Given the recent number of cripplingly awful security bugs that have been found in open-source infrastructure projects (Shellshock, Heartbleed, etc) which have been in the wild for many years before being discovered, I'm rather less interested in arguments that open-source software is supposedly more secure than closed-source due to the number of eyes that are supposedly on it. When was the last time there were any security flaws of that magnitude in the Windows Server/IIS stack?

The reality seems more like that even if anybody can look at the code, auditing security code well is damn hard, very few people can do it well, and those people basically never audit open-source projects in their spare time. How secure something is depends more on how battle-tested it is, how good the people who wrote it are, and how well and often it's been tested for security flaws by experts.

Prove that open source has more eyes than closed source. You can't because in reality it's most likely not true for the vast majority of software. Most software requires an incentive to look over the code and the skill to do it. The incentive to do it for closed source is money, open source is warm fuzzies or personal interest. I really love open-source software but code review is clearly not a benefit for the vast majority of people.