4 ms·

This has been a bug since the early 90s. With both heartbleed and this coming in the same year, is it time to stop thinking and teaching the concept that open s

• deleted 12y ago
  [deleted]
• shangxiao 12y ago
  What do you suggest the alternative should be to make bugs inherently easier to find?
• fl0wenol 12y ago
  Doesn't it? Whether or not a product is open source, if no one thinks there's a problem in a code base, no one is going to find the bug. It's when you either: a) Are prompted to do an evaluation of the component for pay, education, or self-gratification or b) Come across a problem behavior and are trying to understand what causes it ... does one discover such things. But without the source code, you can do neither of these things easily. The likelihood of the a) case occurring is lower by virtue of accessibility. With the source code and the development history of the product in the open, we can at least see whether a misbehavior was intentional, or exploited logic questionable, and that there might have been a mistake in the original thinking. How easily would one have come to those conclusions if the source was not private? The response to the issue would have been very different, and I fail to see how if the source code wasn't open would it have somehow made it less likely a bug from the 80s wouldn't still be there. I think it's even more important now than ever to keep source open to make sure bugs can be easily found; even if the benefits are marginal to discover, they are certainly better handled in the aftermath.