The argument that security through obscurity isn't security is that when it is open there are more eyes that can see security flaws within the code and get it f

The argument that security through obscurity isn't security is that when it is open there are more eyes that can see security flaws within the code and get it fixed vs. just the people attempting to exploit it. Not having access to the source might obscure potential vectors from attackers, but at the same time, those vectors might be fairly discoverable without the code, or they might be quickly fixed if more people were looking at the code. I don't think anyone in this comment thread has the data to truly argue one way or the other. The open source world is obviously the easiest example here - there have certainly been plenty of exploits that people started using in the wild before any of the "Good Guys" caught it. But there's also been huge numbers of security bugs quietly fixed because some random person saw it and contributed a fix. And plenty of the highest visibility exploits over the past decade have been found by security researchers unrelated to the projects utilizing the open source code was part of their toolkit in finding issues. If it was closed source, would the "Good Guys" have found it before the "Bad Guys"? Who knows! You'd need to actually compile and analyze all this data to have a strong argument that isn't just people going off of what sounds the most logical to them, and there's also all sorts of confounding factors that would need to be accounted for, like value of the potential target, overall popularity of the codebase, etc.