>But people can casually look at code and see vulnerabilities, any time they want. I think you're dismissing the level of experience, smarts, and inter-discipl

>But people can casually look at code and see vulnerabilities, any time they want. I think you're dismissing the level of experience, smarts, and inter-disciplinary knowledge it takes to find a bug like this. More than likely, even those with all those skills and at the 1% of them can't just eyeball code and go, "Ah yes, here." They're instead writing a lot of little tools and seeing what they can break. Then they go back, see what broke, and work out if its possible to exploit that exception or crash condition. These types of tools and methods work just as well with closed source. Attacking closed source seems very unfair to me in these scenarios.