3 ms·

> This is yet another nail in the coffin of Eric Raymond's irresponsible and fallacious "many eyes make all bugs shallow" theory. What a facetious and unsuppor

> This is yet another nail in the coffin of Eric Raymond's irresponsible and fallacious "many eyes make all bugs shallow" theory. What a facetious and unsupported assertion you have made. You are seemingly purposefully disingenuous. The simple fact of the matter is, ESR is still right. Perhaps because few people use a piece of s/w these things slip through. The seriousness of this flaw is limited and thus not subject to the fierce post humous questioning you give it. Please define how many eyes saw or used or benefited from this code. I certainly live in the world of this code and don't depend on it. There is a chance you are talking shit.

mpyne 13y ago
> The simple fact of the matter is, ESR is still right. ESR is not completely mistaken here, but the problem is that he's not exhaustively right with "Linus's Law". It's more a description of why beta testing with access to source code is good, than a description of why open source is inherently good (and before you flip out, I've contributed to open source longer than I've done my day job). Some types of code flaws will simply never show up to the kind of beta testing that introducing software to a wide population provides. E.g. proving that a X.509 certificate which is faulty in a certain way is actually caught by a software library; few people run into that in practice. What these types of bugs require is code auditing (after the fact) or before-the-fact code review that prevents their entry into the source in the first place. But neither auditing nor pre-commit review are inherent to open-source, and in fact it could be argued that closed-source software companies are better able to ensure sure things happen. The saving grace for open source is that these companies optimize for market success and not code quality (except to the bare extent needed for market success). Additionally you can pay to audit open source code much more easily than you can closed source (e.g. Google's audit teams that do exactly this). But "bugs are shallow in the presence of sufficient eyeballs" is not unique to open source, either in theory or in practice.
SimHacker 13y ago
What supports my assertion are the two recent gigantic but shallow security holes that many eyes (except for the NSA's) didn't see for many years.

mpyne 13y ago

> The simple fact of the matter is, ESR is still right. ESR is not completely mistaken here, but the problem is that he's not exhaustively right with "Linus's Law". It's more a description of why beta testing with access to source code is good, than a description of why open source is inherently good (and before you flip out, I've contributed to open source longer than I've done my day job). Some types of code flaws will simply never show up to the kind of beta testing that introducing software to a wide population provides. E.g. proving that a X.509 certificate which is faulty in a certain way is actually caught by a software library; few people run into that in practice. What these types of bugs require is code auditing (after the fact) or before-the-fact code review that prevents their entry into the source in the first place. But neither auditing nor pre-commit review are inherent to open-source, and in fact it could be argued that closed-source software companies are better able to ensure sure things happen. The saving grace for open source is that these companies optimize for market success and not code quality (except to the bare extent needed for market success). Additionally you can pay to audit open source code much more easily than you can closed source (e.g. Google's audit teams that do exactly this). But "bugs are shallow in the presence of sufficient eyeballs" is not unique to open source, either in theory or in practice.

SimHacker 13y ago

What supports my assertion are the two recent gigantic but shallow security holes that many eyes (except for the NSA's) didn't see for many years.