Are All Bugs Shallow? Questioning Linus's Law 596
root777 writes to point out a provocative blog piece by a Microsoft program manager, questioning one of the almost unquestioned tenets of open source development: that given enough eyeballs, all bugs are shallow. Are they? Shawn Hernan looks at DARPA's Sardonix experiment and the Coverity static-analysis bug discovery program in open source projects to conclude that perhaps not enough eyeballs are in evidence. Is he wrong? Why? "Most members of the periphery [those outside the core developer group] do not have the necessary debugging skills ... the vast numbers of 'eyeballs' apparently do not exist. ... [C]ode review is hardly all that makes software more secure. Getting software right is very, very difficult. ... Code review alone is not sufficient. Testing is not sufficient. Tools are not sufficient. Features are not sufficient. None of the things we do in isolation are sufficient. To get software truly correct, especially to get it secure, you have to address all phases of the software development lifecycle, and integrate security into the day-to-day activities."
more shallow than Windows (Score:3, Insightful)
They become a lot shallower when you can look at the source code.
Re:more shallow than Windows (Score:4, Funny)
Presumably Microsoft employees do look at the source code but some days I have my doubts. (I'm kidding of course)
Re: (Score:3, Insightful)
So, given that Microsoft gave the source code to the Chinese government, and that there are a lot of Chinese... perhaps Microsoft products are also subject to the "more eyes" rule....
Just saying.... ;-p
Yes, but thanks to proprietary software, none of those bugs will be fixed, only found and exploited.
Yeah, right.... (Score:5, Insightful)
What do they say?
Re: (Score:3, Funny)
"The proof of the pudding is in the eating", or as in the case of Microsoft, "the proof of the FUDding is in the beating"...
Re: (Score:3, Interesting)
To play devil's advocate, there is the issue that Microsoft products have 10 times the "eyes" looking for security vulnerabilities than Linux-based products do. They also tend to have more features included.
And frankly, the proof *is* in the pudding. Windows 7 is an excellent product, and I've yet to run into a single bug in it. That's not to say there are no bugs, just that I haven't experienced any. So far, it's running far better than *any* Linux distro I've ever tried-- for one thing, it knows what to d
PEBCEK is the issue... (Score:4, Insightful)
Until you get your code into the hands of users who - for example - will repeatedly hit the ENTER key wile waiting for a response, you don't have a clue what might happen.
Re: (Score:3, Insightful)
I don't know that one could always consider user error as a "bug" in the software.
Given the potential variety of human experience and the ways in which software can be misused or abused, it's likely there is no way to make any piece of software "user proof", as you point out. ;)
SB
Re:PEBCEK is the issue... (Score:4, Insightful)
That's simply not true. Proper, bug-free code should fail gracefully in the event of odd user behavior. It may be that random mashing of the keyboard will give the user some unexpected results but it should never cause the program to go into a state that it was not designed to go into, such as trying to access 0x00000000.
Re:PEBCEK is the issue... (Score:4, Insightful)
The fact is, you can only do so much. the more idiot proof you think you have made it, eventually a big enough idiot with break it.
Re: (Score:2)
Choose freedom, not some $attribute (Score:5, Insightful)
Re:Choose freedom, not some $attribute (Score:5, Insightful)
Re: (Score:3, Insightful)
Exactly.
Microsoft is a business that exists to make money. (Obscene amounts of it, if you want my opinion.)
People who code free software generally do so to make better software.
I know which one I trust.
SB
Re: (Score:3, Insightful)
Don't be so hasty. Software is something that can be made for love of the art. Cars require significant capital investment in fabrication equipment and materials, capital most people do not have.
While not denying they can make good money, many in the caring professions do count the benefit they bring to others as a significant factor in their motivations, and I would indeed prefer it if my doctor had my best interest in mind rather than getting through his "caseload". I don't see why you put forward example
Re:Choose freedom, not some $attribute (Score:5, Insightful)
Is your argument supposed to mean that *we* should trust is the pin-striped suit wearing Dr. Fred MBogo [retrologic.com] with the 100 million dollar home, because he makes a lot of money?
Because in my interpretation of your metaphor the only thing that I can think that corresponds to Microsoft's track record would be Dr. Fred MBogo [retrologic.com].
I think a more accurate metaphor would be that Open Source corresponds to the FDA where all tests, procedures, and results are publicly reviewable, and that proprietary software like Microsoft's corresponds to superb marketers advertising the latest cancer curing snake oil that must be good because it costs so much and since the manufacturers live in dream mansions they must be legitimate.
Or to put it simply: open source chemistry, proprietary software alchemy. Here's my evidence: from wikipedia, some portions of the definition of the scientific method [wikipedia.org]:
Scientific method refers to a body of techniques for investigating phenomena, acquiring new knowledge, or correcting and integrating previous knowledge. To be termed scientific, a method of inquiry must be based on gathering observable, empirical and measurable evidence subject to specific principles of reasoning. A scientific method consists of the collection of data through observation and experimentation, and the formulation and testing of hypotheses.
....
Another basic expectation is to document, archive and share all data and methodology so they are available for careful scrutiny by other scientists, thereby allowing other researchers the opportunity to verify results by attempting to reproduce them. This practice, called full disclosure, also allows statistical measures of the reliability of these data to be established.
