> If I were to screw you, I can very well do it with an open source product and pre-compiled binaries. This is even easier to do to closed-source products, and

> If I were to screw you, I can very well do it with an open source product and pre-compiled binaries. This is even easier to do to closed-source products, and if you're worried about security than compiling your own binaries is a pretty basic measure. It is not just that open source software is inherently more trustworthy than closed source software. 1. It is more resistant to backdoor attacks (related to trustworthiness) and more effectively hardened. Fundamental to security is transparency. You cannot secure something if you cannot understand its attack surface; insecure undocumented features (ie the recent iPhone discoveries[1]) and binaries accidentally (or "accidentally") compiled with debug flags are only detectable if the source is available. 2. It is often more nimble and can respond to new threats which closed-source projects ignore. At my work, we were hit by as USB virus that McCaffe ignored despite our very premium support plan because it didn't exist anywhere else. This was before my time, but from my understanding it was a custom-tailored attack that was made in a virus creator -- a drag-and-drop not-so-advanced persistent threat. (Probably a prank or experiment; I work at a school.) If we used open source software, and the community shrugged at us, we could at least make our own signature. At it was, we had to bring the computers down one at a time, boot them into Linux, and run a script to delete the files and registry keys. This is the job antivirus software is meant to automate. I understand virus companies have a heavy workload, but what exactly were we paying for? With open source, you always get your monies worth. (For the software at least; open source support plans can still suck.) 3. Appsec is expensive, its not always something you can afford to pay for. If you aren't designing with security in mind from the start, its not just a feature you can build into your app. It will require pentests and likely a partial rewrite. On an open source project, theres a good chance someone will volunteer to close at least the widest holes. No one volunteers for closed source. 4. This is likely not a part of your threat model, but its harder to serve an open source project with a national security letter. [1] http://www.theguardian.com/technology/2014/jul/23/iphone-backdoors-surveillance-forensic-services http://www.theguardian.com/technology/2014/jul/23/iphone-bac...