3 ms·
With few enough eyes, all bugs are hidden.
by nwah1 11y ago
With few enough eyes, all bugs are hidden.
- geofft 11y agoLinus's law applies (if it's even true, which there's insufficient empirical evidence for) to code, not bug trackers. The kernel's reporting process for security bugs involves sending an email to security@kernel.org, a closed list with secret membership. It may also involve sending an email to the linux-distros@openwall mailing list, which is also closed but has public membership (and is run by a third party). If either of these groups has a bug tracker at all, they haven't told anyone else. And unlike Mozilla's policy, at no point is the history of discussions on either security@kernel.org or linux-distros@openwall ever opened up to the public. Fixes can, and are often intended to, show up in the kernel changelog without any mention of what security issue they fixed.