I don't dispute that that's a benefit, I do dispute that it's a big enough benefit to counter all the downsides from the perspective of a regular user. Part of

I don't dispute that that's a benefit, I do dispute that it's a big enough benefit to counter all the downsides from the perspective of a regular user. Part of this is that I think the whole "programmers eyes" benefit is over stated. "Can be examined" and "is examined by people who know enough to do a useful assessment" are different things. The number of programmers who really understand security isn't that high and the number of those who are committing time to review this sort of code is a fraction of this. Most exploits aren't down to subterfuge, they're down to incompetence and the people coding (and reviewing) Linux are no less prone to that than those working on Windows or OSX. Those programmers are still human and still make mistakes. Oh, and not everyone reviewing the code has my best interests at heart. I'm not saying that security through obfuscation is good (it's not) but nor is openness without some drawbacks - on balance it's good but it's two steps forward, one step back. And even if there are exploits in there for the NSA and the like, that's not actually that big a deal for most people. Don't get me wrong, I don't subscribe to the "privacy is only for those with something to hide" line, but security is about trade offs, and I can't see that the potentially greater security that comes from the code being open isn't worth the trade offs that come with it for non-technical users. For me the positive thing about OSS is that to a large degree it keeps the competition honest. OSS keeps a focus on security and openness that I don't think existed in the same way before it was so prominent. I think this is a massive benefit, just one that I don't have to use OSS to take advantage of. Because of this I love that OSS exists, and benefits from the fact it does, I just don't want to use it.