How secure is open source?

Your statements make absolutely no sense. How in the world are you opening yourself up to a hack by simply reviewing the source? Or even by modifying it? Looking at the code or even changing it does not automatically make you vulnerable to anything.

In any case, you completely missed the point of the whole article. There are hundreds of capable programmers around the world keeping watch on the code and preventing bad code from getting out, or if it does, they get it corrected as quickly as possible. Most vulnerabilities come from an oversight, rather than from malicious intent, and having many eyes reviewing the code prevents most of these from getting into a release version.

If a vulnerability is discovered, having many eyes investigating the problem helps to quickly identify and correct the problem. At many large software companies, identified bugs have to be evaluated for their anticipated impact, then a fix must be prioritized against other fixes, enhancements, and new development. Many times, bugfixes are seen as costs, where new features or enhancements bring in money, so bugfixes are often not as high a priority. Thus we are saddled with the swiss-cheese products that are so common these days.

Regardless of cost, I'm much more likely to trust open-source products than many commercial products.

Yarden and other posters have not agreed that
independent, malicious modification of the Linux
kernel is viable.

First, tight control of Linux kernel development
helps prevent problems at successive, official
releases.

That largely confines code flaws to ad hoc user
modification (including malicious changes)
distributed between versions. But any code can be
examined at any time by anybody for code
problem determination and resolution-- a vital
difference between open source and a proprietary
product.

This contrasts, of course, with certain OEM-
installed problems in commercial code, many of
which are not even acknowledged, much less
corrected in a timely fashion.

Linux kernel oversight is not a "one-time"
thing, but a continuous, patient review by the
kernel development committees and Linux world
community at large.

You are correct that "many eyes" does not, of
itself, guarantee perfection. But it is far
superior to the approach of Microsoft, for
example, which from all appearances does not
properly address even known problems, much less
follow up on new ones reported by users. Some of
its patches are themselves so flawed as to
require patches of their own. This needlessly
reduces product quality time after time.

By comparison, "many eyes" is careful process,
and is both a pre- and post-release, continuing
review. As a previous poster noted, with Linux,
no version is pushed by false dichotomies like
features vs. stability, or marketshare vs.
maturity.