Rigorous Review

The newest Free and Open Source exploit is called Shellshock, and I hope it will finally illustrate that GNU/Linux is not free of bugs, any more (or less) than closed source code is free of bugs.

However, I've seen several articles in which columnists continue to write as if every piece of open source code has many eyes looking at it (which is not always true) or as if every piece of closed source code goes though rigorous design review and testing by legions of engineers (equally untrue). The answer, as always, lies somewhere in the middle.

Yes, some companies have good design and code reviews that proceed to a field test or beta release that allows end users to test and submit bug reports before the product is unleashed on the general public. Even in the largest companies, however, some projects receive little engineering consideration. The code is written once by engineering, then patched and expanded over time according to bug fix requests and feature requests from end users. Over time, fewer engineers work on each part, with fewer "eyes" on the code.

[...]