> "To an intelligence agency, a well-thought-out weakness can easily be worth a cover identity and five years of salary to a top-notch programmer. Anybody who p

> "To an intelligence agency, a well-thought-out weakness can easily be worth a cover identity and five years of salary to a top-notch programmer. Anybody who puts in five good years on an open source project can get away with inserting a patch that 'on further inspection might not be optimal.'" That is true, but it's true for every attacker, not just the government, which changes the situation quite a bit. There is a very strong incentive for security experts to look very carefully at every patch to, say, OpenSSL. Few things are better marketing for a security firm than revealing a critical hole in security infrastructure. In fact, the high price of such an exploit on the black market works in our favour as well. Tons of black-hats are looking for holes, and when they find and sell one, the subsequent exploitation is bound to raise some red flags and eventually point white-hats in the right direction. Basically, "You can fool all the people some of the time, and some of the people all the time, but you cannot fool all the people all the time"