Here's an example for response turnaround time for fixing bugs. This one has to do with a buffer overflow in OpenSSL. The vulnerability was reported on September 27 in this thread. This morning (Sept 29), Ubuntu had two patches waiting for me. One is for OpenSSL, and the other is for libssl, the library that implements SSL. The vulnerability is the same. The update was actually released 17 hours ago, so It was no more than a day after the vulnerability was revealed.

 

Of course, there are bugs that don't get patched for a long, long time, but in most of the cases, we see quick turnaround times in open source. This is yet another case where "many eyeballs make bugs shallow".