3 ms·
Doesn’t this call for an OSS vehicle platform that can be reviewed by thousands of contributors to avoid these type of issues?
by mack1001 8y ago
Doesn’t this call for an OSS vehicle platform that can be reviewed by thousands of contributors to avoid these type of issues?
- mannykannot 8y agoI see that the "many eyes" hypothesis lives on, despite the accumulation of contrary evidence.
- imtringued 8y agoWell usually the difference between open source and proprietary is that the proprietary vendors are slow to fix security issues because it doesn't increase their profit. In some cases they even try to hide the fact that the software is insecure or even sue the person who reported the vulnerability. Meanwhile most OSS software gets fixed as soon as the vulnerability is found.
- sbradford26 8y agoIn the case of aircraft though a company could find a bug and do their best to fix it quickly. But if the plan is already flying any changes to the software require a re-certification of the software which can take months.
- tdubhro1 8y agoUnfortunately, evidence [1] suggests that the rate of bug detection by reviewers does not scale linearly with the number of reviewers, adding more than 4 reviewers uncovers bugs at a much lower rate [2]. However I absolutely agree that better / more extensive / diligent code reviews are part of the solution to improve code quality and eliminate these kinds of defects. It's tough to create the right kind of incentive structures for reviewers internally at a company; maybe the future will have specialist firms that provide review-as-a-service for a fee, or perhaps firms could trade review-hours (all under strict NDAs I'd imagine). [1] Glass: https://books.google.gr/books?id=3Ntz-UJzZN0C&pg=PA174&redir_esc=y#v=onepage&q&f=false https://books.google.gr/books?id=3Ntz-UJzZN0C&pg=PA174&redir... [2] https://en.wikipedia.org/wiki/Linus%27s_Law https://en.wikipedia.org/wiki/Linus%27s_Law