Just because something is open source doesn't mean we can't have a rational conversation about whether it's well-designed.
Some 'closed source' software is total crap too, but there we say 'product x sucks'. Here the fact that something is open source is taken to imply that all open source is dangerous simply because it is open.
It's a veiled way to promote security by obscurity. If you can't see the leaks we'll all pretend they don't exist.
Anyway, you're the last person on the planet I should argue that with :)
* Sendmail
* BIND
* CMU SNMP
* WordPress
All of these are open source.
Also, while the list would clearly be headed by Microsoft Windows, commercial software can do something open source can't. Pre XP SP2, Windows was a debacle. Then Microsoft spent 8-9 figures on security, and within 4 years, MSFT led the industry in code security. Sendmail is still a bad bet.
Again, don't get me wrong. If you have a choice between a random open source project and a random commercial project, and each is over some reasonable threshold of popularity, you're better off with the open source project almost every time. If you're a closed-source vendor and you aren't Microsoft, chances are your code is quite poor. It is at least harder to hide sheer awfulness in open source code.
But in any case, the reason I commented was, we can't cop out on the WordPress security debate by saying "it's open source, so the standards are different". WordPress is the Sendmail of our times. Lots of pro-bono effort went into it, but that can't obscure the fact of its very poor security design.
In the same posting mentioning BIND and Sendmail that had me chuckling here ;)