For one thing, closed source applications and operating systems can't be examined and verified for secure coding. A revelation of previously secret code almost always leads to the discovery of additional flaws and security holes. In addition, closed proprietary code makes it difficult to distribute trustworthy fixes when a hole or mistake is revealed. Just take the April 2000 event that had webmasters and systems administrators shaking in their shoes. After four years it was discovered that Microsoft programmers had inserted a back door in their popular FrontPage Web server software.
Most experts believe that the odds of a such a back door slipping in are nil.
Apache has never had an exploit like this, and never will. Nor will Linux, or the BIND library, or Perl, or any of the other open source core software available. In other words, since the source code is open for all to review, numerous programmers worldwide will be examining the code for security vulnerabilities. Closed source means only the bad guys get to find the security holes. This promise of peer review promotes secure coding techniques among open source projects, argues Raymond.