Update: Having discussed this with Chainfire, I thought it would be a good idea to add some clarifications here. There are many reasons for software to be open or closed source, and the security of it is not determined by the availability of its source. There's a lot of very secure (and well written) closed source software out there, and a lot of poorly written open source software out there - you only get the benefits of open source if good and competent security experts actually read and audit it.

Root. It's a word we're mostly familiar with here. Despite the ever-increasing attempts by Google to make it harder to achieve and use (and most likely this will continue, with the predicted convergence of the heavily locked-down ChromeOS and Android platforms), rooting remains incredibly popular on XDA.

Indeed, an entire ecosystem has formed around it, and apps which make use of the elevated access offered by root to realise customisations and modifications which would otherwise be prevented by Android's security model.

Many years of changes made to Android to make gaining root more difficult

When customisation of Android first began to gain traction in 2008 and 2009, the first "real" customisable Superuser solution was by Retired Recognized Developer, ChainsDD. This allowed people to control which apps had access to root, and which ones didn't, through a graphical user interface, which was the precursor of what we know today. The source code of the application and su binary are still available if you want to take a look at it.

 Fast forward, and step through many years of changes made to Android to make gaining root more difficult, both for malicious software, and for users, a lot has changed. Indeed, it's currently necessary (at least on Android 6.0) to make changes to a device's kernel ramdisk (boot.img), meaning that root on a device without an unlocked bootloader is something you likely won't be seeing any time soon.

Nonetheless, until recently, your root option was pretty much SuperSU. Which was a big improvement upon the older root solutions, which didn't handle the new and modern complexities like SELinux policies and constraints. The only problem was that SuperSU was (and is) closed-source software. As the gatekeeper to what amounts to absolute control over your phone, this is something which really ought to be open source, and auditable. Until now though, most people just trusted XDA Senior Recognized Developer, Chainfire, to do the right thing, which given his reputation and standing is not really a problem.

The problem reared its head, though, when Chainfire announced the acquisition of SuperSU by a previously-unknown, and unrelated third party. For something as important as root access though, this caused consternation amongst users; it's really important that users trust it - imagine if your Superuser application was configured to allow certain apps to have silent access to root, without you knowing. The developer could do this for their own applications, or for other developers that paid for this access. Nothing suggests this has happened or would happen, but it remains a possibility for a closed source Superuser solution. Alternatively, it could start to show intrusive adverts. You'd really have little option to block those, since it has root access! Root access is powerful, and any kind of change to something this powerful can make people a bit nervous.

Fortunately though, in the spirit of XDA, a group of users have converged to attempt to create a true, modern, Superuser solution, which will be fully open source, and developed by the community. This, once completed, will give users a choice between using a proprietary root solution from a new company of unknown reputation, and one which is open and transparent, and developed by the community.

A choice never hurts anyone, and when it comes to root access, having more than one choice is essential for your security and privacy

Regardless of which root solution you do use, though, having a fully open source version available, as a strong alternative to any commercial or proprietary offerings, is incredibly important. It actually will benefit users of the proprietary one as well -- the mere presence of a viable alternative is essential in ensuring that the developers and new (unknown and currently untrusted) owners of SuperSU act in the public interest. With no alternative, there's nowhere to go if they act with impunity. On the other hand, with a strong open-source alternative, there's a strong incentive to act in the interests of users, rather than risk significant reputational damage, and see an exodus of users elsewhere.

For that reason, I encourage anyone with the relevant skills to get involved in the open source project. To have a community-led, high-quality Superuser solution, which is based on entirely open-source software, will be beneficial to the whole community, including those who want to keep using SuperSU. A choice never hurts anyone, and when it comes to root access, having more than one choice is essential for your security and privacy. Development is in the early stages, and is ongoing on Github, with the patches to the boot images being discussed in the issues section of this repository, and the Superuser app itself being developed in this repository.

Why not get involved in the discussion or get involved in the development, by joining the discussion thread on the forums? Let's make a truly community-led, open-source, auditable Superuser solution, and ensure there's always going to be the option to use entirely open-source software to gain and control root access on your phone.