>given that it is open source the people doing things are under no obligation to talk about it, it is hard for anyone to know everything being done. Actually,

>given that it is open source the people doing things are under no obligation to talk about it, it is hard for anyone to know everything being done. Actually, by nature of being Open source there's 100% increased likeliness they'll talk about it - they simply can. It's the thousands of security consultants working under NDA doing code review for software companies that legally cannot talk about it, even if they did want to. > Anyway, my point is that these sorts of things only happen with OSS. That's not correct. Software companies have much bigger budgets for security tooling than open source projects. They've got access to clang and coverity as well as a host of other tools that cost hundreds of thousands of dollars. > The same goes for non-profits devoting money to auditing code (which the Linux Foundation announced last year). You definitely will not see that happen with proprietary software. This gives OSS an intrinsic advantage. This is really awesome, I'm loving seeing this happen. But For every 1x security review of say truecrypt, you do realize that Microsoft and Apple would've had those exact same experts audit their own implementations several times a year, right?