It needs shifting (Score:2)
Re: (Score:2)
Re: (Score:3, Insightful)
The great software writer Benjamin Franklin already wrote:
They who can give up essential freedom to obtain a little temporary security, deserve neither freedom nor security.
And if the poor man knew how often that line would be quoted (badly or not) in a context that has absolutely nothing to do with what he meant, he'd be spinning in his grave fast enough to provide the entire planet with energy and knock us out of orbit at the same time.
To get software truly correct... (Score:5, Insightful)
Since when does MS have the right to say "To get software truly correct..."? They KNOW how to make software secure?
Re: (Score:3, Funny)
Most Difficult Bug for Me (Score:3, Insightful)
One of my most difficult bugs was fixed by simply rescheduling the time a datamining job was to run (which was integrated in to a massive ERP system with other major components of which i had no insight). It took at least 24 hours to test everytime i created a new build. Essentially it was a scheduling ordering issue, where pre-processing of other processes wasn't done in time.. It took me a month to figure this one out. Some times the bugs are outside of the scope of your own system, and the bug will probably re-arise as data grows. I've also had some difficult threading issues where a wait is never notified caused by bad error handling, which was fixed by simply renaming a file (after 1 month of multi threaded debugging with the final session taking 3 days for one execution).
Re: (Score:3, Informative)
Apparently some system that I didn't have source code to was interpreting files based on the prefix of their name, and I thought I was following convention. Turns out, if the file wasn't of a particular format, it would hang. I didn't realize that by following convention, i was causing a bug, so I had to rename the data object file to not include the special prefix.. with was do_ when normally all data objects would simply be prefixed with do .
Code fixes (Score:5, Insightful)
That's kinda funny.
I spent part of today working around problems with a closed source application.
The other part of the day has been working with an open source program, where I've already solved the problem, and am documenting my changes to pass back to the author for the next release.
I'm not a "core" developer for any public projects. I've never submitted a bug fix to someone like Microsoft (but have sent bug complaints that went unanswered). I have sent quite a few bug fixes for open source applications, most of which were used in future release. I'm just another guy, or as indicated, another pair of eyes.
Re:Code fixes (Score:4, Insightful)
I'm not a "core" developer for any public projects. I've never submitted a bug fix to someone like Microsoft (but have sent bug complaints that went unanswered). I have sent quite a few bug fixes for open source applications, most of which were used in future release. I'm just another guy, or as indicated, another pair of eyes.
Well, in my experience what's annoying about closed source software is that you can't solve your own problems. I've reported quite a few defects and gotten quite a few of them fixed, but when you're working with a large vendor just getting through the support organization, down to development and back out through the normal release process means the implementation project is normally over before you get it. There's also a hotfix process but that creates its own headaches both in getting it, running other support cases on the same module and getting rid of it when it's rolled into a normal release.
Sometimes I really wish you could just patch it and roll your own build to solve your own problems. Right now, reporting bugs is more of a chore in the project and really more of a long term investment in not getting as many headaches in the future. I honestly admit there's been times where I've thought "man, am I glad I reported that six months ago" but other times I've cursed that I "wasted" time on support rather than just accept that it'll never work and get what works working and just do damage control on the rest. Ah well, nothing like a little undeserved flak for the consultant.
Re: (Score:2)
I did the same the other day for a proprietary security camera setup software (under windows) which is a fairly blatant ripoff of zoneminder.
The company that produced this software (some of you may know who I'm talking about) was no help to the business owner I was working for, he'd already spent a few hundred dollars working with their "support techs" - who were unable to solve his problem (conflict with a anti-malware app) and there is almost no support available online even for basic issu
Re: (Score:3, Insightful)
Silent L (Score:2)
Many bugs are caused by the silent L in in the word USER.
Re:Silent L (Score:4, Funny)
Ya it's a joke... (Score:2)
Re: (Score:2)
Yes. Yes, they are. (Score:2)
Any technological endeavor human beings work towards will always be subject to "more eyeballs means improvement". If there's not enough eyeballs, then there simply isn't enough people working on the problem.
I haven't RTFA. but from the summary, most of what this program manager says is intuitively obvious.
SB
Re: (Score:3, Funny)
Any technological endeavor human beings work towards will always be subject to "more eyeballs means improvement".
So that's why the more people there are on the committee that designed a language or protocol, the better the result. I'd always wondered about that.
He's partly right. (Score:4, Insightful)
...though perhaps not in the way he intends.
Look, software is *hard*. Building an OS kernel is like assembling a thousand watch movements by hand. You're going to screw up. It's not a matter of "if". There Are Always Mistakes.
Now, when he says "truly correct", I'm assuming he doesn't mean formal proving. That would be absurd, especially for an operating system as complex as Windows or Linux (or really anything with limited resources). Anything short of the formal proof and you just have empirical evidence that it works - but if there's a billion branches and trillions of code paths, nobody will hit all of them with all data.
Fact is, stuff is going to break. You can't prevent it.
So if we can't keep code from breaking - if all significant code is buggy - what's the answer? Well, with open-source code you can find a bug in your application and debug through the kernel itself, finding out why your syscall isn't returning the right information, and fix it yourself. Then everybody benefits from your work - keep in mind, you only did it (or needed to) because your application exposed a flaw. If you're using Linux 1.8 for some unholy reason, well you can fix it anyway (just nobody else will care).
