[eraser X]

"...as long as the modified software is itself available under open-source terms."

I think the above is the important point with respect to national security. Why would anyone that cares about national security promote the idea of releasing all modifications back to the open source community?

[ThePythonicCow]

Why would anyone that cares about national security promote the idea of releasing all modifications back to the open source community?

For certain security applications, it's actually good to publicize the code and get more eyes looking at the implementation. Algorithms for things like encryption and checksumming obtain their security from provable mathematical properties, not from keeping their mechanisms obscure. Their greatest weakness lies in unrealized bugs, which public review can help thwart. For general purpose computer facilities and utilities, such as a command to copy a file, the portions of such a command that are just dealing with moving bytes around is also helped by public review, in that it reduces the chance of bugs (or planted code) that has undesired side affects.

Do you avoid buying padlocks from the popular commercial lines, because I could buy the same padlock, learn its flaws, and thereby gain illegal access to your property? No, having a market for padlocks increases the quality of all such padlocks, and reduces their price. What you don't do is tell me what you have padlocked, where, with what brand of lock, and what of value lies behind that lock. Obscurity as to the particulars of your situation helps you stay safe, even as you use widely distributed and publically available means to padlock it.

[Bush2000]

I think the above is the important point with respect to national security. Why would anyone that cares about national security promote the idea of releasing all modifications back to the open source community?

Answer: Because they don't care. The FBI, NSA, and other federal agencies would love for citizens and foreign governments to utilize code based on open source because it makes it that much easier to plot exploits.