Increasing Software Security through Open Source or Closed Source Development? Empirics Suggest that We have Asked the Wrong Question