erhm... you're now talking about linux, but you'd first about GNU. I expected you to know the difference between userland and kernel. you know GNU has its own kernel, and it's not Linux, right? it's not used much, so probably of limited interest WRT security, though.

I wouldn't ever advise counting on reverse engineering to find security issues if you have source code to apply all sorts of code analysis tools all the way from sources to the binary, aided by debug info and whatnot to trace findings from the binaries all the way back to the binaries. having only the binaries doesn't bring you any advantage, it rather makes the whole effort more difficult. anything you can do with the binaries of a proprietary program, you can also do with the binaries of a freedom-respecting program. but there's plenty you can do with a freedom-respecting program that is just not possible if all you have are the binaries. arguing otherwise strikes me as almost as absurd as suggesting that programming with blinds on your eyes is better because it's better not to see the source code :-)