Comment by tombert

ESR's "many eyes" quote in his "Linus's Law" is unmitigated bullshit. And Linux Torvalds should not be blamed for it, since it wasn't his law, ESR just named it after him to get attention. Hardly anyone actually reads code, and the few people actually qualified to find bugs by reading huge piles of buggy code dumped into the public domain when a company abandons it have much more important things to do with their time.

If the many eyes that Macromedia and Adobe paid to work full time on Flash couldn't prevent the need to push out Flash security patches several times a week, the code is fundamentally flawed far beyond the point that the few much less qualified people who might actually take their unpaid spare time to look at it are able to finally find and fix all the bugs.

The major browser developers have enough on their hands designing new open standards and writing and debugging new code, without having to spend any of their time burning their eyes and brains looking at free abandoned obsolete toxic waste code dumps. And ESR certainly isn't going to chip in and help them.

>He made up the ridiculous "many eyes" quote himself, then misnamed it "Linus's Law" to avoid personal responsibility and shift the blame to innocent Linus Torvalds, who never said such a stupid thing, and which HeartBleed and many other eyeballable bugs proved terribly wrong and misguided.

>About which the salty security expert Theo de Raadt famously said "Oh right, let's hear some of that "many eyes" crap again. My favorite part of the "many eyes" argument is how few bugs were found by the two eyes of Eric (the originator of the statement). All the many eyes are apparently attached to a lot of hands that type lots of words about many eyes, and never actually audit code."