Re discussion of #opensource in http://csrc.nist.gov/publications/drafts/nistir-8151/nistir8151_draft.pdf: 1) all open source is commercial (so say "proprietary"), 2) re 4.3.4, OSS solves