Hacker News new | past | comments | ask | show | jobs | submit login

This argument comes up super frequently. Yes, more people actually reading the source code is better for identifying security vulnerabilities, but that almost never how it’s either articulated or implied.

When most people make this argument the suggestion is that popular software must be more secure because somebody would have certainly identified and reported the vulnerability. That makes several assumptions not qualified by evidence. In other words it’s wishful thinking.

As a case in point when I reported my first V8 defect it was around the time of Node 4.4. Chrome had been out for several years at that point with many millions of users. The defect I found was that V8 could not perform recursion using only function name. WTF. The problem was missing test cases, not a lack of eye balls.




To adjust an old joke about economics:

“Two open source maintainers are walking along the street when one says:

Look! A repo exposing an API allowing unprivileged deletion of users!

The other replied: that vulnerability clearly cannot be real, as someone would have fixed it already.”




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: