That is not true. In fact, the "goto fail" bug was only known because it was patched in iOS and then some folks dug into the SecureTransport sources. You may be

That is not true. In fact, the "goto fail" bug was only known because it was patched in iOS and then some folks dug into the SecureTransport sources. You may be thinking of the fact that, from what I understand, OS X was not yet patched at the time so this was considered big news (See here: https://nakedsecurity.sophos.com/2014/02/24/anatomy-of-a-goto-fail-apples-ssl-bug-explained-plus-an-unofficial-patch/ https://nakedsecurity.sophos.com/2014/02/24/anatomy-of-a-got...). Definitely an issue, but seeing as it was patched in iOS (and thus discovered in the SecureTransport source code), it would most certainly not still be in the wild. With regards to auditing: The machine code is available for review, you just need to invest some time into learning the ARM instruction set. Most users of HN have invested time into learning various programming languages and that is why the trope of "open source == more secure" is often repeated, but the truth is that ARM assembly is just another programming language and is almost never obfuscated to a point in which you would not be able to read through it and understand what is happening once you understand the instruction set.