content: but closed source is inherently insecure.   It is inherently insecure. It has a different probability of being insecure, depending on how many people work on it and know what they are doing.  open source software is less likely to be part of built-in mass-surveillance dragnet style exploitation  Except it is, there's plenty of OSS tools used in mass-surveillance. In addition, with open source the NSA and others can find currently unknown zero-day's to exploit until they are found. That's a lot more difficult with closed source.  It's true that to the average end-user downloading and installing binaries, both open and closed source are equally opaque, however in the same way that one trusts science even though one doesn't have the equipment to personally replicate every experiment, knowing that there are experts in the field that are able to, and would reveal flaws in the research  The intent behind science and software is different, sort of. Science is a system. Software is not. Science, to make money, needs to be open because if not -- PEOPLE CAN DIE. Software, less so. Perhaps one day we'll take software security more seriously, but to be honest where we are now is leaps and bounds ahead of where we were 15 years ago. I mean leaps and mother fucking bounds ahead. I don't know how old you are but you don't want to know how insecure 95/98/ME was. Even XP didn't have a firewall until SP2.  problems are able to be discovered and corrected, vs taking something in a black box that nobody can see into.  One could argue that if you can't see, it's more difficult to hack -- security through obscurity works in real life.  A full updated Windows 7 machine, full updated Mac OS X Macbook Pro, full patched Mint box, and OpenBSD box are all equally secure in and of themselves. This has been shown over and over and over and over to the point you laugh at people who say and OS is insecure if you have a clue and by secure we mean remote exploits. In this case Mac and Windows, which are closed source, prove a solid point: It can be done within reason. This doesn't mean hackathons don't try, they do. It's just, as best as I know, they've had to loosen the rules day by day until something happens. Day 1 is usually stock install, nothing special. Get remote access without user input or help. That hasn't happened in a while last I looked it up. This is not insignificant. This would be like comparing the safety of an older car (without a crumbling zone) to a modern car (with a crumbling zone + airbags + seatbelts). We're not perfect but holy fuck have we made progress. The vectors are third party softwares which is nearly inescapable on any OS, regardless of if they are open source or closed. Historically speaking, there are just too many bugs in them period as those developers lack the same skills and concerns. In addition, the methods of entry currently primarily take advantage of idiotic users clicking and running things they shouldn't. These are commonly known as trojans. No OS can avoid stupidity without seriously inconveniencing the user, which usually has the user diable that security system (remember how much people hated XP and Vista for this? It's like getting annoyed when you have to use sudo or when prompted for admin access on your mac). Leaving the other main vectors as Java and Adobe Acrobat. Most browsers (should) limit Java pretty harshly now, so that's much less of an issue than it was leaving Adobe Acrobat which is a nasty beast. Of which there's not really any alternative that's open source that competes. Or even closed source. They are the big dogs of the PDF game. By that I mean for businesses, not for Joe Blow who just needs to read and doesn't need OCR, form filling, form editing, etc. Few programmers that I know take enjoyment in security bug hunting, whether they are in open or closed source environments.