>In my experience nobody reads the source code before executing it Joe Schmo isn't going to be auditing it, actual security researchers are. Heartbleed was onl

>In my experience nobody reads the source code before executing it Joe Schmo isn't going to be auditing it, actual security researchers are. Heartbleed was only discovered because some research firm was auditing random open source software. Imagine how long the exploit would have gone unnoticed in a closed source application. Now imagine if said exploits were intentionally added and used by the software authors since day 1.