Hacker News Reader

Hacker News

Comment by ErikAugust | Hacker News Reader

Parent Full thread

ErikAugust

One thing I would think helps software is Linus's law: "Given enough eyeballs, all bugs are shallow".

https://en.wikipedia.org/wiki/Linus%27s_law

As far as I know, this is not something available to other forms of engineering.

View on HN

"Given enough projects, all eyeballs are elsewhere."

Yes. Outside of the top 20 or so open source projects, few people are watching. Often only one.

I don't think that's really true. I have open source projects that nobody else actually uses, but I still get messages from people reading and looking at the code. There's often only one person maintaining open source software, but I'd bet there's a lot of eyes on a lot of projects.

But most of them have no critical impact on essential infrastructures. Eyeballs are always their for big projects.

OpenSSL is a good example of something that was essential everywhere that had few eyeballs on it for a number of years.

Thanks for that.

Unfortunately, we've found out in the subsequent 20+years since that was said, that most projects, even major ones, don't have enough eyeballs...

There was a point a few years ago that GTK+ dev was complaining that only he was left to work on the project. A single person for a whole GUI lib..

And GTK+ is the basis of so many FOSS it's not even funny...

https://xkcd.com/2347/

The main advantage of open source for me isn't that all bugs are found. It's that when I encounter a bug I can check the code, report it, fix it in my fork and get it fixed in the main repo eventually.

With closed source you have to make do with workarounds.

I don't think that's true, or at the very least it's misleading. Qualified eyeballs are often expensive, and moreover there are consistent intellectual biases of human beings that interfere with catching all bugs.

Though the 'law' is associated with reading source code, I think it can also apply to people using the code, and reporting errors (sometimes automatically).

They may not be able to fix it, but just noticing there is a problem is a big first step.

Sure, I'm just saying in reality it's not as ideal as it would seem. You're not going to get thousands of new qualified people reading every codebase every year, things will inevitably slip through the cracks, and at a guess open-source lines of code probably have fewer people reading them net than all currently maintained proprietary software, just because there is so much vastly more open source software these days.

This would be more in the context of FOSS, so the economics are certainly different. I am not sure qualified eyeballs are expensive in this context.

Look at OpenSSL and Heartbleed. Nobody found it and it ended up being a catastrophe. It has since seen major industry investment. The problems have been mostly alleviated.

Anyone worth their salt that spent longer than 10 minutes lokoing at openssl's source code knew that it was riddled with problems.

Regardless of that none of the many billion dollar companies that relied on it invested anything into improving it.

Definitely true for my domain, mechanical engineering. Enough reviews and bugs will be found and corrected.

In most other fields, there are far fewer eyeballs, because far less work is opensource.

If most/all CAD designs were opensource, you can imagine there would be projects underway to automatically "find all screws in the world that are too short to hold the design load". With enough projects of that nature, standards across the entire field will improve.

Reminds me of the old jokes that start with "if cars were like computers".

https://www-users.cs.york.ac.uk/susan/joke/crash.htm

Self-driving cars and IoT turned that joke into prophecy.

Cars must necessarily follow the laws of physics. Software does not have such limitations, which creates hundreds times more ways to shoot yourself in a foot.

"No one reads anything. Those who do read, they do not understand. Those who do understand, they immediately forget."

"Linus's law" is refered to as "Linus's fallacy" now.

And the ones that don't forget eventually get discouraged by having to go through people like him.

Reply on news.ycombinator.com