>> The NHS approach: close source everything.

> Yeah good luck.

Is most NHS code client-side or server-side (/are they still making binaries available)? If binaries aren't being distributed, server-side code still can't be decompiled, so the exploitation likelihood may be a lot smaller, especially if they have basic rate limiting or similar in place. (Regardless, I still prefer open.)