People assumed that open source software is somehow magical, that it’s immune to ordinary programming mistakes and security blunders. It’s not.