Do they have background in fuzzing or formal verification? That's what you need if you want to make high-assurance software.

I'm sure there's a lot of people specialized in that as well

There isn't

And here 2 years to find a buffer overflow vulnerabity in glibc that was found via a fuzzer: https://news.ycombinator.com/item?id=39194093

In a library used on billions of devices.

if that was a private project at some company, it would still probably be there. In the long run openness always win. That's what inevitably happens in a world where the knowledge is accessible to anybody.

It's a project used by millions of people yet it took 2 years.

What about projects used by 10~50 people?

What kind of strange argument is this? If it wasn't public, it would have never been found at all.

I'm going to trust more a project peer reviewed by the best devs on the planets compared to some homebrew homemade software where the devs allegedly know better than everybody else (and they don't)

Your argument is that asking for professional auditor is not necessary for open-source code.

My argument is that open-source is not enough when high-assurance is needed and devs or end-user should still ask for a professional audits.

I'm not saying professional auditors are useless, just that they will never reach the feedback you get from peer reviews and are not a replacement for peer reviews anyways.

We're not in the 90s anymore and it's time to acknowledge that the software world and even the world in general has changed. Knowledge is now spread and the most knowledgeable devs aren't working at an audit firm and might not even hold a computer degree!

The people who found the bug in glibc worked at an audit firm.

Peers aren't enough. Finding vulnerabilities require training and an adversarial mindset that is rare.

There is a reason why in cryptography people say "don't roll your own crypto"