[ranger_danger]

I think it's a common misconception that just because source is available, people are actually looking at it properly.

The number of new security bugs that e.g. LLM models have been finding lately, most of which are very old, are staggering.

[jolmg]

By way of bugs (unintended effects in code), who knows how it compares to proprietary codebases. Those also depend on the particular companies.

However, by way of intentional code that goes against the interests of the user, which would be considered security issues with FOSS but not with proprietary codebases where the interests of the company come first, things should be better with FOSS.

The latter should also be more noticeable than the former. It's possible some of the former may not have run at all, neither accidentally nor intentionally. A bug can just stay dormant without ever surfacing in practice. The latter is there to be used.

The benefit of FOSS with respect to eyes is that those eyes are better aligned with the interests of users (since it's the users looking) than the eyes on closed-source code.