4 ms·

The "many eyes" theory needs to go away, it is completely false when egregious bugs exist into their teenage years. That doesn't mean closed source fairs any

The "many eyes" theory needs to go away, it is completely false when egregious bugs exist into their teenage years. That doesn't mean closed source fairs any better, but "many eyes" are largely blind to sophisticated bugs

arca_vorago 9y ago
I have a modification to many eyes that makes it relevant, which is many eyes make bugs shallow when the code is simple enough. I think over-complexity is at the heart of the issue here, and the path forward in the future will be in reducing complexity of codebases and increasing readability. The comparison I like to use, though not completely fair, is that the linux kernel is now at what... 14mil+ loc, while minix is at more like 14k loc. As we have seen with the intel ME debacle... minix is production ready. This is also why I still think a microkernel is going to be the future. GNU+HURD and half-life 3 release on the same day I think though.
- frou_dh 9y ago
  These sayings are unfalsifiable though. They can be protected after the fact with "You thought there were enough eyes, but there actually weren't." and "You thought the code was simple, but it actually wasn't."
- clarry 9y ago
  > I have a modification to many eyes that makes it relevant, which is many eyes make bugs shallow when the code is simple enough. Many eyes would make many bugs shallow if there only were said eyes. The problem is that very few people lift a pinky to help audit & secure the software they use. Nobody reads the code. And then when disaster strikes a particular well known & widely used project and people start paying attention, they notice the code is full of low-hanging fruit that anyone could've fixed (nobody did). Even when people read code and find bugs (as I often do), they're too busy to actually report let alone fix them. It's so comfortable to pretend that someone else must've audited the code for you because it's open sauce. So you don't have to :-)
  - DanBC 9y ago
    The debian random number bug was a result of many eyes trying to help, but not knowing what they were doing. http://taint.org/2008/05/13/153959a.html http://taint.org/2008/05/13/153959a.html
kandrews 9y ago
Fully agree. I work on a large open source project and in 8 years I have encountered one person who found a bug by actually reading the code. Many projects are stable only because the massive numbers of users that find bugs by running the software. On the other hand there are virtually zero-fault small projects that no one is interested in because they are finished, bug-free and the author/maintainer would like to keep it that way.
- feelin_googley 9y ago
  "On the other hand there are virtually zero-fault small projects that no one is interested in because they are finished, bug-free and the author/maintainer would like to keep it that way." Interesting that this statement did not trigger the usual mindless, meme-like HN syllogisms: "Software is never finished." "All software has bugs." They try to discredit the truth that such small projects exist and might have something to offer.
  - deleted 9y ago
    [deleted]

arca_vorago 9y ago

I have a modification to many eyes that makes it relevant, which is many eyes make bugs shallow when the code is simple enough. I think over-complexity is at the heart of the issue here, and the path forward in the future will be in reducing complexity of codebases and increasing readability. The comparison I like to use, though not completely fair, is that the linux kernel is now at what... 14mil+ loc, while minix is at more like 14k loc. As we have seen with the intel ME debacle... minix is production ready. This is also why I still think a microkernel is going to be the future. GNU+HURD and half-life 3 release on the same day I think though.

frou_dh 9y ago
These sayings are unfalsifiable though. They can be protected after the fact with "You thought there were enough eyes, but there actually weren't." and "You thought the code was simple, but it actually wasn't."
clarry 9y ago
> I have a modification to many eyes that makes it relevant, which is many eyes make bugs shallow when the code is simple enough. Many eyes would make many bugs shallow if there only were said eyes. The problem is that very few people lift a pinky to help audit & secure the software they use. Nobody reads the code. And then when disaster strikes a particular well known & widely used project and people start paying attention, they notice the code is full of low-hanging fruit that anyone could've fixed (nobody did). Even when people read code and find bugs (as I often do), they're too busy to actually report let alone fix them. It's so comfortable to pretend that someone else must've audited the code for you because it's open sauce. So you don't have to :-)
- DanBC 9y ago
  The debian random number bug was a result of many eyes trying to help, but not knowing what they were doing. http://taint.org/2008/05/13/153959a.html http://taint.org/2008/05/13/153959a.html

kandrews 9y ago

Fully agree. I work on a large open source project and in 8 years I have encountered one person who found a bug by actually reading the code. Many projects are stable only because the massive numbers of users that find bugs by running the software. On the other hand there are virtually zero-fault small projects that no one is interested in because they are finished, bug-free and the author/maintainer would like to keep it that way.

feelin_googley 9y ago
"On the other hand there are virtually zero-fault small projects that no one is interested in because they are finished, bug-free and the author/maintainer would like to keep it that way." Interesting that this statement did not trigger the usual mindless, meme-like HN syllogisms: "Software is never finished." "All software has bugs." They try to discredit the truth that such small projects exist and might have something to offer.
- deleted 9y ago
  [deleted]