4 ms·
> the solution is to put energy and resources into auditing and improving Sadly but not surprisingly, when your labor pool consists of volunteers, few of them
by IvyMike 12y ago
> the solution is to put energy and resources into auditing and improving
Sadly but not surprisingly, when your labor pool consists of volunteers, few of them sign up for this thankless task. I don't know how to solve this problem.
I never liked "given enough eyeballs, all bugs are shallow". In the worst case, it devolves into "someone else will do it".
- blcknight 12y agoI think it's a big misconception that the labor pool for libre software is volunteers, it's paid -- by Red Hat, IBM, Intel, Canonical, etc. In this case, bash had plenty of resources to be fixed quickly, it wasn't a problem at all. There's unwieldy projects like OpenSSL that probably have far too critical of a task for few too few developers, but generally, most open source products are developed by paid developers and are doing just fine
- IvyMike 12y agoWhen you've got that many people in charge of security, nobody's in charge of security. In the end, who is responsible for this bug being out in the wild?