&quot;Ownership is a single point of failure.&quot;<p>Ownership can be a single point of failure but someone owns copyright to GPL code, too. Trick is protections in licensing. A recent conversation found that the real issue, if you get down to it, is in distribution: free distribution and network effects is strongest benefit of FOSS over proprietary, shared-source model which may have every other benefit.<p>&quot;A proper security audit is only possible if one can compile that source with ones own toolchain or get the binary from a source you trust. One must test and make modifications, otherwise the binary only purports to be from exactly that source.&quot;<p>Realize that I said proprietary, <i>shared source</i>. You have the source of whatever you need. One can also do something like Wirth&#x27;s Pascal&#x2F;P where runtime is P-code and some I&#x2F;O shims. Everything else in toolchain was compiled to it. Result was amateurs ported whole thing to 70+ architectures while having to reimplement just one, tiny part. Interesting enough, System&#x2F;38 design did same thing at microcode or asm level with successful port to POWER with many apps needing no source recompile.<p>&quot;So you must in the end trust the companies, and trust them to release patches promptly, not delay them at the behest of the NSA (as per Snowden).&quot;<p>This problem exists for FOSS, too, so don&#x27;t kid yourself. The vast majority of FOSS isn&#x27;t Linux: it&#x27;s barely maintained and many ignore bug reports for long periods. The <i>average</i> is in favor of FOSS if it&#x27;s major projects vs proprietary software but individually it ranges from total shit to excellence. Totally dependent on contributors or maintainers.<p>&quot;PGP and SSH are both provably secure. &quot;<p>They&#x27;re not due to their CVE history. They just got really good with GPG foiling NSA after years of improvements with a narrow focus for GPG. GEMSOS, PSOS, and seL4 are provably secure. World of difference in how they&#x27;re built. None were created with a FOSS model.<p>&quot;If a patch removes an essential feature and security is bundled with it, this is problematic. If you cannot use distributed community modifications then you are often out of luck.&quot;<p>&quot; Free software forks at disagreements so everyone is happy. &quot;<p>It&#x27;s a risk but can be countered. The counter I did in another discussion was a shared-source license that allowed fixes, modifications, and even distribution to other customers. You perpetually keep what you licensed if you keep paying optionally with a limit on per organization charges. You and a group can do anything you want with that commercial code if you&#x27;re paying. Btw, the <i>real</i> hacker OS was provided with some (but not enough) of those attributes with features UNIX still can&#x27;t fully match:<p><a href="http:&#x2F;&#x2F;www.symbolics-dks.com&#x2F;Genera-why-1.htm" rel="nofollow">http:&#x2F;&#x2F;www.symbolics-dks.com&#x2F;Genera-why-1.htm</a><p>&quot;cannot be taken from you by law - it is public domain.&quot;<p>It&#x27;s actually not: it&#x27;s copywritten software licensed with specific terms that enforce things on you. Public domain has no copyrights or restrictions. This is a problem or a feature of GPL vs public domain depending on who you ask. Only thing both protect almost 100% is widespread distribution which any paid model might... <i>might</i>... always reduce.