Ask Lemmy

If Adobe-or-Whatever has an undisclosed vulnerability, a few hundred people could easily already know about it due to working there. It can be due to bugs, or intentional backdoors required by corporate HQ or government.

They will leak this information. Either by accident or for financial gain. Those people will re-sell it to other shady people.

Now you sit on software where an unknown number of third parties can hack your shit. And you don't know about the vulnerability, what is at risk, how to protect yourself, or who from.

You can mostly trust corpos to protect against general hackers to some extent, but backdoors by government or from their own needs they will just keep secret.

Sony's Rootkit fuckery is probably the biggest example I can give, but there are tons more. Anti-piracy software are historically frequent offenders.

Assumed by who?

You don't need to have access to the source code (reverse engineered or not) to find security holes. However, people need to audit the source code to prove it's secure.

So, closed source software is maybe slightly harder to find flaws in for a malicious actor, but significantly harder for users to audit (because you have to rely on the word of the company publishing the software, or a 3rd party security auditing company, or reverse engineer the code yourself)

Additionally, it's harder for malicious actors to hide the existence of vulnerabilities they find. They can't just not tell anyone what they find because the code is all public anyway. If people are looking at it frequently enough (i.e. if the project is still active), someone else will probably notice it as well.

Helping hackers is the whole point. They can read the source code and report problems with the software.

Because people assume someone is auditing it. Which is wrong, most of the time nobody is auditing.