I understand what you're saying. On the idealistic side in the battle between idealism and pragmatism, you're trying to negate the premise that the other side's instruments are even useful. If you can't be certain what the closed product does, how can it be a reliable source of data?
Put another way: if your goal is to not ever harm your child, how can you responsibly feed them applesauce or let doctors administer them medicine when you can't be certain what went into the making of the applesauce or of the medicine?
With a very rigorous standard, you can't. With the most rigorous standard, you can't even if the chain of trust has a single link, and you'd only use food or medicine that you, yourself, produced. But we know that few, if any people, use such rigorous standards, and that, if they did, they'd be much worse off. It's not a perfect analogy for software or hardware, but it's certainly a salient one. With your standards, it's malpractice all the way down[0].
Put another way: if your goal is to not ever harm your child, how can you responsibly feed them applesauce or let doctors administer them medicine when you can't be certain what went into the making of the applesauce or of the medicine?
With a very rigorous standard, you can't. With the most rigorous standard, you can't even if the chain of trust has a single link, and you'd only use food or medicine that you, yourself, produced. But we know that few, if any people, use such rigorous standards, and that, if they did, they'd be much worse off. It's not a perfect analogy for software or hardware, but it's certainly a salient one. With your standards, it's malpractice all the way down[0].
0. http://wiki.c2.com/?TheKenThompsonHack