> SSL Heartbleed. Nobody reviewed the code change by that guy. Not even the maintainer reviewed it. I think this is a blatant counterexample actually. The cod

> SSL Heartbleed. Nobody reviewed the code change by that guy. Not even the maintainer reviewed it. I think this is a blatant counterexample actually. The code _was_ reviewed. It passed the review. This just shows that security is hard and that reviews don't always catch everything. But the only reason that heartbleed ever came to light was that OpenSSL is open source. Had it not been, such a bug would have been much much more difficult to find. Yes, this is not instant, yes, it takes time and leaves people vulnerable in that time, but it did work out in the end. If a similar bug were to exist in proprietary software, there's a good chance it would never come to light at all. Save for the extremely dedicated intelligence agencies who may have the people and desire to exert the effort to find it. That's who proprietary security software helps. The Debian bug isn't a terrible example, but it simply shows that distro-specific patches aren't well reviewed, not projects in general. Most people who want to see OpenSSL code go to OpenSSL, not Debian. Bugs happen, reviewers miss things or may not look in the right places. Open source does not mean secure by any means, it simply removes some requirements of trust of a sole entity and eases reviews.