But if you're using Windows, and you get bad return data from a method, your best shot is probably going to be to just coerce the data how you want it. This happens *all the time* in closed-source software - handle a buggy OS method with a special case.
So "many eyeballs" is correct, but not because there are thousands of expert code analysts poring over every git commit. It's correct because any piddly little application developer can debug the kernel itself, following his own method calls around to make sure they do the right thing. Even if he doesn't know how to fix it, he'll be able to say "doThis(*myData) isn't returning the right value" and lead the experts (writers/kernel hackers) straight to a fix.
This is the strength of open source, at least from a code quality standpoint.
Re: (Score:2)
never mentions design or economics (Score:5, Insightful)
The funny thing about this article is that he essentially never mentions (a) design flaws or (b) perverse economic incentives to sell defective software. IMO these are probably the two biggest reason why MS has such a terrible reputation on security.
As an example of a design flaw, there are lots and lots of things that MS designed for ease of use, while ignoring security. MS software is way too willing to execute code in an email or on a web page just because they wanted to do something flashy without putting any responsibility on the user to know what the heck was going on. This is a design flaw. No amount of debugging will ever fully succeed in working around it.
The economic incentives to ship buggy, insecure software are also huge. Companies gather revenue by putting out a new version of the software with a long list of features. Users who buy the new version of the software generally have no way of knowing that it's full of bugs. MS is of course infamous for this.
Of course the implication of the whole article is that MS pays people to fix bugs, while nothing like that is going on in the open source world. This is complete nonsense. Most well known open-source projects are written by paid coders. But let's not let facts get in the way of MS advertising.
No design or economics, but there is new Math (Score:2)
Mathematically, the many-eyeballs argument, and the million-monkeys argument are equivalent.
Yes, but this is only true if N(eyeballs) = 2 million - N(one-eyed monkeys) - 2*N(zero-eyed monkeys). Of course, once we have humans and their eyeballs involved, we will need modify this recently discovered Microsoft monkey-eye theorem. We should inquire if Microsoft considers human and monkey eyes equivalent in order to determine the effective conversion factor between human and monkey eyes.
A Microsoft Creationist would set the conversion rate at infinite, since our eyes are in the image of Go
I don't think he understands the argument (Score:5, Insightful)
From the article:
One cannot deny the logic. In fact, it is a tautology. If you assume that all individuals have a non-zero probability of finding and fixing a bug, then all you need is "enough" individuals.
Emphasis added by me to show where I think his argument goes off the rails. "Linus' law" does not assumed that each eyeball is a bug fixer--it simply states that bugs are made shallow. Often the hardest part of fixing a bug is knowing about it, and finding it. The open source process makes it easier to do both, even if there are only a small group of coders actually fixing things.
This is not about how many software engineers you have reviewing your code. It's about how your end users can interact with the software engineers.
Don't use a burning broom on a strawman (Score:4, Insightful)
Ladies and gentleman, the article author is making a strawman argument. By transforming the "Linus' Law" into a badly written syllogism, and pointing out examples where _his invented syllogism_ fails, he's implying that closed source is _better_. Unfortunately, the vulnerabilities of closed source are often worse, by comparison and from experience.
Classic absolutist fallacy (Score:3, Insightful)
When you bring more heat than light (Score:2)
One of these things is not like the other...
Features are to software correctness as apples are to oranges.
Really, do not subscribe me to your newsletter, mr 'program manager'
Why do we take M$ punditry seriously? (Score:5, Funny)
Let me rephrase this for him -
"For 25 years, we deliberately chose to ignore the bitter lessons that were learned by the big vendors, to take shortcuts
to ship shit software first and fix it later and to build up massive layers of cruft in the name of backward compatibility. Now we are caught in a nice pickle
as we've spent years trying fill the leaks in our crap - some of which is so insecure that, 8 years after the launch, we still have record numbers of bugs in
Windows XP almost every fucking Patch Tuesday -and restructure it into something rock solid.
However, until we can get this done, we need to play smoke and mirrors, convince you to toss Win XP - and your old PC, most likely, buy our latest
and greatest and spit out evermore FUD about how nobody else can get stuff done except us.
Ladies and gentlemen, I give you the M$ business plan and I'm pleased to say that it's working as well as ever and thank you all"
Did anyone ever believe it in the first place? (Score:2, Insightful)
I'm all for open source software. I could give you a dozen reasons why it's a great thing.
But does anyone REALLY believe it's bug-free because there are lots of eyeballs on it?
From the first time I heard that argument I thought it was laughable and not backed by any solid evidence.
He's attacking that argument for a simple reason: Because he can. It's a stupid argument.
And he's getting people all worked up and distracted over it.
Meanwhile, in the next room, Microsoft salespeople are convincing your boss they
Let me be the first to say (Score:2)
bla, bla, bla ,bla, bla
NEWS! (Score:5, Insightful)
Re: (Score:3, Insightful)
The quotation is not meant like an immutable law. There's a really good, important point there, but it's still just a meaningful aphorism. Let me help you with this -- when you see "given enough eyeballs, all bugs are shallow", read it as "given enough eyeballs, [almost all] bugs are shallow".
