In either case, finding new vulnerabilities is easier the more you know about a system, especially if you have access to the human-readable source code and not just to the computer-readable object code. Similarly, it’s easier to find vulnerabilities in a rule book if you have a copy of the rule book to read, and not just information about rulings.
