True, but you can inspect BSD-licensed source just as freely as GPL'd code too.

Not that that's much use against a malicious distributor, who could disguise malicious code so that it passes inspection: http://underhanded.xcott.com.

(Oh, $DEITY I don't want to get involved in another BSD vs. GPL thread, but I just can't help myself...)

You can't inspect the source of something BSD-derived that's distributed as a binary (which I suspect is the point of the parent poster).

Interestingly the GPL sort-of stipulates that the recipient of the software should be able to build the software from source. This would allow a sufficiently paranoid recipient to inspect all the source and compile said source. (Ken Thompson's caveat notwithstanding.)

Paranoid me is stuck between a rock and a hard place—I don't want to have to trust a ton of third parties with my security, but I'm unlikely to be able to ensure it on my own and still benefit from modern technology.

That's not just because I depend on proprietary software—frankly, there's no way I could audit every line of code that runs on a Linux system that solves the problems I want it to solve, and even if I could, it's almost guaranteed I'll still miss something critical in the process.

But that's another topic. If I think it'll buy me something, I'm free to audit the source to both GPL and BSD-licensed software. I can't audit the source to proprietary derivatives of BSD-licensed software, but if I choose not to run it that doesn't hurt me any more than it hurts me that Windows continues to exist despite my refusal to use it.

In other words, I'm still free to make choices that preserve my freedom, no matter what another group chooses to do with their derivative works of software I run.

Ken Thompson's caveat has a solution: www.dwheeler.com/trusting-trust