> Many eyes theory conclusively disproven Really? Using as evidence an example where a security auditor reading open-source code found a serious bug? The fact

> Many eyes theory conclusively disproven Really? Using as evidence an example where a security auditor reading open-source code found a serious bug? The fact that few serious bugs are found by reading open-source code may reflect their infrequency rather than the notion that "many eyes" isn't realistic. Heartbleed was also discovered by auditors reading open-source code files. Claiming that Shellshock's discovery "conclusively" disproves many eyes is like saying that a cancer diagnosis proves that one shouldn't visit hospitals.