> The simple fact of the matter is, ESR is still right. ESR is not completely mistaken here, but the problem is that he's not exhaustively right with "Linus's

> The simple fact of the matter is, ESR is still right. ESR is not completely mistaken here, but the problem is that he's not exhaustively right with "Linus's Law". It's more a description of why beta testing with access to source code is good, than a description of why open source is inherently good (and before you flip out, I've contributed to open source longer than I've done my day job). Some types of code flaws will simply never show up to the kind of beta testing that introducing software to a wide population provides. E.g. proving that a X.509 certificate which is faulty in a certain way is actually caught by a software library; few people run into that in practice. What these types of bugs require is code auditing (after the fact) or before-the-fact code review that prevents their entry into the source in the first place. But neither auditing nor pre-commit review are inherent to open-source, and in fact it could be argued that closed-source software companies are better able to ensure sure things happen. The saving grace for open source is that these companies optimize for market success and not code quality (except to the bare extent needed for market success). Additionally you can pay to audit open source code much more easily than you can closed source (e.g. Google's audit teams that do exactly this). But "bugs are shallow in the presence of sufficient eyeballs" is not unique to open source, either in theory or in practice.