Hacker News Reader

Comment by mack1001 | Hacker News Reader

Doesn’t this call for an OSS vehicle platform that can be reviewed by thousands of contributors to avoid these type of issues?

View on HN

Unfortunately, evidence [1] suggests that the rate of bug detection by reviewers does not scale linearly with the number of reviewers, adding more than 4 reviewers uncovers bugs at a much lower rate [2].

However I absolutely agree that better / more extensive / diligent code reviews are part of the solution to improve code quality and eliminate these kinds of defects. It's tough to create the right kind of incentive structures for reviewers internally at a company; maybe the future will have specialist firms that provide review-as-a-service for a fee, or perhaps firms could trade review-hours (all under strict NDAs I'd imagine).

[1] Glass: https://books.google.gr/books?id=3Ntz-UJzZN0C&pg=PA174&redir... [2] https://en.wikipedia.org/wiki/Linus%27s_Law

I see that the "many eyes" hypothesis lives on, despite the accumulation of contrary evidence.

Well usually the difference between open source and proprietary is that the proprietary vendors are slow to fix security issues because it doesn't increase their profit. In some cases they even try to hide the fact that the software is insecure or even sue the person who reported the vulnerability. Meanwhile most OSS software gets fixed as soon as the vulnerability is found.

In the case of aircraft though a company could find a bug and do their best to fix it quickly. But if the plan is already flying any changes to the software require a re-certification of the software which can take months.

Reply on news.ycombinator.com