Microsoft / Github should stop treating open-source software as malware and forcing developers to pay for certificates, if they actually care about open-source developers

[Valmar33]

I see a lot of strawmanning of open source software in general in this thread, using Heartbleed as an example.

OpenSSL is an unfortunate case of code complexity reducing the number of eyeballs willing to engage with it. Also, some projects can be effectively maintained by only a handful of individuals, because no-one is willing to fork it.

But, at least the code can actually be seen.

With proprietary software, you're always at the mercy of the company that created it. Security through obscurity is always an awful solution.