[scarface74]

I agree with that assessment, but how many vulnerabilities have been found in closed sourced software? If the software is popular enough, someone somewhere is going to find a vulnerability whether it's open or closed source. Look at all of vulnerabilities that Google has found in closed sourced software. It just takes more skill to find vulnerabilities and incentives. The black hats have found vulnerabilities in iOS that Apple still hasn't managed to patch - like the one that lets law enforcement break into a locked iPhone and bypass the fail login attempts.

[schrodinger]

I think the question is is the likelihood of the party finding the vulnerability being a “good guy” or a “bad guy” different between closed and open source. I’d suspect not, but who knows.