user-friendliness.

But in the end, it boils down to trust. If you don't trust Debian's binaries as they are, why would they trust them with sources included? Just because both the source and the program say version 3.5.19.7, isn't some kind of foolproof guarantee that noone added a bit of malicious code without changing the version number.

Heck, even if you compile everything from scratch, if you use their compiler to start the whole thing, I'll kindly point out the ancient story of the compiler which would:

1. add a backdoor to the login handling, when it recognized that piece of code, and

2. added a bit of extra code to handle 1 and 2 to its own code, when compiling itself.

So you'd look at the sources of the compiler and see nothing wrong. The malicious bits were removed from the source after compiling the malicious executable, since they weren't needed any more: the "infected" compiler would add those bits anyway when compiling itself. compile them with itself, and get a bit more than the sources said you'd get.

How paranoid do you want to be there? Which starting point would you really trust, to start that cycle from?

Or you could just realize that the Debian guys probably have better fish to fry than pwning your computer to send viagra spam ;)

Untidy, and GPL isn't the real problem

It's the way that, when sources are included, they don't match the binary.

How do we know these mismatched binaries don't include some sort of malware?