> in the infosec space those with closed source products (e.g. WAF's) laugh at those with open source products when it comes to the numbers of embarrassing and business-damaging zero-days reported.
Because no one reports theirs? It's not a good reason to laugh if you think of it.
> in the infosec space those with closed source products (e.g. WAF's) laugh at those with open source products
I would imagine open source has more reported zero days because, well, the source is open and auditable.
I do see a lot more closed source in the info/app sec space, but I suppose if you know that space well enough, the source code is just a bonus to seeing how the program works, not a requirement.
You can interpret "get's away with" as "makes better business sense". On a slight tangent - in the infosec space those with closed source products (e.g. WAF's) laugh at those with open source products when it comes to the numbers of embarrassing and business-damaging zero-days reported.
Closed source rocks if you're a capitalist. Those who sell closed source love that open sourcers are so distracted by singing-it from the mountain.
~From a guy who runs a not-that-small open source biz.