But that's not true, and the original version is correct. Given enough viewers - where "enough" might possibly be more than the number of people alive - every error will be obvious to at least one person.
FUD (Score:4, Insightful)
One big piece of FUD here is the notion that Microsoft programmers are paid, while open source programmers are not. The open source projects I know of advance mostly because of paid programmers, and I suspect that that is the case in general. That gives them the usual capitalist incentives for finding and removing bugs.
Only early bugs are shallow (Score:3, Interesting)
Actually, most bugs that survive initial testing are not shallow. If they were, they'd have been caught early.
A key point of the article is that almost nobody in the open source world is really looking hard at old code. An experiment was run to encourage code review, but nobody really wants to do that. This is related to the phenomenon that many open source projects stall out at version 0.x. The basic functionality is in, the fun part has been done, and the boring grind of making the last bits work isn't getting done.
Some bugs are so deep the open source process can't fix them. Search Google for "prune_one_dentry oops". The Linux kernel is known to crash when all free memory has been taken over as file cache, a process needs memory, and due to some lock being set, file cache space can't be released. Bugs of this type have been reported steadily since 2004, and it's still not fixed. It will probably take a redesign of some fragile code to fix that, and nobody wants to take that on.
Let me be ... (Score:5, Insightful)
I feel the need to explicitly call this guy a shill, rather than imply it. IF he honestly believes what he wrote, he's merely an idiot.
Shawn Hernan has deliberately misconstrued what Raymond wrote. Raymond explicitly said that the phrase "Given enough eyeballs, all bugs are shallow" was an informal phrasing of the lesson, in the very first sentence of the lesson. The actual phrasing was given as "Given a large enough beta-tester and co-developer base, almost every problem will be characterized quickly and the fix obvious to someone." There's not even one sentence separating the two.
Trying to rip apart an informal phrasing, and ascribing hidden syllogisms to it, tells me this man is either an ideologue or an idiot. Given his position, he's a dangerous ideologue or idiot.
Competently done it'd just be propaganda (Score:4, Informative)
He reports Coverity's results on open source software
... but doesn't report Coverity's results on Microsoft's software.
He reports that Coverity scanned 280 open-source projects
...but doesn't report that only 180 of those have "active developer support".
He can't be bothered to present any data at all on the distribution of the reported or corrected defects — how many are in nethack or aalib or that long-abandoned "flash-based photo album generator"?
He doesn't, for instance, mention that Samba and several others have no defects Coverity can discover. None.
Vim has none. X.org has ... three. All of KDE, nearly five million lines of code, has ... ninety. glibc has none.
There have been MySQL and PostgreSQL and Berkeley DB versions with none. His bioblurb says he's "currently working to ensure that Microsoft SQL Server is secure". That's interesting. You mean it isn't, now? How many defects can Coverity find in SQL Server?
TFA is a nauseating pile of sneers and aspersions ("Hope is not a security strategy"?) built on a very carefully selected and very few facts. "No one is doing auditing" he quotes. "No one is doing auditing" and reporting it to some self-styled central authority almost no one ever heard of is what's true, but telling the truth isn't what he's doing here. He's a "Program Manager", and he works for Microsoft.
Comment removed (Score:5, Insightful)
Re: (Score:2, Funny)
But then again, you get what you pay for so... oh wait
Re:Bugs are an error in the... (Score:5, Informative)
A ridiculous amount of the linux kernel code is written by programmers paid by IBM, Intel, RedHat, etc.
Someone pays. I'm just glad it isn't me.
Re:Bugs are an error in the... (Score:4, Insightful)
I think the matter that people get paid, nor that most of those working on the same area are from the same company will help in making Linus's Law 'more true'.
Yes, in general, the more people look at an issue, the more likely it is that someone will spot a bug, if there is one.
But - I give you the following caveats to this:
* people working closely together might reduce design flaws, but not necessarily implementation flaws - knowing specifically what a piece of code is doing CAN stand in your way of spotting subtle bugs in it (because the code more or less reads like what you expect). So, it helps to have more 'independent' pairs of eyeballs looking at the code.
* people not knowing the subject matter inside out are not on par with people who do. People who know how buffer overruns come about may figure out potential buffer overruns more likely than others. On the other hand, if, say, these people were to look at encryption code, they may see a potential for a buffer overrun, but not necessarily, whether the implementation of the encryption routines has a (not totally obvious) security flaw in the way it handles its keys; or whether any s-boxes may be good or not.
So, the more 'subject-matter-aware' eyeballs, which work independently of each other, look at a given code, the more likely you are getting a better review of the code.
I don't think I'm a bad C developer, but I don't think I could spot the majority of the linux kernel flaws because I do not know enough of the design of the kernel and potential interaction of areas of code.
Re:Bugs are an error in the... (Score:5, Insightful)
Re:Bugs are an error in the... (Score:5, Insightful)
There is a problem of deflection on another level. Most of Microsoft's problems when it comes
to security are design issues. Creating and then enforcing standards and policies with respect
to source code and development process is not going to help if the whole thing is broken as
designed. You will end up with a very consistent turd that looks good on paper.
