Can someone explain how leaking a traceback is a security flaw, considering it's a lot less information than just releasing the source code (which we do all the time and don't consider it a security flaw)?
WRT to open source: in open source software, you theoretically have many benign eyes vetting your code for security issues, whereas with closed source applications, the only people who are looking for security holes are you and attackers. :)