> their own (say) HTTP library, riddled with bugs which will never get fixed, because it will never have the same person-hours sunk into it that a (major/respec

> their own (say) HTTP library, riddled with bugs which will never get fixed, because it will never have the same person-hours sunk into it that a (major/respectable) FOSS HTTP library will. The interesting trade-off here is that they probably aren't going to make the exact same mistakes as everyone else. Which means more vulnerabilities, but fewer industry wide vulnerabilities where everyone gets pwned. I'm not sure that's worth it, but it is something that should be mentioned when discussing the situation. edit: me -> be