Buffer overruns and such are not the most serious problem.
Re: (Score:3, Informative)
Creating and then enforcing standards and policies with respect
to source code and development process is not going to help if the whole thing is broken as
designed.
I was thinking of the irony of an MS project manager lecturing the Linux kernel devs on "bugginess."
Re: (Score:3, Informative)
* Ring 1 or higher code being able to write to Ring 0 locations.
* Administrative users necessary to run most things (MS software or otherwise).
* Proprietary networking.
* Lack of regression testing (LAND should just never have happened).
There's 5, who wants to take up the mantle from there.
Re:Bugs are an error in the... (Score:4, Informative)
To be fair to Microsoft this is no longer true. UAC asks the user if they wish to elevates privileges when an app does something unsafe. Vista took a lot of flak when UAC appeared (including from myself) but it did force user land applications to stop abusing the registry (e.g opening HKLM with read/write permissions), writing random files to random locations on disk and other unnecessary operations. The consequence is apps written / patched in the last 3 years run pretty cleanly and if they don't, you get the UAC popup. In practice it's little different from what happens in Ubuntu or OS X in similar circumstances.
Experience says otherwise (Score:3, Insightful)
Reality unfortunately insists otherwise. We can't blame Microsoft for it but it is still the rule rather than the exception. There are plenty of idiot developers out there that still have the single user MSDOS mindset where security is not seen as a problem because from their viewpoint the user only has a computer so that they can run that developers application and nothing else. "Security" dongles are a major offender and other bits of cr
Re: (Score:3, Interesting)
What do you mean by unmaintainable? How can it be unmaintainable, yet still be in use to this day?
You can use something that's unmaintainable. All "maintenance" is, in this context, is applying the necessary fixes to keep the OS reasonably current and secure. Every product, sooner or later, reaches a point where it's "not economically feasible" to continue making proper repairs-- you just wind-up spending too much money and time doing so.
Maintainability of --anything-- begins with good documentation and an engineering framework that allows for repairs of whatever is broken or functionality upgrades wi
Re: (Score:2, Insightful)
Freedom is your primary concern. There are certain ethical quandries that people just don't care about. For example, most people know that the low, low prices at large department stores are directly due to shabby treatment of worker in China and India, but they still shop there. Most people know that the meat, eggs and dairy that most fast food places use come from animals who live in tiny cages for all of their short lives, but people are still ordering sausage-and-egg-McMuffins. In this case, most people
Re:Bugs are an error in the... (Score:4, Insightful)
Well I don't see people joining PETA and saying "Hey you know what, our views are a little extreme, lets try be a little more level headed".
I don't see people joining Greenpeace and saying "Hey now, Genetic Engineering's alright y'all". And lets not get started on Sea Shepard.
You also don't see hippies and vegans going to MacDonald's or Wallmart and working there in the hope to make it more ethical.
The point I am trying to make is that GNU started as the environment for people who cared about those Freedoms. Linux became part of that and is Licensed under the GPL. It is part of the Ecosystem that cares about those Freedoms. To turn around and say, well maybe those Freedoms aren't important, maybe we should become more mainstream so we can cater to the masses who like MacDonalds and Wallmart and don't care about Hens in cages or sweatshops, is kind of besides the point.
We all have our own reasons for using Linux but it would not exist without those freedoms... If you have a different view on freedoms you can also use *BSD, Solaris or something like Haiku (Etc. etc.). If you don't care, there is NOTHING that is stopping you from using Windows or OSX.
I certainly know that if I emigrated to a country and started saying people should follow my political views I certainly wouldn't be well received, it's no different with the F/OSS sphere. It is what it is. It is what it is because of what it is and really, most of us have bigger mouths than we should.
The Developers are free to do what ever they want and their projects can go in what ever directions they want them to. Users like me can be thankful for what they give us. Yes some are more rabid in proclaiming the Freedoms, but then again if a single project isn't free enough, a half-assed effort of replacing it is at least made.
Long post after a tired and long day tl;dr: Freedoms could be only a concern for a minority, but a large part of what exists is because of them. Even if they aren't the most important thing doesn't mean they aren't important.
My kingdom for mod points (Score:3, Insightful)
You get it exactly and word it perfectly.
Linux IS its freedom, without it, it wouldn't be the same and might not even exist.
One of the most beautiful things I find about GNU/Linux is that I can get a working development AND/OR server environment all from a single package manager. That is because all the software is free, no endless license agreements to click through or setup programs that try to install all kinds of crap or require me to register. Just apt-get/pacman/emerge.
To me windows is the OS that
Re: (Score:3, Insightful)
we must point out that freedom is our primary concern
It might be yours, but when it comes to choosing software getting the job done cost effectively is mine. If the closed source commercial software will do the job and the FOSS won't then I'll choose the closed source commercial, thanks. It's not an automatic choice. Some FOSS is better than the closed source commercial, but some is complete rubbish, and in the latter case I couldn't give a monkeys about the "freedom" it gives me.
Re:Bugs are an error in the... (Score:5, Insightful)
Some of my points (IMHO, my 2 cents, works for me, etc.):
Mr Web Man: "Safari is way faster than Firefox on OS X and uses less resources."
