5 ms·

One thing I would think helps software is Linus's law: "Given enough eyeballs, all bugs are shallow". https://en.wikipedia.org/wiki/Linus%27s_law https://en.wi

One thing I would think helps software is Linus's law: "Given enough eyeballs, all bugs are shallow". https://en.wikipedia.org/wiki/Linus%27s_law https://en.wikipedia.org/wiki/Linus%27s_law As far as I know, this is not something available to other forms of engineering.

javiramos 6y ago
Definitely true for my domain, mechanical engineering. Enough reviews and bugs will be found and corrected.
- londons_explore 6y ago
  In most other fields, there are far fewer eyeballs, because far less work is opensource. If most/all CAD designs were opensource, you can imagine there would be projects underway to automatically "find all screws in the world that are too short to hold the design load". With enough projects of that nature, standards across the entire field will improve.
- amelius 6y ago
  Reminds me of the old jokes that start with "if cars were like computers". https://www-users.cs.york.ac.uk/susan/joke/crash.htm https://www-users.cs.york.ac.uk/susan/joke/crash.htm
  - mamon 6y ago
    Cars must necessarily follow the laws of physics. Software does not have such limitations, which creates hundreds times more ways to shoot yourself in a foot.
  - ben509 6y ago
    Self-driving cars and IoT turned that joke into prophecy.
jolux 6y ago
I don't think that's true, or at the very least it's misleading. Qualified eyeballs are often expensive, and moreover there are consistent intellectual biases of human beings that interfere with catching all bugs.
- ErikAugust 6y ago
  This would be more in the context of FOSS, so the economics are certainly different. I am not sure qualified eyeballs are expensive in this context.
  - jolux 6y ago
    Look at OpenSSL and Heartbleed. Nobody found it and it ended up being a catastrophe. It has since seen major industry investment. The problems have been mostly alleviated.
    - 77pt77 6y ago
      Anyone worth their salt that spent longer than 10 minutes lokoing at openssl's source code knew that it was riddled with problems. Regardless of that none of the many billion dollar companies that relied on it invested anything into improving it.
- colonelxc 6y ago
  Though the 'law' is associated with reading source code, I think it can also apply to people using the code, and reporting errors (sometimes automatically). They may not be able to fix it, but just noticing there is a problem is a big first step.
  - jolux 6y ago
    Sure, I'm just saying in reality it's not as ideal as it would seem. You're not going to get thousands of new qualified people reading every codebase every year, things will inevitably slip through the cracks, and at a guess open-source lines of code probably have fewer people reading them net than all currently maintained proprietary software, just because there is so much vastly more open source software these days.
TheOtherHobbes 6y ago
"Given enough projects, all eyeballs are elsewhere."
- qlk1123 6y ago
  But most of them have no critical impact on essential infrastructures. Eyeballs are always their for big projects.
  - mixologic 6y ago
    OpenSSL is a good example of something that was essential everywhere that had few eyeballs on it for a number of years.
- neolog 6y ago
  Thanks for that.
- Animats 6y ago
  Yes. Outside of the top 20 or so open source projects, few people are watching. Often only one.
  - _AzMoo 6y ago
    I don't think that's really true. I have open source projects that nobody else actually uses, but I still get messages from people reading and looking at the code. There's often only one person maintaining open source software, but I'd bet there's a lot of eyes on a lot of projects.
mamon 6y ago
"No one reads anything. Those who do read, they do not understand. Those who do understand, they immediately forget." "Linus's law" is refered to as "Linus's fallacy" now.
- 77pt77 6y ago
  And the ones that don't forget eventually get discouraged by having to go through people like him.
coldtea 6y ago
Unfortunately, we've found out in the subsequent 20+years since that was said, that most projects, even major ones, don't have enough eyeballs... There was a point a few years ago that GTK+ dev was complaining that only he was left to work on the project. A single person for a whole GUI lib.. And GTK+ is the basis of so many FOSS it's not even funny...
- ajuc 6y ago
  https://xkcd.com/2347/ https://xkcd.com/2347/ The main advantage of open source for me isn't that all bugs are found. It's that when I encounter a bug I can check the code, report it, fix it in my fork and get it fixed in the main repo eventually. With closed source you have to make do with workarounds.

