5 ms·

Whereas closed source proprietary software has no eyeballs on it. Open source is at least an opportunity to identify problems by third parties without reverse-e

• deitcher 12y ago
  And that is the key IMHO. Closed-source requires enough commercial incentive by one firm to look at it. Open-source requires enough incentive in the aggregate across many problem, each of whom may have their own reasons... and who cares what they are. Most bugs I have seen figured out have been a collaborative effort. One person finds one part, which leads to the next person figuring something else out, etc. Much harder to do when it is just your job, and you may not even be paid for this work.
  • wglb 12y ago
    Closed-source requires enough commercial incentive by one firm to look at it. Or a motivated attacker to reverse it for exploits.
• ryanlol 12y ago
  Closed source often has eyeballs specifically paid to... eyeball it.
  • ikt 12y ago
    maybe? How can we be sure?
  • awalton 12y ago
    All four combinations exist in nature: Open source code with plenty of eyeballs, open source software with no eyeballs, closed source software with tons of reviewers, and closed source software with no no reviewers. It'd be interesting to see what the percentage break down is amongst these, but it probably wouldn't be surprising. It's also another tick in the box as to why pre-checkin code review is so important - bad code is often immortal, and it can be really hard to patch out bugs if people have grown to rely on broken behavior, so it's best not to get yourself in that state to begin with.
    • amelius 12y ago
      Also interesting would be a breakdown by language. For example C++ versus Haskell.
    • deitcher 12y ago
      "bad code is often immortal." I have to remember to quote that!
  • br3w5 12y ago
    But just because they're paid to do it doesn't mean they care, or that they're any good at it.
    • JoachimS 12y ago
      Headcount. Given enough headcount all problems are solved in line with the time plan is the enterprise version of the law. With enough engineers, you can just treat them as replaceable units, just numbers in an Excel sheet. Move them around as needed to meet staffing requirements, or resource allocation requests as they are often called. (No, I'm not cynic at all.)
    • t_7u_ol8 12y ago
      You can apply that attitude in general to open source software as well. Most people using open source software trust it as implicitly as they would have to trust closed source software, they have to, because reviewing and comprehending all of the code running on any typical machine is impossible. Most people simply use open source and don't care about (or aren't capable of) dealing with the code, and of the ones that do, there is no guarantee that they're going to be competent.
      • br3w5 12y ago
        Totally true - i think if you want to use open source you should be prepared to read the code in order to understand it and for debugging
  • JoachimS 12y ago
    The question is what do the brain behind the eyeballs do? Do they in fact register the bug, ignore it, file a report, solve it? Without source code we are left to trust the vendor that they actually fins and solve bugs. The vendor and/or its staff might be under pressure to leave bugs in place. We just don't know.
    • ukigumo 12y ago
      You have to trust the vendor's interest in making a profit. Nothing wrong with that :-) Closed source (usually) gives you Ts&Cs, support model and some level of guarantee of fitness for purpose which is why we pay to use it. This is not to say that there aren't bugs that seem to take forever to fix, but usually that is not the case at least not when there is a risk of the product becoming unsalable. Of course there are closed source software or appliances that just are not worth their cost because they fail to mitigate the risks of having us trust what we cannot see, but these usually fail to gain any significant market share.
      • iwwr 12y ago
        >You have to trust the vendor's interest in making a profit. Nothing wrong with that :-) Sometimes there are conflicts of interest. We have documented cases of 3-letter agencies paying companies to leave bugs or unsafe options in code. Sometimes the backdoors may be more valuable than the product itself. I suspect many corporate clients found out these days that their SSL MITM software they used made their infrastructure vulnerable.
        • ukigumo 12y ago
          This is very true. However trusting that open source does not include such vulnerabilities is a leap of faith we cannot make which is why auditing and quality control process are needed.
      • JoachimS 12y ago
        In these days wit SuperFishes and Lenovos selling out their customers for a few bucks more, trusting that the vendor have an interest in making a profit might not by itself be ok.
• wolfgke 12y ago
  > Whereas closed source proprietary software has no eyeballs on it. Open source is at least an opportunity to identify problems by third parties without reverse-engineering. Open source also allows code analysis tools to do automated tests across wide numbers of codebases. Shared source (http://en.wikipedia.org/wiki/Shared_source http://en.wikipedia.org/wiki/Shared_source) also has these properties (but not the freedom properties of open source).
• wglb 12y ago
  Closed source does in fact have eyeballs on it. Vulnerabilities are found in source such as Windows by those who are only looking at the binary. Automated testing tools are also available at the binary level.