how to discover vulnerability?

[Quynh Nguyen Anh <quynh () sfc keio ac jp>]

hello,

i have a question: almost every day, there are many security holes are 
discovered. i wonder how they can find these holes?

1. for open source softwares, they must read every source line ?
2. for closed source softwares, they must reverse engineering binary code ?

anway, i dont know exactly how they can discover holes!

your ideas on this matter?

many thanks.
nguyen


---------------------------------------------------------------------------
Attend Black Hat Briefings & Training Europe, May 12-15 in Amsterdam, the 
world's premier event for IT and network security experts.  The two-day 
Training features 6 hand-on courses on May 12-13 taught by professionals.  
The two-day Briefings on May 14-15 features 24 top speakers with no vendor 
sales pitches.  Deadline for the best rates is April 25.  Register today to 
ensure your place.  http://www.securityfocus.com/BlackHat-security-basics 
----------------------------------------------------------------------------