javiramos 6y ago

Definitely true for my domain, mechanical engineering. Enough reviews and bugs will be found and corrected.

londons_explore 6y ago
In most other fields, there are far fewer eyeballs, because far less work is opensource. If most/all CAD designs were opensource, you can imagine there would be projects underway to automatically "find all screws in the world that are too short to hold the design load". With enough projects of that nature, standards across the entire field will improve.
amelius 6y ago
Reminds me of the old jokes that start with "if cars were like computers". https://www-users.cs.york.ac.uk/susan/joke/crash.htm https://www-users.cs.york.ac.uk/susan/joke/crash.htm
- mamon 6y ago
  Cars must necessarily follow the laws of physics. Software does not have such limitations, which creates hundreds times more ways to shoot yourself in a foot.
- ben509 6y ago
  Self-driving cars and IoT turned that joke into prophecy.

jolux 6y ago

I don't think that's true, or at the very least it's misleading. Qualified eyeballs are often expensive, and moreover there are consistent intellectual biases of human beings that interfere with catching all bugs.

ErikAugust 6y ago
This would be more in the context of FOSS, so the economics are certainly different. I am not sure qualified eyeballs are expensive in this context.
- jolux 6y ago
  Look at OpenSSL and Heartbleed. Nobody found it and it ended up being a catastrophe. It has since seen major industry investment. The problems have been mostly alleviated.
  - 77pt77 6y ago
    Anyone worth their salt that spent longer than 10 minutes lokoing at openssl's source code knew that it was riddled with problems. Regardless of that none of the many billion dollar companies that relied on it invested anything into improving it.
colonelxc 6y ago
Though the 'law' is associated with reading source code, I think it can also apply to people using the code, and reporting errors (sometimes automatically). They may not be able to fix it, but just noticing there is a problem is a big first step.
- jolux 6y ago
  Sure, I'm just saying in reality it's not as ideal as it would seem. You're not going to get thousands of new qualified people reading every codebase every year, things will inevitably slip through the cracks, and at a guess open-source lines of code probably have fewer people reading them net than all currently maintained proprietary software, just because there is so much vastly more open source software these days.

TheOtherHobbes 6y ago

"Given enough projects, all eyeballs are elsewhere."

qlk1123 6y ago
But most of them have no critical impact on essential infrastructures. Eyeballs are always their for big projects.
- mixologic 6y ago
  OpenSSL is a good example of something that was essential everywhere that had few eyeballs on it for a number of years.
neolog 6y ago
Thanks for that.
Animats 6y ago
Yes. Outside of the top 20 or so open source projects, few people are watching. Often only one.
- _AzMoo 6y ago
  I don't think that's really true. I have open source projects that nobody else actually uses, but I still get messages from people reading and looking at the code. There's often only one person maintaining open source software, but I'd bet there's a lot of eyes on a lot of projects.

mamon 6y ago

"No one reads anything. Those who do read, they do not understand. Those who do understand, they immediately forget." "Linus's law" is refered to as "Linus's fallacy" now.

77pt77 6y ago
And the ones that don't forget eventually get discouraged by having to go through people like him.

coldtea 6y ago

Unfortunately, we've found out in the subsequent 20+years since that was said, that most projects, even major ones, don't have enough eyeballs... There was a point a few years ago that GTK+ dev was complaining that only he was left to work on the project. A single person for a whole GUI lib.. And GTK+ is the basis of so many FOSS it's not even funny...

ajuc 6y ago
https://xkcd.com/2347/ https://xkcd.com/2347/ The main advantage of open source for me isn't that all bugs are found. It's that when I encounter a bug I can check the code, report it, fix it in my fork and get it fixed in the main repo eventually. With closed source you have to make do with workarounds.