This is pretty awesome. Just because an app connects to a single website/service doesn't mean there isn't a benefit to being open! It's good to be able to trust (and verify) the software running on our devices.
If you want your code security audited, pay a reputable firm to conduct an audit. Throwing it up on Github and thinking "the good guys" will spend time looking and contact you for free when they discover problems is misguided at best.
This is a fantastic mentality, but unfortunately doesn't really play out in reality.
I'm a huge Open Source fanboy, but we need to be "real". How many people are really going to read every line of every open source program? Very-few-to-none is the real answer. Massively popular software gets eyeballs, but few others do.
Most of us just use the software and trust/hope someone else reviewed it for security et al.
The problem with that is, we are all trusting/hoping someone else did a review, but that someone else is trusting/hoping someone else did a review.
> How many of the people that do review your code would exploit it vs reporting it to you
By nature, attackers would be reviewing your code as well.
> Combine it with a bounty program
The overwhelming majority of Open Source software was created-by and is curated-by a single person who makes negative profit by working on the software for free in their spare time. Even some of the most popular projects are still total losses for their curators. You're not going to get bug bounty programs here.
For example, take a look at Crosstool-ng[1] (a popular project used to build cross-compilers for various architectures). Companies and individuals are all using this project to build cross-compilers that they trust to build other software with. A bug in Crosstool-ng could propagate into bugs in the compiled software it produces. Bryan Hundven does most of the heavy lifting on this project by himself, and as far as I know, he's paid nothing for it. You're not going to get a bug bounty program here either.
Heck, it's doubtful even a project as large as the Linux Kernel would be able to afford an ongoing bug bounty program. They're trying with the Linux Foundation and the Core Infrastructure program, but how many years before did it have none of that?
Essentially, these programs only work for commercially-backed software, which is only a small sliver of open source software.
Ah, I see. I misunderstood. Yes, I think we are in agreement then, although I have my doubts most companies want their "secret sauce" or code-indiscretions flapping in the wild.
I think the largest hurdle for getting more stuff open sourced is two-fold.
1) A large amount of software is sub-par, and likely commits many atrocities including having business logic in the UI.
2) Companies are afraid they'll be embarrassed by their code, and would rather not take the risk of being branded as a company that doesn't do things right.
For number 1, there are potential solutions by hiring better engineers etc... but number 2 is always a (perceived) risk, even if their codebase is "perfect".
And - if the code is good, clean, modern - attracting talented coders that way. Showing me such code is million times more convincing than all the usual slogans
Kickstarter is in an even better position. Their defendable advantage is the network effect of being the go-to place for crowd sourcing.