> With closed software people are paid to look. Or they are paid to look the other way. Or it’s just not in the budget this year. > With free (as in beer) so

> With closed software people are paid to look. Or they are paid to look the other way. Or it’s just not in the budget this year. > With free (as in beer) software nobody is incentivized to look. Only in the sense that there is no external incentive to look. Users of the open source library, however, have an intrinsic incentive not to open themselves up to vulnerability. For example, companies paying for audits for libraries they use, where the audit is cheaper than reproducing the library in total. Making code doesn’t change that incentive. It just prevents people from acting according to it.