I am pretty skeptical of the 'many eyes' hypothesis with regard to bugs in general, and there is an additional issue when trying to apply it to security specifically: in that case, many of the eyes will be malicious in intent. Security is always a race between good and evil.
Before anyone says I am advocating the discredited 'security by obscurity', let's look at what it means to say that it doesn't work. It does not mean that any use of obscurity is pointless - the whole point of private keys, of course, is that they are obscured. What it means is that if you are trusting only to the obscurity of your implementation, you don't have security. This observation is not an invitation to make things easier for your opponents. Open-sourcing code can not help with security unless you can be sure that it leads to more and better scrutiny by white-hats than black-hats, and there is no guarantee even then.
I am pretty skeptical of the 'many eyes' hypothesis with regard to bugs in general, and there is an additional issue when trying to apply it to security specifically: in that case, many of the eyes will be malicious in intent. Security is always a race between good and evil.
Before anyone says I am advocating the discredited 'security by obscurity', let's look at what it means to say that it doesn't work. It does not mean that any use of obscurity is pointless - the whole point of private keys, of course, is that they are obscured. What it means is that if you are trusting only to the obscurity of your implementation, you don't have security. This observation is not an invitation to make things easier for your opponents. Open-sourcing code can not help with security unless you can be sure that it leads to more and better scrutiny by white-hats than black-hats, and there is no guarantee even then.