3 ms·

"given enough eyeballs, all bugs are shallow" -- Linus's law. The fallacy that closed source projects have fewer security flaws is not strictly true.

danielweber 13y ago
You know those are Eric Raymond's words, not Linus's, right? I didn't say that closed-source was more secure. I did, however, point out the problems with the statement open-source is more secure because it's more audited. Those problems are 1: if "auditing" is the measure of security, then Windows wins everything, hands down, game over, everyone else go home; and 2: you are assuming that the expensive labor is showing up for free. They will for some projects, but not for most. (Also, lots of security bugs aren't because there have been insufficient eyeballs looking at a problem, but because the eyeballs looking at the problem are insufficiently skilled.)
- malandrew 13y ago
  I'm not entirely certain on what metric you are using to say Windows is more secure because it has had more eyeballs. I would assume the fair metric is eyeball hours per line of code, which I would assume is much lower for Windows than for Linux. There are probably many parts of the Windows codebase that, once written and demonstrated to be working, have probably not received any real attention since. With Linux and other popular open-source programs, their lines of code have probably been reviewed by every serious senior software engineer that have decided to get involved in those codebases for one reason or another. There is no reason to think that the eyeballs looking at the Windows source code (i.e. Microsoft employees) are any more skilled than those in the open source community looking over Linux source code. There are probably many parts of the Windows codebase that was written by junior engineers, given the OK by a senior engineer if the code worked and didn't look obviously broken. Much of that code probably hasn't been combed over since because it would only be combed over by the few people that have access to it and the fewer still number of people who have both access and a reason to comb over it because it's part of a task they are currently assigned to work on.

danielweber 13y ago

You know those are Eric Raymond's words, not Linus's, right? I didn't say that closed-source was more secure. I did, however, point out the problems with the statement open-source is more secure because it's more audited. Those problems are 1: if "auditing" is the measure of security, then Windows wins everything, hands down, game over, everyone else go home; and 2: you are assuming that the expensive labor is showing up for free. They will for some projects, but not for most. (Also, lots of security bugs aren't because there have been insufficient eyeballs looking at a problem, but because the eyeballs looking at the problem are insufficiently skilled.)

malandrew 13y ago
I'm not entirely certain on what metric you are using to say Windows is more secure because it has had more eyeballs. I would assume the fair metric is eyeball hours per line of code, which I would assume is much lower for Windows than for Linux. There are probably many parts of the Windows codebase that, once written and demonstrated to be working, have probably not received any real attention since. With Linux and other popular open-source programs, their lines of code have probably been reviewed by every serious senior software engineer that have decided to get involved in those codebases for one reason or another. There is no reason to think that the eyeballs looking at the Windows source code (i.e. Microsoft employees) are any more skilled than those in the open source community looking over Linux source code. There are probably many parts of the Windows codebase that was written by junior engineers, given the OK by a senior engineer if the code worked and didn't look obviously broken. Much of that code probably hasn't been combed over since because it would only be combed over by the few people that have access to it and the fewer still number of people who have both access and a reason to comb over it because it's part of a task they are currently assigned to work on.