I don't trust the "many eyeballs" approach anywhere near that much. I doubt that a lot of people will look too closely at something dhh supposedly committed, an

I don't trust the "many eyeballs" approach anywhere near that much. I doubt that a lot of people will look too closely at something dhh supposedly committed, and even if they were worried by what they saw they may put trust in the system (and the "developer") and decide that they're simply misreading it. Bottom line is "someone will probably see the exploit" is a gambler's approach to security.