3 ms·

How are you equating a "code review" to open source, the difference is the difference between asking a couple dudes for advice and asking the entire world for a

How are you equating a "code review" to open source, the difference is the difference between asking a couple dudes for advice and asking the entire world for advice. I'm sure the argument sounded really good in your head, but let's be adults here when it comes to the United States military

Veserv 2y ago
Because auditable does not mean the same thing as audited. It is silly that people keep pushing that dead argument after Heartbleed pounded a stake through its heart. Audits are time consuming, challenging, and boring. Experience shows even critical, high profile projects hardly get any review at all by the "world", let alone actual audits by competent domain experts. Quality verification depends on auditing and auditing depends on competent, trusted review and testing. Global transparency is not a substitute for auditing except when discussing absolute rock-bottom standards. Reviewable is significantly better than unreviewed and unreviewable, but that is the lowest possible bar. Unfortunately, software does, as a general rule, have rock-bottom auditing standards, so FOSS does provide meaningful assurance increases in many use cases. But, that is a artifact of the abysmal quality standards rather than any sort of inherent auditing advantage that FOSS provides. That is not to say that global transparency is not valuable for other reasons, but it provides no meaningful quality verification or auditing advantage in serious applications versus local transparency (to the trusted reviewer). If you want to see how this works in practice, look at literally every other industry.
- a_simple_man 2y ago
  the market will determine what should and should not be audited, according to supply and demand. thinking that a couple employees that were not paid for with profit but with printed and taxed government dollars is not and never will be a substitute for the free market, which is a synonym for humanity. not respecting that fact will always result in loss and inefficiency. and no amount of paragraphs can undo that.
  - Avamander 2y ago
    The market has been horrid in determining that. There are a few dozen massive companies funding a significant amount of the menial and boring work done on FOSS. Possibly because they have more to lose from their competitors building moats and wide-scale incidents. Thankfully governments are now also funding FOSS work but this really doesn't align with what you're envisioning, I think.

Veserv 2y ago

Because auditable does not mean the same thing as audited. It is silly that people keep pushing that dead argument after Heartbleed pounded a stake through its heart. Audits are time consuming, challenging, and boring. Experience shows even critical, high profile projects hardly get any review at all by the "world", let alone actual audits by competent domain experts. Quality verification depends on auditing and auditing depends on competent, trusted review and testing. Global transparency is not a substitute for auditing except when discussing absolute rock-bottom standards. Reviewable is significantly better than unreviewed and unreviewable, but that is the lowest possible bar. Unfortunately, software does, as a general rule, have rock-bottom auditing standards, so FOSS does provide meaningful assurance increases in many use cases. But, that is a artifact of the abysmal quality standards rather than any sort of inherent auditing advantage that FOSS provides. That is not to say that global transparency is not valuable for other reasons, but it provides no meaningful quality verification or auditing advantage in serious applications versus local transparency (to the trusted reviewer). If you want to see how this works in practice, look at literally every other industry.

a_simple_man 2y ago
the market will determine what should and should not be audited, according to supply and demand. thinking that a couple employees that were not paid for with profit but with printed and taxed government dollars is not and never will be a substitute for the free market, which is a synonym for humanity. not respecting that fact will always result in loss and inefficiency. and no amount of paragraphs can undo that.
- Avamander 2y ago
  The market has been horrid in determining that. There are a few dozen massive companies funding a significant amount of the menial and boring work done on FOSS. Possibly because they have more to lose from their competitors building moats and wide-scale incidents. Thankfully governments are now also funding FOSS work but this really doesn't align with what you're envisioning, I think.