Is open source security a myth? What do vulnerability and patch data say?
G. Schryen, Communications of the ACM (CACM) Vol. 54 (2011) 130–139.