4 ms·

One trope I frequently encounter as a FreeBSD professional is "Linux is used by so many people, it doesn't have vast and sweeping bugs anymore".. the many eyes

by _kp6z 9y ago

One trope I frequently encounter as a FreeBSD professional is "Linux is used by so many people, it doesn't have vast and sweeping bugs anymore".. the many eyes fallacy. In reality, you get bystander paradox.. everyone wants RedHat or IBM to do all the hard work and they reap all the rewards. I find my field of systems pretty interesting.. there's so much to do and not a lot of people rushing in to do it as the heavy hitters retire or move to entrepreneurship etc. It's probably much cheaper to harden a *BSD or Illumos system in these domains, and much easier to get the results integrated into mainline. The financial and fame are much greater in doing it on Linux though.

Bromskloss 9y ago
> the many eyes fallacy What do you mean by this? Do more eyes not find and point out more problems? Is the effect offset by some counteracting mechanism?
- wrs 9y ago
  The many eyes idea postulates many eyes looking at the code, not many eyes finding bugs. (Proprietary software has as many or more users finding bugs as open source!) In reality, the number of developers actually reading code to find bugs may not be significantly larger for complex open source like Linux, particularly in esoteric areas like filesystems or device drivers.
- aw1621107 9y ago
  I think it's more along the lines of "Eh, I probably don't need to look, since someone else is surely doing that".
  - convolvatron 9y ago
    once it gets annoying enough - followed by "lets try a newer kernel and see if it goes away"
- acdha 9y ago
  One big problem is how many users actually translate into extra eyes contributing to the codebase. Linux has a huge number of users but how many actually do more than find a workaround for a bug, much less contribute a patch back. It definitely happens but in my experience a lot of people think that’s too much work and assume someone else will do it even if they don’t. It’s been far more common for someone to try hoping it doesn’t happen again, disabling features blindly, etc.
- kev009 9y ago
  https://en.wikipedia.org/wiki/Linus%27s_Law https://en.wikipedia.org/wiki/Linus%27s_Law The results of "many eyes" seems to be basically moot (i.e. certainly not a 10x magnitude and more likely well below 2x) in the face of the cultural mores of a project. For example, Linux kernel treats userland ABI compatibility quite seriously and there haven't been many faults there. OTOH security and KPI stability are not taken seriously, and are in constant flux. I can dig up papers on the former if needed, but it is the most glaring failure of "many eyes" What's particularly noteworthy from my perspective is the bandwagon effect toward one kernel is causing the thing that is supposed to be the ultimate best that keeps getting better (Linux kernel) to lose focus, investment (new talent and money), maybe even quality due to decreased competition. Systems software is starting to look a lot more like Electrical Engineering as a field than the greater software ecosystem. Mostly done by large, central organizations. That makes me sad.
- mannykannot 9y ago
  The fallacy is in the assumption that there actually are many eyes taking a critical look - e.g. at the level demonstrated here. When it comes to security, there may be more eyes, in which case the fallacy is to assume that the preponderance of them are well-intentioned. Here we have empirical evidence of problems being overlooked, yet you would prefer to put faith in a comforting aphorism?
- ericflo 9y ago
  There's a psychological principle called Diffusion of Responsibility that I think applies here. But this is my rusty memory from undergrad around a decade ago.

by _kp6z 9y ago

Bromskloss 9y ago

> the many eyes fallacy What do you mean by this? Do more eyes not find and point out more problems? Is the effect offset by some counteracting mechanism?

wrs 9y ago
The many eyes idea postulates many eyes looking at the code, not many eyes finding bugs. (Proprietary software has as many or more users finding bugs as open source!) In reality, the number of developers actually reading code to find bugs may not be significantly larger for complex open source like Linux, particularly in esoteric areas like filesystems or device drivers.
aw1621107 9y ago
I think it's more along the lines of "Eh, I probably don't need to look, since someone else is surely doing that".
- convolvatron 9y ago
  once it gets annoying enough - followed by "lets try a newer kernel and see if it goes away"
acdha 9y ago
One big problem is how many users actually translate into extra eyes contributing to the codebase. Linux has a huge number of users but how many actually do more than find a workaround for a bug, much less contribute a patch back. It definitely happens but in my experience a lot of people think that’s too much work and assume someone else will do it even if they don’t. It’s been far more common for someone to try hoping it doesn’t happen again, disabling features blindly, etc.
kev009 9y ago
https://en.wikipedia.org/wiki/Linus%27s_Law https://en.wikipedia.org/wiki/Linus%27s_Law The results of "many eyes" seems to be basically moot (i.e. certainly not a 10x magnitude and more likely well below 2x) in the face of the cultural mores of a project. For example, Linux kernel treats userland ABI compatibility quite seriously and there haven't been many faults there. OTOH security and KPI stability are not taken seriously, and are in constant flux. I can dig up papers on the former if needed, but it is the most glaring failure of "many eyes" What's particularly noteworthy from my perspective is the bandwagon effect toward one kernel is causing the thing that is supposed to be the ultimate best that keeps getting better (Linux kernel) to lose focus, investment (new talent and money), maybe even quality due to decreased competition. Systems software is starting to look a lot more like Electrical Engineering as a field than the greater software ecosystem. Mostly done by large, central organizations. That makes me sad.
mannykannot 9y ago
The fallacy is in the assumption that there actually are many eyes taking a critical look - e.g. at the level demonstrated here. When it comes to security, there may be more eyes, in which case the fallacy is to assume that the preponderance of them are well-intentioned. Here we have empirical evidence of problems being overlooked, yet you would prefer to put faith in a comforting aphorism?
ericflo 9y ago
There's a psychological principle called Diffusion of Responsibility that I think applies here. But this is my rusty memory from undergrad around a decade ago.