Sure, but that is no reason to lump all open source software together either.
Some 'closed source' software is total crap too, but there we say 'product x sucks'. Here the fact that something is open source is taken to imply that all open source is dangerous simply because it is open.
It's a veiled way to promote security by obscurity. If you can't see the leaks we'll all pretend they don't exist.
Anyway, you're the last person on the planet I should argue that with :)
By and large, I think open source is a huge win for security. At the same time, if you made a list of the top security debacles of the last 20 (fuck I'm old) years, that list would certainly include:
* Sendmail
* BIND
* CMU SNMP
* WordPress
All of these are open source.
Also, while the list would clearly be headed by Microsoft Windows, commercial software can do something open source can't. Pre XP SP2, Windows was a debacle. Then Microsoft spent 8-9 figures on security, and within 4 years, MSFT led the industry in code security. Sendmail is still a bad bet.
Again, don't get me wrong. If you have a choice between a random open source project and a random commercial project, and each is over some reasonable threshold of popularity, you're better off with the open source project almost every time. If you're a closed-source vendor and you aren't Microsoft, chances are your code is quite poor. It is at least harder to hide sheer awfulness in open source code.
But in any case, the reason I commented was, we can't cop out on the WordPress security debate by saying "it's open source, so the standards are different". WordPress is the Sendmail of our times. Lots of pro-bono effort went into it, but that can't obscure the fact of its very poor security design.
I'd say that because something is open source means that we can have a rational conversation about whether it's well-designed -- because we can look at the source code and evaluate it. It's almost impossible to have a rational conversation about the design of closed-source software, simply because there's no evidence to work with.