Me: "Safari doesn't run at all on GNU/Linux or Solaris or FreeBSD. Besides, Firefox has a LOT of features that I like"
Mr Netbook Man: "The Gnome desktop is still kinda clunky, even after all these years."
Me: "I don't know what you mean by Clunky, but I prefer the functionality of Gnome over Windows or OSX any day of the week. Anyway, I like KDE and XFCE more than I like Gnome."
Mr Graphic Designer Man: "Linux still doesn't do proper color management."
Me: "I don't know what that means. You may be right."
Mr Gamer Man: "There aren't any decent games for Linux."
Me: "There are actually some decent games for GNU/Linux, but I agree that the selection could be greater. I hope the situation improves, but gaming is far from my primary concern"
You'll notice that I don't have to mention software freedom.
Re: (Score:3, Interesting)
Mr Graphic Designer Man: "Linux still doesn't do proper color management."
Me: "I don't know what that means. You may be right."
Funny that you mention that; I've throughly compared several CMS engines, from Adobe, Apple, Esko (formerly Barco), Efi (makers of the Fiery) and LittleCMS (the OS CMS used everywhere Linux need color management). Believe it or not, LCMS was right there with Efi on quality, a little better than Adobe, and waaay better than Esko (Apple was erratic, it seems to be a modification of Efi's engine). And it ran circles around everything else on terms of performance and resource utilization.
So, quality _can_ be
Re: (Score:3, Insightful)
I know that was a flippant remark, but step back and look at it.
The statement is an accurate, yet deeply depressing indictment of the modern world. We should be focused on making thing better, not accepting things the way they are.
Re: (Score:3, Interesting)
Specifics?
Some of my favorite FOSS stuff -- things I'd pick over the commercial al
Re:Bugs are an error in the... (Score:4, Informative)
Plan9 is in the Unix family, one secuirty alert in 15 years
Re: (Score:3, Insightful)
Microsoft has 90% of the market because of what they did in the late 80s and though the 90s that resulted in them becoming a convicted criminal monopolist. Please read up on that era and watch how those things play into how software development is so complex that once you commit to one you will almost never put the resources into any other, even though they may be viable. Software today is not a democracy. It is a dictatorship. OSS is the only free choice you have. That's not an extreme view, that's the
Re: (Score:3, Insightful)
Why do you think that MSFT has 90%+ of the market?
They don't. There's a whole world of computing out there beyond laptops and desktops. When it comes to embedded and server devices, Linux is kicking ass.
The majority of the population want pretty pictures controlling their computers, there's no doubting that. Aside from basic office apps, the PS3 could probably handle most of their needs (web browser, movies, pictures).
But when you want power, a GUI can't cut it. Sometimes you need to see the guts. And
Re: (Score:3, Insightful)
Note to self: Microsoft evangelists no jack-shit about Linux.
I have had few problems installing the latest versions of Ubuntu on my rather annoyingly difficult HP notebook with its goofy Broadcom drivers. By the same token, I have spent the better part of an hour trying to find appropriate drivers for similar notebooks (and don't get me started on when HP's universal print driver goes kersplonk).
This idea that somehow Windows is this insanely excellent platform, and that all the software for it is easy to
Re:Bugs are an error in the... (Score:5, Interesting)
Except the point he is trying to make is that his code is better then the competing individual because he follows process doctrine.
Unfortunately, to make his claims stick he took a failed project as an example to support his theories. While being quite pointed in defining what projects failed he did not cite which projects of his has succeeded. This would have been at least a good starting point for a real argument.
Is good process doctrine wrong? No, it won't hurt of course, but it's not quite a kevlar vest against root shells.
Besides more examples from both sides of the camp he really does neglect several facts. Many open source projects are often led or particpated by professionals as well. In fact a recent article suggested a great more open source projects are corporate sponsored.
It's just an awful piece when you consider he is painting his enemy as both unprofessional and only arming that foe with one failed project example.
Personally, I wanted to read something useful that I could learn from and grow with, but this is pretty standard tripe.
Re: (Score:3, Insightful)
Re: (Score:2)
I've had that argument posed to myself actually. My manager preferred I post often and clean it up later as the project evolved.
I'm more of a design, document, implement kinda guy. More often then not my initial designs and goals are a bit more complex and generally solved more problems then one.
However, they paid the bills so in the end it's up to my employer on my style. I prefer to make art more then utilities ;)
Re:Bugs are an error in the... (Score:5, Funny)
...A perfect program that is never written isn't very useful.
It is, however, bug-free!
Re:Bugs are an error in the... (Score:5, Insightful)
In product after product, Microsoft continues to ship fewer vulnerabilities than our competitors.
I wish he had cited some. It does not seem to be anyone's experience, and the only study I have ever seen that said that Windows was more secure than Linux did so by counting each Linux vulnerability several times (once per distro), and comparing just Windows against entire Linux repositories.
He also looks only at whether more eyeballs are good, neglecting the disadvantage of the uniformity of the WIndows monoculture, etc.
He also argues that the Coverity scan was not an example of many eyeballs because it was government funded. So, the government paid for it - but it still happened.
He does cite some stuff including, hilariously, a study carried out in 2002 that concluded that Linux was close to becoming unmaintainable. Eight years later I am pretty sure it is being maintained.
