Is Open Source Too Open for its Own Good?

Glyn seems to be in need of clicks. While the basic questions are in themselves valid, the onesided framing of these questions in relation to FOSS is not. It is universal to ask if we can trust code, can trust people or organizations. This is equally valid for FOSS and CSS.

Glyn is trying to paint a picture in which it seems that being open makes these areas of concern particularly pertinent to FOSS. In reality it doesn't matter if code is open or closed when it comes to trusting people or organizations. Trust of people/organizations is not inherent to the actual software. It is a judgment call outside of lines of code.

When it comes to the potential of backdoors lurking is source code... It is possible, but in the case of FOSS it must be highly sophisticated, because any malware needs to hide in plain sight. The code is out in the open and everyone can vet through it. Contrast this to CSS, where only the entity writing the code can see it.

In theory it must be far easier to compromise closed source software. The number of people working on it is relatively small and it only takes one act of successful corruption to get malicious code embedded into it. When it's there, no one else from the outside can check if the code is safe and uncorrupted.

I think it is time to put the corpse of "security by obscurity" on the pyre once and for all.