>you're wrong to think this
Security engineer here. No they aren't. I'd say they are being a much more comprehensive in their security analysis by including the cons in their calculation rather than dismissing them and assuming that the pros outweigh them.
>opinion is shared by most of the security community.
No it isn't.
Security by obscurity is a very valid defense-in-depth measure. There's a reason you disable "debug-level logging" on production webservers.
>There is ample evidence that the cons FAR outweigh the pros in this particular comparison.
Show said evidence, please, because there is ample evidence that open source software magically being reviewed by hordes of people is many times a myth.
Heartbleed was caused because pretty much nobody cared to look at openssl's code and review it for vulnerabilities. Just because it is available to be looked at by white hats doesn't mean anyone actually is looking at it. And if something so critical to security like openssl isn't even being reviewed by security researchers, what gives you any confidence that random software like JoesCoolLoggingLibrary is reviewed with any more scrutiny?
Speaking of logging, Log4shell is yet another example. The most ubiquitous libraries in use. Used everywhere by some of the largest tech companies in the world, that all have the largest and most well-budgeted security organizations. The vulnerability was present in code for years, available for anyone in the world to look at, and yet...? Instead, there is evidence that Log4shell was being exploited by black hats before any white hats discovered it.
>You're arguing that 99 white hats don't trump black-vs-white.
No, they're arguing that there is no guarantee that these 99 white hats are somehow better than the 1000 black hats, and I'd add to it that there is also no guarantee that these 99 white hats magically appear, anyway. In fact, I think a more realistic visualization for most software is:
- Closed source:
-- Pros: 1 well paid white hat can easily inspect the source
-- Cons: 1000 hackers can blackbox-attack the application
- Open source:
-- Pros: 1-2 unpaid volunteer white hats might inspect the source if they have time
-- Cons: 1000 black hats can whitebox-attack the application
As a security engineer, I know which one I feel more comfortable with.