I don't understand your points about the NSA letters, which makes me think that my point was missed. I am saying that the NSA letter claiming that only some information was logged is fully independent of the open source code of the server. Assuming the NSA letter reflects the truth, there could be more information or less information that what appears to be collected from the open source server code because, once again, the server does not have to be running the open source code, and even if it were, that does not preclude other systems from running against the same information the server has access to. Hence, open sourcing the server does not affect the security of the system at all. If the system is insecure without knowledge of how the server works, then the system is insecure. Period.

I think you're trying to argue that open source is good, and I agree with you. Open sourcing the server has many benefits. The only point I have consistently been trying to make is that open sourcing it does not help with determining the security of the system, whatsoever.

edit:

> If you didn't have the NSA letter, would you be able to verify the source code?

No, but even if the code was open sourced, you would not be able to verify the code that is running.

> If another project got an NSA letter and responded to it, would it tell you anything about the source code?

It would tell you something about the code they are running, yes, but nothing about the code they open sourced.

> This is simple: Having the source code means you get to learn more from the other signals, no pun intended, of how that source code is used.

This is equally simple: the source code that is open may have nothing to do with the source code that is running, and you must assume that they are not equal when auditing the security of the system.