"It's an arms race."

In the evolutionary biology standpoint, for sure!

"The scary thing about many of the vulnerabilities listed is that they go behind the layer of HTML and JavaScript and dig into the underlying browser code. Mozilla exposes its entire C++ class hierarchy to script, resulting in a fantastically rich environment for hacking."

I think ultimately such a 'blown open' system is the only system that will be ultimately secure. While I don't have any numbers admittedly, I would imagine that the rate that security bugs are found and fixed is probably much higher than a closed source system like MS

The situation with MS is that a whole lot of people are spending a geat deal of time deducing weaknesses behind a semi-permeable semi-opaque barrier. There is little incentive for programmers to keep-it-clean- which of course doesn't necessarily mean that they won't... Its just that they have no real reason to. (and obfuscated unclear poorly architected code, in my experience, breeds bugs and security faults by the pixel).

The situation with FF like systems is you have a whole bunch of people adopting, adapting and scrutinizing the code either as an end or a means to an end. Coders have a lot of incentive to keep it clean and well built (which doesn't mean they will, just that there are reasons to).

So on one hand, the bug rate is likely by all measures to be higher and the fix rate lower, and the obfuscation not all that much of a safety net. On the other hand, we have a probably lower bug rate, higher fix rate- but very little safety net.

And of course there is another issue altogether- accountability and action. There have been lots of cases where systems that rely on IP and source obfuscation for security will 'ignore bugs and hope they go away'. I am thinking of the supposed and alleged recent situation with Cisco (I think) routers. In open source its awful hard to pretend the elephant does not exist once someone spots it- and there are few legal tools to get people to stfu about the elephant.

I am no open-source dead-head. Open Source has serious end-user quality issues, and I have seen some really crap code and even worse architectures come out of open source. Open osurce brings a whole different can of worms. Everything in life is a trade off... yaddayadda.

BUT

Ultimately I think that open source will eventually become a valid technique for protecting the security of systems. The trick will be dis-entangling it, as much as possible, from the hairy IP issues that plague us in this decade, as well as to differentaite it from the social movement that has advanced it to the level it is currently at.

Just my 2 pennys.