[kylebrown]

Anyone can run a validator node, and you have total control over your own UNL (usually published as ripple.txt). It is true that the current network of validator nodes isn't very diverse, but rippled has only been open source a couple of months. That will change as more gateways come online (e.g. the xrptalk validator node has snapswap in its UNL, as you can see https://xrptalk.org/ripple.txt).

OpenCoin/Ripple Labs can't steal funds at any account (unless they have the private keys to that account). They could attempt to freeze an arbitrary account by ignoring any broadcasted transactions associated with that account, and only voting on candidate sets which don't include them. But that would be noticeable, as the transactions would get stuck in the candidate sets of all the honest nodes. If there are enough honest nodes with overlapping UNL's, then the Ripple Labs nodes would have to accept it, or be split/forked from the network.

The paid transaction fees are destroyed, so they are effectively paid to all XRP holders, in proportion to their holdings. This is actually similar to the proof-of-stake scheme in ppcoin.

Also, the base fee gets changed by upgrading rippled. There is a pseudo-transaction associated with changing the base fee and the minimum reserve, but these pseudo-transactions are used to prevent the network from agreeing to a fee change (or implementation of new features) until enough validator nodes have the upgraded ripple (upgraded nodes will "vote" on the fee change).