The average enterprise software is swiss cheese. It seems the hacker news type that likes to post just doesn't realize how much business/enterprise software exists out there. An F100 company has thousands, maybe tens of thousands of applications that you've never heard of and never will unless you work for them. Industry has applications ran by relatively few people, but it's keeping processes that make the modern world work alive.

Worse is everyone is like "Well, this stuff is protected or air gaped". Yea, it's behind firewall, or even private networks commonly, but the moment you get inside that network you have tons of lateral movement and could cause unbelievable damage in minutes.

    > Not maintained or developed by a billion dollar company.

Directly? No. Indirectly? Yes. They are mostly funded by billion dollar companies.

Mostly funded is different from “maintained” or “developed”.

Afaik everyone working on curl has a day job.

> I suspect open source projects are better off than proprietary software - they already have many eyes on them

This has been disproven by the sordid history of OpenSSL. It was open source, critical, and full of holes.

https://www.mend.io/blog/how-the-heartbleed-vulnerability-sh...

Single datapoint does not prove anything at all, but it is a data point.