The Security Challenge of Open Source Software