>Theo de Raadt's argument (as presented here) isn't logically valid

Yes it is.

>A character attack is not an argument

His argument is not a character attack. It is pointing out two problems with Eric's hypothesis. The reality that simply saying "lots of eyes" doesn't actually mean there are lots of eyes. And that the eyes have to be attached to people who actually know what bugs look like or they won't be found. ESR himself does not bother to look at code, thus providing counter evidence to his own claim that open source software is seen by many eyes.

>ESR himself does not bother to look at code, thus providing counter evidence to his own claim that open source software is seen by many eyes.

Do you not see how this basic statement is completely illogical?

"One guy doesn't audit code much, therefore nobody audits code." Seriously?

One guy is the example, not the proof.

Then where is the proof? This code was found wanting years ago....

The proof is the fact that we have just gone through two historically tragic, enormous, and terribly stupid security holes, each big enough to land the space shuttle on, either of which could have been easily caught by ESR or anyone else simply shutting their mouth and reading the code.

It was known to be bad several years ago and an article to that effect was published.

That's the point?