The 'many eyes' hypothesis has now been empirically tested.
Perhaps we need to hit the reset button, and have a bit more oversight into "NewSSL" with continuous audits. There are enough big players in need of secure communication that money shouldn't be a problem.
Also, this bug was in place for what, two years? If the many eyes hypothesis has a two year lead time to find bugs this severe, we can stop talking about it because it's fucking worthless.
If that's how we're measuring things, then closed source isn't going to win either, e.g. [1].
[1]: http://www.computerworld.com/s/article/9146820/Microsoft_con...
The combination of time and severity in this case should mean that we can move on from naive 'all bugs are shallow' dogma towards developing a more evidence-based approach to the verification of critical software.