4 ms·

>> Many knowledgeable eyes on the open parts can help Well, that is the problem. No one (well, say very very few) do code reviews on their own -- they do not

>> Many knowledgeable eyes on the open parts can help Well, that is the problem. No one (well, say very very few) do code reviews on their own -- they do not provide as much benefits as coding (learning and reputation wise). Its a bit like the problem in academic publishing: Replication trials are not prestigious enough, so they are done far to rarely, albeit they are very important. There are companies out there, that will do it for money, and many great open source products have been reviewed that way. But I don't think this happens often enough.

PakG1 7y ago
While that's a valid concern, the real question should be: despite that, is it more trustworthy than closed source or not?
maxheadroom 7y ago
>...they do not provide as much benefits as coding (learning and reputation wise). I think that's because code reviews have changed from being helpful form of preventing you from stubbing yourself on your toe to, "Why would you do this...? No0b..." kind of format. If code reviews were weighted as equally beneficial to the code and as being approached as being beneficial to the growth of the developer making the change, then I could see it having much more benefit in learning; however, that would take a dynamic change in the general culture. ...but saying that code reviews don't provide as much learning benefit is to just infer that there's nothing that can be done about that when, in fact, there is. :)
tomatocracy 7y ago
I suspect that code openly contributed by the NSA will get quite a lot of scrutiny - more than average code contributions. For that reason, if they wanted to subvert something like this, I doubt they'd advertise the source of the contributions like this.
stjohnswarts 7y ago
LOTS of security companies do code reviews and constantly looking for security holes in OSS, it is after all a huge feather in their cap and reputation boost to find holes and earn the big $$. Imagine if they were able to find a deliberate hole in NSA provided UEFI code.

PakG1 7y ago

While that's a valid concern, the real question should be: despite that, is it more trustworthy than closed source or not?

maxheadroom 7y ago

>...they do not provide as much benefits as coding (learning and reputation wise). I think that's because code reviews have changed from being helpful form of preventing you from stubbing yourself on your toe to, "Why would you do this...? No0b..." kind of format. If code reviews were weighted as equally beneficial to the code and as being approached as being beneficial to the growth of the developer making the change, then I could see it having much more benefit in learning; however, that would take a dynamic change in the general culture. ...but saying that code reviews don't provide as much learning benefit is to just infer that there's nothing that can be done about that when, in fact, there is. :)

tomatocracy 7y ago

I suspect that code openly contributed by the NSA will get quite a lot of scrutiny - more than average code contributions. For that reason, if they wanted to subvert something like this, I doubt they'd advertise the source of the contributions like this.

stjohnswarts 7y ago

LOTS of security companies do code reviews and constantly looking for security holes in OSS, it is after all a huge feather in their cap and reputation boost to find holes and earn the big $$. Imagine if they were able to find a deliberate hole in NSA provided UEFI code.