> To take the analogy of the Linux Kernel, if Linus and his top team
> added suspicious code, would anyone notice?

Or if someone(s) on the core team of GCC did Something Naughty. Eventually, one has to trust *someone*, even if it's the Three-Letter Agencies trusting Ken Thompson's statement that he didn't let *that* binary version of CC leave Bell Labs. Personally, I'd rather trust Linus and Co than the anonymous coders behind commercial software --- even if I don't valet the Linux sources myself, at least in principle I could.