I think this is a good taxonomy/sequence to note 1) Observing 2) Understanding as bad 3) Reporting (or fixing) 4) Closing the loop on remedy Both proprieta

I think this is a good taxonomy/sequence to note 1) Observing 2) Understanding as bad 3) Reporting (or fixing) 4) Closing the loop on remedy Both proprietary and open code runs into problems at (3) because people don't want to hear it, for commercial or ego reasons. With FOSS at least you get the direct intervention route of simply fixing and publishing the patch, which done responsibly may or not force a maintainer's hand. With proprietary you can piss into the wind and be ghosted, or sued, hence more irresponsible/anonymous disclosure. Anything that maximises the likelihood of getting from (1) to (4) safely must be a good thing, so I think FOSS yields the better security model.