The Internet Is Broken, and Shellshock Is Just the Start of Our Woes | WIRED

An open source inconvenient truth

"For Robert Graham, the CEO of consultancy Errata Security, Shellshock gives lie to a major tenant of open-source software: that open-source code permits “many eyes” to view and then fix bugs more quickly than proprietary software, where the code is kept out of view from most of the world. It’s an idea known as Linus’s Law. “If many eyes had been looking at bash over the past 25 years, these bugs would’ve been found a long time ago,” Graham wrote on his blog last week.

Linus Torvalds—the guy that Linus’s Law is named after and the guy who created the Linux operating system—says that the idea still stands. But the fallacy is the idea that all open-source projects have many eyes. “[T]here’s a lot of code that doesn’t actually get very many eyes at all,” he says. “And a lot of open-source projects don’t actually have all that many developers involved, even when they are fairly core.”"

The Internet Is Broken, and Shellshock Is Just the Start of Our Woes | WIRED