In my opinion, there is no problem with this, as the groups I've defended only expose well-known, battle tested, security audited, and heavily supported dependencies/services, such as Django and OpenSSH. They also have very simple firewall rules and configurations which block out all other ports. To me, this seems practical and removes much (although obviously not all) of the risk from their hands.

However, I also see the other side, and understand that this could be risky for smaller projects that don't have many people reviewing their code. This also, unlike a proprietary solution, exposes technical data about security to a potential attacker, which is a risk... although I've also heard people argue that it doesn't actually make any practical difference.

Here's a simple, but good article on Wikipedia that covers some points on each side. This article is more about software... but many of the arguments still apply or translate: https://en.wikipedia.org/wiki/Open-source_software_security

The point is, I've already had my debates about this, and now I would like to hear from everyone else. What do you think? Do you think that "security through community" is a good idea? Is it the way of the future? Or is it the beginning to the end for any company that takes this approach? Are there some approaches that are good, and others that are bad?