There was also the Apple “goto fail” bug in their open source TLS code[0], which was so shockingly obvious that it would have been found by compiler warnings, y

There was also the Apple “goto fail” bug in their open source TLS code[0], which was so shockingly obvious that it would have been found by compiler warnings, yet it was not. I myself have on occasion found high priority bugs (not security issues) in open source projects with many eyeballs, simply by turning on additional compiler warnings. The fruit out there hangs very low. Openness counts for nothing if nobody is reading the code. Open is better than being closed source but the difference is marginal. The real difference is made by having the code reviewed by security professionals, and by how the project is maintained/lead, and those are orthogonal to open/closed source. [0] https://www.imperialviolet.org/2014/02/22/applebug.html https://www.imperialviolet.org/2014/02/22/applebug.html