If the DHS insists, as bureaucracies are apt to do, that open-source must be certified via a sanctioned, formal process, it will interfere with the informal process of open-source itself. It seems to me the DHS is trying to turn an open-source development project into a Microsoft (or IBM or Oracle) software development project. And we know what that means: more, not fewer, errors -- security and otherwise.