>auditing the open code means nothing if and when something before that code in the stack manipulates the outcome of the code. In terms of software security vu

>auditing the open code means nothing if and when something before that code in the stack manipulates the outcome of the code. In terms of software security vulnerabilities, there is so much low hanging fruit making exploitation trivial. Even if a small team within an intelligence agency knows about a zero day deep in the stack, addressing vulnerabilities higher up in the stack that are easily exploited by script kiddies necessarily reduces attack surface. However, what we're talking about here is not so much about security vulnerabilities, as it is about design flaws (or features) which have harmful effects on society.