"Many eyes"

We don't know how many of the eyes are paid not to report and fix those problems.

Actually we don't even know how many of the anti-patterns are accidental and how many are deliberate.

I wonder if the automated tools mentioned in the article could be hooked up to "git blame" and used to deduce possible patterns in the sources of vulnerabilities.