[pasta]

This also can happen in open software. So I don't think your comment is valid.

Open software enables people to take a look inside to what is going on. It isn't a cure for bug free development.

[fstephany]

It reminds me the KMail bug: https://www.ctrl.blog/entry/kmail-cve-2017-9604-openpgp

Some security bugs exist in the Linux/BSDs kernels for a loooong time before someone notice and fix it (e.g., https://media.defcon.org/DEF%20CON%2025/DEF%20CON%2025%20pre...)