3 ms·

A great example of the falsehood that people often repeat mindlessly about "thousands of eyeballs watching the source".

• nonsince 10y ago
  It's actually a great example of why that works, but simultaneously an example of why it's not sufficient
• nine_k 10y ago
  See, that user actually watched the source and readily detected the bug. I just wonder if thousands, or hundreds, or at least a dozen eyeballs actually watched this source. I suspect 1-2 pairs of eyeballs would detect the problem if a proper code review was done. Even better, if an automated test existed for this pretty critical piece of code (passing the password around), thousands of eyeballs won't even be needed that badly. I suspect that just too few people actually use this piece of software. If a large org used it, they probably would have tested this, or even audited the code. Anyway, it's great that everyone has access to the code, so the bug was detected by a user. For closed-source software, a ticket like this might linger longer for a developer's attention.
  • borplk 10y ago
    Oh if only it was more popular, yeah just like Heartbleed was caught in OpenSSL. My point was the eyeballs argument is often made as a claim about the absence of bugs at the present time. When in fact it simply means "it is possible for people to look at it and find and fix bugs" no more no less. The mere ability does not magically translate to security. And the ability does not automatically imply that it is being done.