3 ms·

I'm always a bit skeptical of this argument as a rationale for FOSS. Of course, publishing your source code does make it a lot easier for outsiders to audit yo

I'm always a bit skeptical of this argument as a rationale for FOSS. Of course, publishing your source code does make it a lot easier for outsiders to audit your software, but how many people actually do? Linux might be an exception because so many organizations build drivers and distributions for it (there are always people digging through the internals and likewise, hackers/security consultants looking for opportunities), but I suspect for most open source projects (even the big ones), there are way fewer people auditing them than comments like this would lead you to believe. How many people do you think are digging through and critically analyzing Django/Node/Rails/Docker/OpenSSL/network drivers/etc? There's a mindblowing amount of code behind any application, and as developers/users, we tend to trust strength in numbers - people are using it, so it must be fine. But in practice, I wonder how much the bystander effect counteracts this intuition.

Clubber 9y ago
>publishing your source code does make it a lot easier for outsiders to audit your software, but how many people actually do? I would say very, very few people in the world read random source code looking for bugs. Finding hidden bugs requires active use like a QA person would do. This has probably already been done on any major FOSS software, so any remaining bugs would be unbelievably hard to find, and very unlikely by just reading source code. I mean it sounds good as a theory, but it also sounds like, "If I publish my book online for free, lots of people on the internet will read it."
- gkop 9y ago
  You are both right. Having the code helps the kind of testing you’re talking about. Also static analysis.
  - Clubber 9y ago
    >static analysis Doesn't really change the equation though. That just allows people to not read it faster using automation. :)
    - gkop 9y ago
      Sorry I ninja edited above. I see your point upon reflection - we’re talking about other dimensions of open source (eg. popular and trusted), not the availability of the code.

Clubber 9y ago

>publishing your source code does make it a lot easier for outsiders to audit your software, but how many people actually do? I would say very, very few people in the world read random source code looking for bugs. Finding hidden bugs requires active use like a QA person would do. This has probably already been done on any major FOSS software, so any remaining bugs would be unbelievably hard to find, and very unlikely by just reading source code. I mean it sounds good as a theory, but it also sounds like, "If I publish my book online for free, lots of people on the internet will read it."

gkop 9y ago
You are both right. Having the code helps the kind of testing you’re talking about. Also static analysis.
- Clubber 9y ago
  >static analysis Doesn't really change the equation though. That just allows people to not read it faster using automation. :)
  - gkop 9y ago
    Sorry I ninja edited above. I see your point upon reflection - we’re talking about other dimensions of open source (eg. popular and trusted), not the availability of the code.