Frankly, I have trouble believing that you don’t understand the difference here and are making your argument in good faith.

Let's back up to what I replied to in the first place:

You don’t have to trust anybody

I even took the time to quote that, because it's important.

Of course there are different levels of trust. But what you said is flatly wrong and misinformation, if you want to get technical about it. Arguing in bad faith? I beg your fucking pardon, friend.

Just becuase it's less likely to find nefarious code in open source doesn't mean it doesn't exist. There ahve been multiple cases of it found in open source code. Blindly trusting something because it's open source or you host it on your own server is a very very false sense of security, especially in the context of the larger discussion, which came about in regard to what information is exposed by certain messaging clients.

It's also a matter of the importance of what you're doing.

I wrote a little CRUD app a while back to track me giving my cat medication. I sanitized inputs, but I left it open without a login on my server, just an obscure URL that didn't get published anywhere. All you could do was click a button to indicate the cat had been medicated, or another button to delete the latest entry. That was plenty of security for that. If I was writing a banking app, I'd use a bit more.

So yes, in the same way as that, hosting something you use to chat with friends about whatever is one thing; trying to communicate secretly from a country where your comms might lead to being put to death is quite another. And in the latter case, it's important to know that no matter what you use, unless you wrote it or read all the source code, you are trusting others with your life. Perhaps you feel comfortable doing that, but you should be aware of it.

So no, this is not a discussion in bad faith at all, it is valuable on multiple levels.