GNU and links like those consistently miss the point when the discussion is about security. OSS or FOSS don&#x27;t matter as much as <i>review by qualified, trusted party with trustworthy distribution</i>. As explained here:<p><a href="https:&#x2F;&#x2F;www.schneier.com&#x2F;blog&#x2F;archives&#x2F;2014&#x2F;05&#x2F;friday_squid_bl_424.html#c6051639" rel="nofollow">https:&#x2F;&#x2F;www.schneier.com&#x2F;blog&#x2F;archives&#x2F;2014&#x2F;05&#x2F;friday_squid_...</a><p>Might explained why a few closed source products achieved high assurance security (B3&#x2F;A1&#x2F;EAL6&#x2F;EAL7) that survived years of NSA pentesting while FOSS... see Snowden leaks. You can get those freedoms with proprietary models via contracts, esp with non-profits. Most just are about money though. Likewise, FOSS communities rarely deliver high-quality, maintained software and never deliver highly assured software.<p>So all this philosophical crap serves nobody if we&#x27;re talking about making software <i>trustworthy</i>. For that, we need capable people building it while utilizing every security-enhancing method we know, trustworthy people reviewing it whether closed or open, ability to know you possess what was reviewed in that configuration, and continual maintenance esp of bugfixes. That&#x27;s the baseline we need to push whether FOSS or a proprietary version of open-source.