I am also wondering about the advantages of there beinga lot of code that is shared by multiple projects. I remember a BSD code review catching an X Windows bug. In that particular case it was not fixed upstream because the XFree86 people were being awkward, but I wonder how many cases there are of stuff getting fixed.
It is also easier to report open source bugs. I have never reported a bug in a proprietary app, but I have reported lots of Linux bugs (mostly distro level, or fixable at distro level) because I can follow what it happening, and I know what the (usually good) reaction to my individual report is.
Re: (Score:3, Insightful)
It is also easier to report open source bugs. I have never reported a bug in a proprietary app, but I have reported lots of Linux bugs (mostly distro level, or fixable at distro level) because I can follow what it happening, and I know what the (usually good) reaction to my individual report is.
Report a closed source bug and you get fobbed off by first line support who know less than you. You have little change of ever talking to someone who understands the problem.
Report a open source bug and you get told why you are wrong, or why they can't be bothered to fix it, or how unreasonable you are for demanding they fix your problems. But if you provide a patch you have a chance of being taken seriously.
It's not exactly easy either way around.
Re: (Score:3, Insightful)
I think a better point for him to make might be that good software development in practice requires you pay people to do it. Who does the paying probably matters to some degree, but unpaid people are probably more inclined to solve problems interesting to them than problems which are boring but ought to be fixed.
He's arguing, probably correctly, that open source software is not necessarily secure because you can put and infinite number of eyes on it. There are not, in practice infinite number of developer
Re: (Score:3, Interesting)
This argument is logical, and reasonable.....but for all that is wrong
Linux is (surprisingly) not riddled with bugs, not full of security holes, and is maintained
Microsoft products (surprisingly) do have security holes, do have bugs, and these are left unpatched until people complain ...
The problem is that in general people who use Linux complain about the flaws, and if the people who manage the code agree it is a flaw, then it does get fixed, the only cost is time .... with Microsoft fixing/not fixing eac
Re: (Score:3, Interesting)
Well the catch is that linux developers are mostly being paid. That's IMO what's taken say pre ubuntu linux from being an amusing nerd gimmick to something a normal human being might actually use for something. Firefox developers are being paid too.
If you pay people to do the wrong things the product will suck. Linux benefits from several eyes on the problem of deciding where development money should go. But that's the same weakness. What happens to firefox when the product they sell: A google startpage,
Re:Bugs are an error in the... (Score:5, Interesting)
I also think a big difference is that you psychologically don't write shitty code when you think others are going to look at it.
Coders that write shitty code don't know that they write shitty code. From their perspective the code is just fine and even very good. When ever I told someone I don't like his code and challenged him to explain what he did and why, he only answered: "erm, well that is what the code should do as the requirements demand that", they had no idea what my point was and when I pointed i tout they shrugged and did not understand or value my concerns.
angel'o'sphere
Re:Bugs are an error in the... (Score:5, Insightful)
Re: (Score:2)
SB
Re: (Score:2)
I've written a lot of code on short notice for deadlines; but even then I can't say I've written "shitty code" in a long time. But I limit my interpretation in such cases to code that is bug prone and/or hard to read. Anything that is stable and easy to read can be optimized/expanded at a later time if necessary.
Re:Bugs are an error in the... (Score:5, Interesting)
What the essay fails to capture is the nature of the functioning of the eyeballs in practice, between open source and closed source. In closed source, the eyeballs only look at what they are paid to look at, if the code is just barely good enough to sell, then out it goes and nobody looks at that code again until the complaints start rolling in and then and only the do they fix it, well, sort of fix it, they of course only fix it just barely enough to silence the noisiest of complaints and the only if there are real consequences for failing to do so. Don't think so then try this http://social.technet.microsoft.com/Search/en-GB?query=this%20is%20a%20know%20fault&ac=8 [microsoft.com] and a huge number of them have never been fixed.
Open source follows a completely different series of routes;
1) People looking for faults because they get a kick out of finding them and fixing them.
2) Tweaks to functions that indirectly remove bugs by simply replacing them with better code.
3) Discoveries in user interactions, less of a complaint because there is no force in pushing the fix.
5) Governments and government departments directly pursuing more secure code.
6) Corporations seeking to build a public reputation by demonstrating coding expertise.
So in the case of open source software there are many 'different' kinds of eyes, so those eyes all working from different perspectives do in reality make bugs very shallow. In the closed source proprietary world the bugs are buried in the depths of the code, hiding in the dark, basically because of profits versus workmanship issues, which means no light is shone on them because only one set of eyes looking from a single 'shallow' perspective looks at them.
There is of course one other set of eyes looking at code, the saboteurs both private and government, looking for faults to exploit. Hard with open source because it can rapidly turn around and bite you on the arse if you use it (if you protect against it everybody notices). Closed source (mostly but a lot of less than honourable eyes lend up looking at it), of course can be targeted as long as you, well, use open source code yourself whilst promoting closed source to everybody else (hmm, kind of reminds me of all those mainland China computer companies, odd that, isn't it).
Re: (Score:3, Insightful)
Re:Bugs are an error in the... (Score:5, Insightful)
I think that in Microsoft's case in particular, all the exploits out there prove the opposite of his case.
