I don't necessarily disagree with your thesis [2], but this argument seems strange:
>Neither "enough eyeballs" nor "the right eyeballs" are a GIVEN, even for open source software.
and this argument:
> "Not enough eyeballs" (or "ZERO eyeballs" as he loves to claim) are NOT a GIVEN for proprietary software,
Are you an auditor of proprietary software or something? It almost sounds like you're arguing for many-eyes in theory, but you're saying that it's just as likely to benefit proprietary software? That is pretty bonkers to me. Even the 2-4 reviewers thing seems ridiculous, because open source software might be studied years later. In fact, companies trying to sell software analysis tools often fix bugs in open source software to demo their tools; something that they cannot do with proprietary software.
> Although detection of even deliberately inserted flaws can be attributed to Raymond's claim, the persistence of the Heartbleed security bug in a critical piece of code for two years has been considered as a refutation of Raymond's dictum.
I find it amusing that there seem to be this contingent of proprietary code proponents who insist that Heartbleed was the singular proof against "many-eyes". Since this particular security issue is the one thing that critics always point to, it almost seems like this is the exception that proves the rule[3]. Discussion also tends to leave out that it was discovered and patched by people other than the core developers because it was open source.
Closed source software security bugs don't seem to get pithy names because they're so common. If we're cherry-picking cases, how about Windows XP? Beloved software created by arguably the biggest, most advanced proprietary software developers at the time. There was a period of time when you could not turn a machine on for an hour without it being compromised. Or serious bugs that are trivially exploitable and are known about and not fixed for many years [4].
1. I think reasonable people would disagree with ESR about various opinions he has expressed. You really sound like you have a bone to pick though.
2. There is just as much diversity in open source software as there is in proprietary. I do suspect that truly bad code doesn't get used as much in the open source world as it does in the proprietary world though.
3. All software has bugs, DJB creations excepted. It seems like critics are saying "Ha! See! Open source has security bugs too!" No shit. Of course, in a black and white world, this could be considered refutation of ESR.
4. Not really an exploit, but this denial of service is one of my favorites because of how trivial it is and how badly it crushes old versions of Windows:
http://www.cvedetails.com/cve/CVE-2010-4669/
https://www.youtube.com/watch?v=00yjWB6gGy8
Edit: formatting.