> No it isn't. Security by obscurity is a very valid defense-in-depth measure.
No-one has said otherwise. I said this in the gp of the comment you're replying to.
> Show said evidence, please
No need: you've just shown two good examples yourself. Bugs found by scrutinising open source software. I'd be curious to see how many examples you have of the same found in closed-source software (or are you suggesting there's no closed-source software out there with vulns of the same vintage as Heartbleed).
> No, they're arguing that there is no guarantee that these 99 white hats are somehow better than the 1000 black hats
This sentence seems to make the same assumption others have: that "black hats" are exclusively looking at open source software.
> 1-2 unpaid volunteer white hats might inspect the source if they have time
This might be true of a library noone uses (in which the impact of an exploit is limited by it's popularity). For popular libraries, there's an entire SCA industry of commercial vendors selling products that disprove this (transient dependency reporting is done throughout large corps that rely on open source supply chains). Admittedly this industry is more mature in some areas than others (e.g. package-managed language ecosystems -vs- orchestrated system deps), but it's still not insignificant. There's absolutely no comparison between this effort and the number of eyes looking at proprietary products internally in any given org.