Six open source security myths debunked - and eight real challenges