And to a large extent, there is automatic software that can audit things like dependencies. This software is also largely open source because hey, nobody’s perfect. But this only works when your source is available.

It’s safe because there’s always a loud nerd who will make sure everyone knows if it sucks. They will make it their life mission

Also because those people who can audit it don’t have a financial incentive to hide any flaws they find

My very obvious rebuttal: Shellshock was introduced into bash in 1989, and found in 2014. It was incredibly trivial to exploit and if you had shell, you had root perms, which is insane.

env x=‘() { :;}; echo vulnerable’ bash -c “echo this is a test”

I would argue that even in that scenario it’s still better to have the source available than have it closed.

If nobody has bothered to audit it then the number of people affected by any flaws will likely be minimal anyway. And you can be proactive and audit it yourself or hire someone to before using it in anything critical.

If nobody can audit it that’s a whole different situation though. You pretty much have to assume it is compromised in that case because you have no way of knowing.