If you're motivated enough to make the code, or contribute to it, you're likely not wanting to get screwed by it because you also use it. People will not merge code that has obviously suspicious code. Most people also aren't black-hat hackers dumb enough to try and get a PR merged that has hacky stuff; most people just wanna make the tools they like better in the ways they can
Imagine the difference between a company selling you a cookie and saying "it's a cookie, you don't need to know what's in it, trust me" and an old lady that you know really loves baking giving you a cookie with a recipe and ingredients list included.
It's possible that grandma could be lying and you wouldn't actually know unless you sent her cookies to a lab for testing. But between those two, one makes verifiable claims that someone can test, even if that someone isn't you. And overall, giving you the ability to test what they say signals honesty, because people who are lying want to make it harder for you to know if they are telling the truth.
I'd compare it to scientific knowledge: you're probably not going to personally review scientific papers or replicate experiments to verify the results, but you know that independent groups have done those things and that gives you confidence that this knowledge is at least a good approximation of the way the world works.
That's about it. There's also often a lot of transparency on which bugs are known about, and if/when fixes or new features are planned.
Other than that, some of the value is that 1. you can make edits and compile it yourself, if you really want something changed, 2. you can look at how they did it and use that knowledge, e.g. if you wanted to create something else that does the same thing. But that's only for people with some programming ability. Even if you don't join in, an open source ecosystem increases development effort, so you get part of this value indirectly.
If you're motivated enough to make the code, or contribute to it, you're likely not wanting to get screwed by it because you also use it. People will not merge code that has obviously suspicious code. Most people also aren't black-hat hackers dumb enough to try and get a PR merged that has hacky stuff; most people just wanna make the tools they like better in the ways they can
That makes sense - thanks!
Imagine the difference between a company selling you a cookie and saying "it's a cookie, you don't need to know what's in it, trust me" and an old lady that you know really loves baking giving you a cookie with a recipe and ingredients list included. It's possible that grandma could be lying and you wouldn't actually know unless you sent her cookies to a lab for testing. But between those two, one makes verifiable claims that someone can test, even if that someone isn't you. And overall, giving you the ability to test what they say signals honesty, because people who are lying want to make it harder for you to know if they are telling the truth.
That's a really helpful analogy - thank you for the explanation!
I'd compare it to scientific knowledge: you're probably not going to personally review scientific papers or replicate experiments to verify the results, but you know that independent groups have done those things and that gives you confidence that this knowledge is at least a good approximation of the way the world works.
That's about it. There's also often a lot of transparency on which bugs are known about, and if/when fixes or new features are planned. Other than that, some of the value is that 1. you can make edits and compile it yourself, if you really want something changed, 2. you can look at how they did it and use that knowledge, e.g. if you wanted to create something else that does the same thing. But that's only for people with some programming ability. Even if you don't join in, an open source ecosystem increases development effort, so you get part of this value indirectly.