Talking about how these machines are open source is misleading. They (like many, many other voting machines already in use) are designed to let you run an election without actually trusting the software on the machines. From the risk limiting auditing link above:
> How Does a RLA Work?
> A risk-limiting audit examines a random sample of paper ballots, comparing them to the machine count to ensure that the winner actually won.
> The number of votes needed to manually count depends on the margin of victory. The closer the margin, the more votes we manually count. The RLA confirms that, if a full hand-tally were performed, it would give the same outcome.
Put another way, the malicious voting machine plays a game: It makes the first move by lying about the tally and incorrectly claiming that candidate X wins.
If the machine claims X won by a large margin, then a small randomized recount exposes its lie. If the machine claims X won by a small margin, then a full recount is performed.
Crucially, with high probability (it can be set arbitrarily high), the faulty voting machines get caught the first time they attempt this, and then are thrown away.
There are some voting machines in use in the US that do not keep paper trails. There's widespread evidence of systematic fraud with those machines in swing districts, going back to a least 2004. (Old paperless mechanical machines had the same problem.)