Re: Paper "Security record of open source and free software"