I'm not a MS dev or even anyone important, just a small business owner who fixes infected Windows machines (it's better than 3/4 of the work I do, sadly) so it seems to me that security wise at least he is way off base - the many more eyes that are looking at MS Windows without even having access to the code base are doing a pretty damned good job of finding security bugs in it.
SB
Re:Bugs are an error in the... (Score:5, Interesting)
True, but that's not what he is questioning. Given two identical projects that are fairly complex (i.e. an OS kernel) he's saying that just being open source doesn't necessarily provide "more eyes". While I think there is a bit of merit to this, it certainly doesn't hurt to have more eyes possible - especially when you don't have to pay for them.
Agreed, of course. However, the converse is important, too:
Given two identical projects that are fairly complex (i.e. an OS kernel), being closed source virtually guarantees that there won't be 'more eyes'.
But the real question is: How many eyes are enough?
The answer is its own problem: Only one more pair. The tricky part is figuring out whose they are. (Yes, I'm in screaming agreement with what the OP is saying.)
It's a quality issue as much as it's a question of quantity. Ben Laurie [links.org], writing about the Debian OpenSSL Fiasco [imagicity.com], states:
So yes, it does matter whose eyes are turned to a particular problem. The difference between FOSS/Open Source and Closed Source is therefore whether the Closed Source company has hired the right people and whether the FOSS project has gained the attention and interest of the right people.
Neither of those situations is guaranteed, but they are not at all equivalent. (Especially when we consider that for many of the best FOSS products, gaining the attention and interest of the right people is done by employing them.) Realistically, FOSS faces better odds of having bugs found and fixed, all else being equal.
Re: (Score:2)
Re: (Score:2)
Then you probably miss out on a lot of good information because someone makes a basic mistake.
IME pedants are usually so busy proofreading they miss the gist of the content. ;-)
Me included!
SB
Re: (Score:3, Insightful)
What process error is that other than human error? There's almost no way to ensure that human error will ever occur regardless of what type of process is being used. You can argue that
Re:Bugs are an error in the... (Score:5, Informative)
Bugs are an error in the process, not the code. If you find a bug, you need to find the process error that allowed that bug to occur.
Agreed!
I read, with interest, the referenced article. I was expecting FUD - but I didn't find much, until I reached the Conclusion.
eg.
The many eyeballs argument is neat, tidy, compelling, and wrong.
The article starts with
Eric S. Raymond wrote [catb.org], “Given enough eyeballs, all bugs are shallow.” He calls this Linus’ law.
and then attempts to refute. Fair enough. Except - the link leads to The Cathedral And The Bazaar - where I cannot find the quote... Hmmm
Now this might be relevant if the "many eyes" routine was the only form of audit used in GNU/Linux - but [nsa.gov] is not [coverity.com] the only [google.com] form of review/audit used. I'm sure other, more knowledgable posters will be able to provide more evidence than I could find in a quick search.
I call FUD
Re:Bugs are an error in the... (Score:4, Insightful)
Absolutely right. The author seems to be making the argument a lack of pay implies a lack of skill.
From the article:
According to Cowan, who is now a Security Program Manager for Windows, “the scientific conclusion of Sardonix is that auditing is both demanding of high skill and tedious, and so karma/reputation/good will is not enough to motivate people to do it. You must pay them to do it, precisely as Microsoft does.
The author is right that the "many eyeballs" scheme needs skilled eyeballs to work, but assumes that the only way to get good people on a project is by paying them. It seems odd that an article that tries so hard to provide a compelling argument makes such a poorly backed assumption. It's certainly true that good people need to be payed, but they can be paid to work on free software or write free software in their spare time; both cases have many examples.
Bugs are errors in code as well - Duh! (Score:3, Insightful)
Bugs are an error in the process, not the code. If you find a bug, you need to find the process error that allowed that bug to occur.
Not in the code?
Of course bugs are errors in the code. Duh! And sure, bugs may be errors in the process as well.
But why the false antithesis?
-wb-
Open Source allows the right eyes to see (Score:3, Insightful)
Re:Bugs Exist Because We Use the Wrong Software Mo (Score:3, Insightful)
I defend the hypothesis that the two major crises that afflict the computer industry (unreliability and low productivity) are due to our having adopted the Turing Machine as the de facto computing model in the last century
You're hypothesis fails by being based on false assumptions. The Von Neumann architecture has been the de facto computing model, not the Turing Machine. Turing Machines suck at IO.
Furthermore you don't seem to understand that the reason computer programs are, as you call them, unreliable and low productivity, is mainly because programming is hard, and most of the time this has nothing to do with threads. Have you ever spent hours trying to get elements to line up perfectly on a web page in three differ
Re:Perfect code may not be perfect.. (Score:5, Informative)
Sorry, that's totally wrong. The Airbus FBW systems do allow reversion back to "just do what the damn human says". However, in the situation that aircraft was in, if it were a 1972 manufactured Boeing 747 with the same fault (no airspeed indication, inside a storm, in a flight regime where stall speed and maximum mach number are very close together) it is likely that the end result would have been the same.
Incidentally, how the A320 allows human handling of exception was very well demonstrated by the United flight that ended up in the Hudson - in which no lives were lost despite a very difficult situation.
Re: (Score:3, Interesting)